CVE-2024-48651

In ProFTPD through 1.3.8b before cec01cc, supplemental group inheritance grants unintended access to GID 0 because of the lack of supplemental groups from modsql...

CVE-2023-5575

Improper access control in the permission inheritance in Devolutions Server 2022.3.13.0 and earlier allows an attacker that compromised a low privileged user to access entries via a specific combination of permissions in the entry and in its parent...

CVE-2022-34787

Jenkins Project Inheritance Plugin 21.04.03 and earlier does not escape the reason a build is blocked in tooltips, resulting in a cross-site scripting XSS vulnerability exploitable by attackers able to control the reason a queue item is blocked...

CVE-2019-10407

Jenkins Project Inheritance Plugin 2.0.0 and earlier displayed a list of environment variables passed to a build without masking sensitive variables contributed by the Mask Passwords Plugin...

CVE-2019-10408

A cross-site request forgery vulnerability in Jenkins Project Inheritance Plugin 2.0.0 and earlier allowed attackers to trigger project generation from templates...

CVE-2003-1575

VERITAS File System VxFS 3.3.3, 3.4, and 3.5 before MP1 Rolling Patch 02 for Sun Solaris 2.5.1 through 9 does not properly implement inheritance of default ACLs in certain circumstances related to the characteristics of a directory inode, which allows local users to bypass intended file permissio...

Intel Simics Package Manager 安全漏洞

Intel Simics Package Manager is a complete system simulation technology from Intel Corporation USA. It provides software and system developers, architects, and test engineers with the means to build and use virtual systems or create multiple virtual connected systems for a variety of purposes. A...

Intel Simics Package Manager 安全漏洞

Intel Simics Package Manager is a complete system simulation technology from Intel Corporation USA. It provides software and system developers, architects, and test engineers with the means to build and use virtual systems or create multiple virtual connected systems for a variety of purposes. A...

Intel Ethernet Network Adapter E810 Series 安全漏洞

Intel Ethernet Network Adapter E810 Series is a series of high-performance data center-class Ethernet adapters from Intel Corporation USA. A security vulnerability exists in Intel Ethernet Network Adapter E810 Series versions prior to 4.60, which stems from improper privilege inheritance and coul...

Ensure That the Sticky Bit Is Set for Globally Writable Directories

The sticky bit of a common file is ignored by the kernel. The sticky bit shows up as the execute permission flag of a directory and is indicated with t. If the sticky bit set is for a directory, a user who is not root or the directory owner cannot delete files or directories in the directory,...

Dell Wyse Management Suite WMS 安全漏洞

Wyse Management Suite WMS is a cloud and local management platform from Dell, USA. Wyse Management Suite WMS suffers from an authorization issue vulnerability that stems from insecure inheritance permissions, no details of the vulnerability are provided at this time...

Security update for proftpd

This update for proftpd fixes the following issues: CVE-2024-57392: Fixed null pointer dereference vulnerability by sending a maliciously crafted message bsc1238143. CVE-2024-48651: Fixed supplemental group inheritance granting unintended access to GID 0 bsc1238141. Patch Instructions: To install...

SUSE-SU-2025:1028-1 Security update for proftpd

This update for proftpd fixes the following issues: - CVE-2024-57392: Fixed null pointer dereference vulnerability by sending a maliciously crafted message bsc1238143. - CVE-2024-48651: Fixed supplemental group inheritance granting unintended access to GID 0 bsc1238141...

USN-7297-1 ProFTPD vulnerabilities

Fabian Bäumer, Marcus Brinkmann, and Jörg Schwenk discovered that the transport protocol implementation in ProFTPD had weak integrity checks. An attacker could use this vulnerability to bypass security features like encryption and integrity checks. CVE-2023-48795 Martin Mirchev discovered that...

DEBIAN-CVE-2025-1390

The PAM module pamcap.so of libcap configuration supports group names starting with “@”, during actual parsing, configurations not starting with “@” are incorrectly recognized as group names. This may result in nonintended users being granted an inherited capability set, potentially leading to...

AZL-57034 CVE-2025-1390 affecting package libcap for versions less than 2.69-2

The PAM module pamcap.so of libcap configuration supports group names starting with “@”, during actual parsing, configurations not starting with “@” are incorrectly recognized as group names. This may result in nonintended users being granted an inherited capability set, potentially leading to...

PT-2025-6914

Name of the Vulnerable Software and Affected Versions: libcap affected versions not specified Description: The PAM module pam cap.so of libcap configuration incorrectly recognizes configurations not starting with "@" as group names, potentially leading to nonintended users being granted an...

CVE-2024-24747

MinIO is a High Performance Object Storage. When someone creates an access key, it inherits the permissions of the parent key. Not only for s3: actions, but also admin: actions. Which means unless somewhere above in the access-key hierarchy, the admin rights are denied, access keys will be able t...

Mageia: Security Advisory (MGASA-2025-0015)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Updated proftpd packages fix security vulnerability

In ProFTPD through 1.3.8b before cec01cc, supplemental group inheritance grants unintended access to GID 0 because of the lack of supplemental groups from modsql. CVE-2024-48651...