987 matches found
PT-2021-18019
Name of the Vulnerable Software and Affected Versions: rConfig server version 3.9.6 Description: The issue is related to insecure permissions of the chmod command on the rConfig server. After installation, the apache user may execute chmod as root without a password, potentially allowing an...
CVE-2021-29005: Incorrect Default Permissions
Insecure permission of chmod command on rConfig server 3.9.6 exists. After installing rConfig apache user may execute chmod as root without password which may let an attacker with low privilege to gain root access on server...
rConfig security vulnerability
rConfig is an open source network device configuration management utility . An insecure privilege vulnerability exists in the chmod command in rConfig version 3.9.6. The vulnerability stems from the fact that after installing rConfig, an apache user can execute chmod as root without a password,...
CVE-2021-41089 `docker cp` allows unexpected chmod of host files
Moby is an open-source project created by Docker to enable software containerization. A bug was found in Moby Docker Engine where attempting to copy files using docker cp into a specially-crafted container can result in Unix file permission changes for existing files in the host’s filesystem,...
Privilege Escalation
systemd-cron:sid is vulnerable to privilege escalation. In the cron package, the postinst maintainer script allows for group-crontab-to-root privilege escalation via symlink attacks against unsafe usage of the chown and chmod programs...
Containerd Privilege Escalation
The vulnerability of the chmod command implementation in the container runtime system, Containerd, is related to deficiencies in the isolation of the controlled system area. Exploiting this vulnerability allows a remote attacker to increase their privileges...
CVE-2021-30463
VestaCP through 0.9.8-24 allows attackers to gain privileges by creating symlinks to files for which they lack permissions. After reading the RKEY value from user.conf under the /usr/local/vesta/data/users/admin directory, the admin password can be changed via a...
Default credentials
VestaCP through 0.9.8-24 allows attackers to gain privileges by creating symlinks to files for which they lack permissions. After reading the RKEY value from user.conf under the /usr/local/vesta/data/users/admin directory, the admin password can be changed via a...
CVE-2021-30463
VestaCP
CVE-2021-30463
VestaCP through 0.9.8-24 allows attackers to gain privileges by creating symlinks to files for which they lack permissions. After reading the RKEY value from user.conf under the /usr/local/vesta/data/users/admin directory, the admin password can be changed via a...
PT-2021-18739
Name of the Vulnerable Software and Affected Versions VestaCP versions prior to 0.9.8-25 Description The issue allows attackers to gain privileges by creating symlinks to files for which they lack permissions. This can be achieved by reading the RKEY value from user.conf under the...
CVE-2021-30463: Improper Link Resolution Before File Access
VestaCP through 0.9.8-24 allows attackers to gain privileges by creating symlinks to files for which they lack permissions. After reading the RKEY value from user.conf under the /usr/local/vesta/data/users/admin directory, the admin password can be changed via a...
ClusterLabs Hawk security vulnerability
ClusterLabs Hawk is a ClusterLabs open source application. It is used to manage and monitor Pacemaker HA clusters. ClusterLabs Hawk has a security vulnerability that allows an attacker to bypass access restrictions to read or modify data using chmod...
Exploit for SQL Injection in Icegram Email_Subscribers_\&_Newsletters
CVE-2019-20361-EXPLOIT There was a flaw in the WordPress plugi...
Unspecified Vulnerability in SolarWinds Serv-U FTP Server
SolarWinds Serv-U FTP Server is a set of U.S. SolarWinds FTP and MFT file transfer software. A security vulnerability exists in SolarWinds Serv-U FTP Server versions prior to 15.2.1 that stems from the server not properly handling CHMOD commands, no details of the vulnerability are provided at th...
CVE-2020-15542
SolarWinds Serv-U FTP server before 15.2.1 mishandles the CHMOD command...
CVE-2020-15542
SolarWinds Serv-U FTP server before 15.2.1 mishandles the CHMOD command...
CVE-2020-15542
SolarWinds Serv-U FTP server before 15.2.1 mishandles the CHMOD command...
CVE-2020-15542
Summary: CVE-2020-15542 affects SolarWinds Serv-U FTP Server prior to version 15.2.1, due to mishandling of the CHMOD command. The connected documents confirm the vendor release of 15.2.1 as a fix (per Serv-U 15-2-1 release notes). Impact (as stated): The CVSS metrics in the reference indicate hi...