872 matches found
CVE-2012-2666
golang/go in 1.0.2 fixes all.bash on shared machines. dotest in src/pkg/debug/gosym/pclntabtest.go creates a temporary file with predicable name and executes it as shell script...
CVE-2021-32551
It was discovered that readfile in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-15 package apport hooks, it could expose private data to other local users...
CVE-2021-32549
It was discovered that readfile in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-13 package apport hooks, it could expose private data to other local users...
CVE-2021-32547
It was discovered that readfile in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-lts package apport hooks, it could expose private data to other local users...
CVE-2021-31154
pleaseedit in please before 0.4 uses predictable temporary filenames in /tmp and the target directory. This allows a local attacker to gain full root privileges by staging a symlink attack...
CVE-2021-31153
please before 0.4 allows a local unprivileged attacker to gain knowledge about the existence of files or directories in privileged locations via the searchpath function, the --check option, or the -d option...
CVE-2021-20266
A flaw was found in RPM's hdrblobInit in lib/header.c. This flaw allows an attacker who can modify the rpmdb to cause an out-of-bounds read. The highest threat from this vulnerability is to system availability...
@bigab/gulp-testee (>=0.0.1, <=0.0.2), books-fe-polymer-dev-sample (1.0.0) +13 more potentially affected by CVE-2021-23330 via launchpad (>=0.2.1, <=0.7.5)
launchpad NPM version =0.2.1, =0.0.1, =0.3.1, =0.0.1, =0.0.1, =1.0.1, =0.2.0, =0.0.1, =0.0.5, =2.0.15, =1.0.1, =2.0.3, =3.4.2 Source cves: CVE-2021-23330 Source advisory: OSV:GHSA-7H8X-WMQ2-7MFF...
GHSA-7H8X-WMQ2-7MFF Command injection in launchpad
All versions of package launchpad are vulnerable to Command Injection via stop...
Command injection in launchpad
All versions of package launchpad are vulnerable to Command Injection via stop...
CVE-2021-28117
libdiscover/backends/KNSBackend/KNSResource.cpp in KDE Discover before 5.21.3 automatically creates links to potentially dangerous URLs that are neither https:// nor http:// based on the content of the store.kde.org web site. 5.18.7 is also a fixed version...
Exploit for OS Command Injection in Alleghenycreative Openrepeater
CVE-2019-25024 OpenRepeater ORP / Unauthenticated Command...
CVE-2021-25684
It was discovered that apport in data/apport did not properly open a report file to prevent hanging reads on a FIFO...
CVE-2021-25683
It was discovered that the getstarttime function in data/apport did not properly parse the /proc/pid/stat file from the kernel...
Remote Code Execution (RCE)
launchpad is vulnerable to remote code execution RCE. The vulnerability exists through execcommand in the stop function...
CVE-2021-23330
All versions of package launchpad are vulnerable to Command Injection via stop...
CVE-2021-23330
All versions of package launchpad are vulnerable to Command Injection via stop...
Command injection
All versions of package launchpad are vulnerable to Command Injection via stop...
CVE-2021-23330
CVE-2021-23330 affects the npm package launchpad . All versions are vulnerable to a Command Injection via the stop function, caused by an insecure use of exec(command) in stop. Documented evidence from multiple sources confirms this vulnerability and its impact. The SNYK entry explicitly states t...
