cve-2022-33891

CVE-2022-33891 Vulnerabilità di Command Injection in Apache Spark Shell Un POC Python per sfruttare la vulnerabilità di command injection in Apache Spark Shell. Ho visto altri POC in giro ma sembravano super loschi. Questo è pulito e semplice. Non ho scoperto io questo exploit/vulnerabilità. Vole...

CVE-2022-33891

CVE-2022-33891 PoC PoC para CVE-2022-33891, com capacidade de definir payloads personalizados. Não vulnerável por padrão -- spark.acls.enable precisa ser TRUE. Uso pretendido A utilização deste script é limitada a pessoal autorizado a executar o payload nos hosts de destino exclusivamente para fi...

cve-2022-33891

CVE-2022-33891 Sicherheitslücke zur Befehlseinschleusung in der Apache Spark Shell Ein Python-POC zur Ausnutzung der Sicherheitslücke zur Befehlseinschleusung in der Apache Spark Shell. Ich habe einige andere POCs gesehen, aber sie sahen sehr verdächtig aus. Dieser ist sauber und einfach. Ich hab...

CVE-2019-15901

An issue was discovered in slicer69 doas before 6.2 on certain platforms other than OpenBSD. A setusercontext3 call with flags to change the UID, primary GID, and secondary GIDs was replaced on certain platforms: Linux and possibly NetBSD with a single setuid2 call. This resulted in neither...

CVE-2019-15900

An issue was discovered in slicer69 doas before 6.2 on certain platforms other than OpenBSD. On platforms without strtonum3, sscanf was used without checking for error cases. Instead, the uninitialized variable errstr was checked and in some cases returned success even if sscanf failed. The resul...

DEBIAN-CVE-2023-28339

OpenDoas through 6.8.2, when TIOCSTI is available, allows privilege escalation because of sharing a terminal with the original session. NOTE: TIOCSTI is unavailable in OpenBSD 6.0 and later, and can be made unavailable in the Linux kernel 6.2 and later...

Authorization Bypass

doas is vulnerable to authorization bypass. The vulnerability exists as the PATH variable was incorrectly inherited by authenticated executions if the authenticating rule allowed the user to execute any command...

The vulnerability of the setusercontext() function in the doas utility allows a attacker to compromise the integrity, confidentiality, and accessibility of the protected information.

The vulnerability of the setusercontext function in the doas utility exists due to insufficient validation of input data. Exploiting this vulnerability could allow a remote attacker to compromise the integrity, confidentiality, and accessibility of the protected information...

Unspecified vulnerability in slicer69 doas

slicer69 doas is a utility program used on the OpenBSD platform to execute privileged commands for Root users. A security vulnerability exists in slicer69 doas versions prior to 6.2, which can be exploited by an attacker to execute commands with root privileges...

CVE-2019-15901

An issue was discovered in slicer69 doas before 6.2 on certain platforms other than OpenBSD. A setusercontext3 call with flags to change the UID, primary GID, and secondary GIDs was replaced on certain platforms: Linux and possibly NetBSD with a single setuid2 call. This resulted in neither...

CVE-2019-15900

An issue was discovered in slicer69 doas before 6.2 on certain platforms other than OpenBSD. On platforms without strtonum3, sscanf was used without checking for error cases. Instead, the uninitialized variable errstr was checked and in some cases returned success even if sscanf failed. The resul...

CVE-2019-15901

An issue was discovered in slicer69 doas before 6.2 on certain platforms other than OpenBSD. A setusercontext3 call with flags to change the UID, primary GID, and secondary GIDs was replaced on certain platforms: Linux and possibly NetBSD with a single setuid2 call. This resulted in neither...

CVE-2019-15900

An issue was discovered in slicer69 doas before 6.2 on certain platforms other than OpenBSD. On platforms without strtonum3, sscanf was used without checking for error cases. Instead, the uninitialized variable errstr was checked and in some cases returned success even if sscanf failed. The resul...

Design/Logic Flaw

An issue was discovered in slicer69 doas before 6.2 on certain platforms other than OpenBSD. A setusercontext3 call with flags to change the UID, primary GID, and secondary GIDs was replaced on certain platforms: Linux and possibly NetBSD with a single setuid2 call. This resulted in neither...

Command injection

An issue was discovered in slicer69 doas before 6.2 on certain platforms other than OpenBSD. On platforms without strtonum3, sscanf was used without checking for error cases. Instead, the uninitialized variable errstr was checked and in some cases returned success even if sscanf failed. The resul...

CVE-2019-15901

The CVE concerns slicer69 doas prior to 6.2 on non-OpenBSD platforms (Linux, possibly NetBSD). A setusercontext(3) call intended to adjust UID, primary GID, and secondary GIDs was replaced with a single setuid(2) call. As a result, the group ID is not changed and secondary group IDs are not initi...

CVE-2019-15901

An issue was discovered in slicer69 doas before 6.2 on certain platforms other than OpenBSD. A setusercontext3 call with flags to change the UID, primary GID, and secondary GIDs was replaced on certain platforms: Linux and possibly NetBSD with a single setuid2 call. This resulted in neither...

CVE-2019-15900

Consolidated details across NVD/Red Hat/OSV/PRION/CVE records show CVE-2019-15900 affects slicer69 doas before 6.2 on platforms other than OpenBSD. Root cause: on platforms lacking strtonum(3), the code uses sscanf without checking errors and inspects an uninitialized errstr, which can lead to su...

PT-2019-14463 · Slicer69 · Slicer69 Doas

Name of the Vulnerable Software and Affected Versions: slicer69 doas versions prior to 6.2 Description: An issue was discovered in slicer69 doas where sscanf was used without checking for error cases on platforms without strtonum3. The uninitialized variable errstr was checked, and in some cases,...

FreeBSD : doas -- Prevent passing of environment variables (7f7d6412-bae5-11e9-be92-3085a9a95629)

Jesse Smith upstream author of the doas program reported : Previous versions of 'doas' transferred most environment variables, such as USER, HOME, and PATH from the original user to the target user. Passing these variables could cause files in the wrong path or home directory to be read or writte...