spritesheet.js Injection Vulnerability

spritesheet.js is a command line Spritesheet aka Texture Atlas generator written in node.js by the Polish individual developer Krzysztof-o spritesheet.js. Provides Spritesheet aka Texture Atlas command line generation. An injection vulnerability exists in spritsheet. The vulnerability stems from...

Cisco SD-WAN Command Line Unauthorized Access

The vulnerability of the command-line interface of Cisco SD-WAN programs exists due to insufficient validation of input data in iperf. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

Cisco SD-WAN CLI Unauthorized Access

The vulnerability of the command-line interface CLI of Cisco SD-WAN software-defined networks is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

Fedora: Security Advisory for python-pygments (FEDORA-2021-175e686ca6)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 32 Update: python-pygments-2.4.2-8.fc32

Pygments is a generic syntax highlighter for general use in all kinds of software such as forum systems, wikis or other applications that need to prettify source code. Highlights are: a wide range of common languages and markup formats is supported special attention is paid to details that increa...

[SECURITY] Fedora 33 Update: python-pygments-2.6.1-5.fc33

Pygments is a generic syntax highlighter for general use in all kinds of software such as forum systems, wikis or other applications that need to prettify source code. Highlights are: a wide range of common languages and markup formats is supported special attention is paid to details that increa...

Cisco Patches Recently Disclosed "sudo" Vulnerability (CVE-2021-3156) in Multiple Products

While Punxsutawney Phil may have said we only have six more weeks of winter, the need to patch software and hardware weaknesses will, unfortunately, never end. Cisco has released security updates to address vulnerabilities in most of their product portfolio, some of which may be exploited to gain...

CVE-2021-1370

A vulnerability in a CLI command of Cisco IOS XR Software for the Cisco 8000 Series Routers and Network Convergence System 540 Series Routers running NCS540L software images could allow an authenticated, local attacker to elevate their privilege to root. To exploit this vulnerability, an attacker...

Hotfix XS82E016 - For Citrix Hypervisor 8.2

Who Should Install This Hotfix? This is a hotfix for customers running Citrix Hypervisor 8.2. All customers who are affected by the issues described inCTX291439 - Citrix Hypervisor Multiple Security Updatesshould install this hotfix. Information About this Hotfix Component| Details ---|---...

CVE-2021-1128

A vulnerability in the CLI parser of Cisco IOS XR Software could allow an authenticated, local attacker to view more information than their privileges allow. The vulnerability is due to insufficient application of restrictions during the execution of a specific command. An attacker could exploit...

Solaris 10 (Intel) - 'dtprintinfo' Local Privilege Escalation (2)

Exploit Title: Solaris 10 1/13 Intel - 'dtprintinfo' Local Privilege Escalation 2 Date: 2021-02-01 Exploit Author: Marco Ivaldi Vendor Homepage: https://www.oracle.com/solaris/solaris10/ Version: Solaris 10 Tested on: Solaris 10 1/13 Intel / raptordtprintcheckdirintel.c - Solaris/Intel 0day? LPE...

chrome-launcher Command Injection

The vulnerability of the chrome-launcher software exists due to the lack of measures taken to neutralize special elements used in the operating system’s command line. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...

Exploit for Off-by-one Error in Sudo_Project Sudo

CVE-2021-3156 Description Sudo before 1.9.5p2 has a Heap-based...

CentOS 8 : virt-manager (CESA-2019:3464)

The remote CentOS Linux 8 host has packages installed that are affected by a vulnerability as referenced in the CESA-2019:3464 advisory. - virt-install: unattended option leaks password via command line argument CVE-2019-10183 Note that Nessus has not tested for this issue but has instead relied...

Exploit for Off-by-one Error in Sudo_Project Sudo

CVE-2021-3156 Ansible role patches CVE-2021-3156 for Cent...

Privilege Escalation

sudo is vulnerable to privilege escalation. The vulnerability exists through a heap-based buffer overflow, through sudoedit -s and a command line argument ending with a \ character...

sudo: Heap buffer overflow in argument parsing

A flaw was found in sudo. A heap-based buffer overflow was found in the way sudo parses command line arguments. This flaw is exploitable by any local user who can execute the sudo command by default, any local user can execute sudo without authentication. Successful exploitation of this flaw coul...

gnome-settings-daemon: Red Hat Customer Portal password logged and passed as command line argument when user registers through GNOME control center

A flaw was found in the GNOME Control Center, where it improperly uses Red Hat Customer Portal credentials when a user registers a system through the GNOME Settings User Interface. This flaw allows a local attacker to discover the Red Hat Customer Portal password. The highest threat from this...

CVE-2021-3156: Off-by-one Error

Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow, which allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character...

Important: sudo

Issue Overview: When sudo runs a command in shell mode, either via the -s or -i command line option, it escapes special characters in the command's arguments with a backslash. The sudoers policy plugin will then remove the escape characters from the arguments before evaluating the sudoers policy...