UBUNTU-CVE-2020-14365

A flaw was found in the Ansible Engine, in ansible-engine 2.8.x before 2.8.15 and ansible-engine 2.9.x before 2.9.13, when installing packages using the dnf module. GPG signatures are ignored during installation even when disablegpgcheck is set to False, which is the default behavior. This flaw...

CVE-2020-14365

CVE-2020-14365 affects the Ansible Engine (ansible-engine 2.8.x before 2.8.15; 2.9.x before 2.9.13). When using the dnf module, GPG signatures are ignored during installation if disable_gpg_check is False, allowing potentially malicious packages to be installed and their installation scripts to e...

CVE-2020-14365: Improper Verification of Cryptographic Signature

A flaw was found in the Ansible Engine, in ansible-engine 2.8.x before 2.8.15 and ansible-engine 2.9.x before 2.9.13, when installing packages using the dnf module. GPG signatures are ignored during installation even when disablegpgcheck is set to False, which is the default behavior. This flaw...

File Upload Vulnerability in MetInfo 7.1.0 Backend of Changsha Mito Information Technology Co.

MetInfo is an open source free CMS building system suitable for enterprise building. Changsha Mito Information Technology Co., Ltd MetInfo 7.1.0 file upload vulnerability exists in the background, attackers can exploit the vulnerability to upload malicious compressed packages and then decompress...

CVE-2020-16122

PackageKit's apt backend mistakenly treated all local debs as trusted. The apt security model is based on repository trust and not on the contents of individual files. On sites with configured PolicyKit rules this may allow users to install malicious packages...

PT-2020-6168 · Packagekit +3 · Packagekit +3

Name of the Vulnerable Software and Affected Versions: PackageKit affected versions not specified Description: The issue is related to PackageKit's apt backend, which incorrectly treats all local debs as trusted. This is problematic because the apt security model relies on repository trust rather...

The vulnerability of the node-tar and fstream packages in Microsoft Visual Studio software allows a hacker to modify any files they choose.

The vulnerability of the node-tar and fstream packages in the Microsoft Visual Studio development environment is related to errors during the checking of hard links when extracting archive files. Exploiting this vulnerability allows a remote attacker to modify arbitrary files by loading a malicio...

CVE-2019-2218

In createSessionInternal of PackageInstallerService.java, there is a possible improper permission grant due to a missing permission check. This could lead to local escalation of privilege by installing malicious packages with User execution privileges needed. User interaction is not needed for...

Input validation

In createSessionInternal of PackageInstallerService.java, there is a possible improper permission grant due to a missing permission check. This could lead to local escalation of privilege by installing malicious packages with User execution privileges needed. User interaction is not needed for...

Skype On Debian Microsoft Apt Repo Addition Vulnerability

Skype on Debian automatically installs apt configuration that adds Microsoft's apt repo to the system's package sources. That way, Microsoft or anybody holding their repo's private key can easily inject malicious packages via regular update and replace distro packages w/ their own manipulated one...

libzypp RPM package injection vulnerability (CNVD-2018-06155)

libzypp aka ZYPP is the U.S. Novell-sponsored open source set of manageable engines, drivers eg: Linux applications YaST, Zypper tools. A security vulnerability exists in versions of libzypp prior to 20170803. An attacker can exploit the vulnerability by adding unsigned YUM libraries to inject...

Octopus Deploy Directory Traversal Vulnerability

In Octopus Deploy, an authenticated user with PackagePush permission to upload packages could upload a maliciously crafted NuGet package, potentially overwriting other packages or modifying system files. This is a directory traversal in the PackageId value. SPDX-FileCopyrightText: 2017 Greenbone ...

GnuPG 1.x Detached Signature Verification Bypass Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/16663/info GnuPG is affected by a detached signature verification-bypass vulnerability because it fails to properly notify scripts that an invalid detached signature was presented and that the verification process has...

PT-2014-1779

Name of the Vulnerable Software and Affected Versions apt versions prior to 1.0.4 Description The issue concerns multiple vulnerabilities in the apt package of the Debian GNU/Linux operating system, which can be exploited to compromise the integrity and availability of protected information. Thes...

PT-2008-1067

Name of the Vulnerable Software and Affected Versions openssh-askpass-gnome version 3.9p1 openssh-askpass version 3.9p1 openssh version 3.9p1 openssh-server version 3.9p1 openssh-clients version 3.9p1 Description The issue involves multiple vulnerabilities in OpenSSH packages for Red Hat Enterpri...