2849 matches found
PT-2022-12304
Name of the Vulnerable Software and Affected Versions Cobbler versions prior to 3.3.1 Description An issue was discovered where files in /etc/cobbler are world readable, exposing sensitive information to local users with non-privileged access. The users.digest file contains the sha2-512 digest of...
coreos-installer: restrict access permissions on /boot/ignition{,/config.ign}
A flaw was found in the coreos-installer, where it writes the Ignition config to the target system with world-readable access permissions. This flaw allows a local attacker to have read access to potentially sensitive data. The highest threat from this vulnerability is to confidentiality...
Mozilla Firefox Security Advisory (MFSA2012-09) - Linux
This host is missing a security update for Mozilla Firefox. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; y...
coreos-installer < 0.10.0 writes world-readable Ignition config to installed system
Impact On systems installed with coreos-installer before 0.10.0, the user-provided Ignition config was written to /boot/ignition/config.ign with world-readable permissions, granting unprivileged users access to any secrets included in the config. Default configurations of Fedora CoreOS and RHEL...
PT-2021-22427 · Unknown · Coreos-Installer
Name of the Vulnerable Software and Affected Versions: coreos-installer versions prior to 0.10.0 Description: A flaw was found in the coreos-installer, where it writes the Ignition config to the target system with world-readable access permissions. This flaw allows a local attacker to have read...
CVE-2021-43413
An issue was discovered in GNU Hurd before 0.9 20210404-9. A single pager port is shared among everyone who mmaps a file, allowing anyone to modify any files that they can read. This can be trivially exploited to get full root access...
CVE-2021-3917
A flaw was found in the coreos-installer, where it writes the Ignition config to the target system with world-readable access permissions. This flaw allows a local attacker to have read access to potentially sensitive data. The highest threat from this vulnerability is to confidentiality...
PT-2021-27360
Name of the Vulnerable Software and Affected Versions: wireguard-tools affected versions not specified Description: The issue concerns world-readable permissions from /etc/wireguard. Recommendations: At the moment, there is no information about a newer version that contains a fix for this...
Security update for wireguard-tools (moderate)
openSUSE Security Update: Security update for wireguard-tools Announcement ID: openSUSE-SU-2021:1425-1 Rating: moderate References: 1191224 Affected Products: openSUSE Leap 15.2 An update that contains security fixes can now be installed. Description: This update for wireguard-tools fixes the...
openSUSE: Security Advisory for wireguard-tools (openSUSE-SU-2021:3527-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
OPENSUSE-SU-2021:3527-1 Security update for wireguard-tools
This update for wireguard-tools fixes the following issues: - Removed world-readable permissions from /etc/wireguard bsc1191224...
PT-2021-28452
Name of the Vulnerable Software and Affected Versions: wireguard-tools affected versions not specified Description: The issue concerns world-readable permissions from /etc/wireguard that have been removed. Recommendations: At the moment, there is no information about a newer version that contains...
PT-2021-27372
Name of the Vulnerable Software and Affected Versions: wireguard-tools affected versions not specified Description: The issue concerns world-readable permissions from /etc/wireguard that have been removed. Recommendations: At the moment, there is no information about a newer version that contains...
coreos-installer: restrict access permissions on /boot/ignition{,/config.ign}
A flaw was found in the coreos-installer, where it writes the Ignition config to the target system with world-readable access permissions. This flaw allows a local attacker to have read access to potentially sensitive data. The highest threat from this vulnerability is to confidentiality...
CVE-2020-4805
IBM Edge 4.2 allows web pages to be stored locally which can be read by another user on the system. IBM X-Force ID: 189539...
RHEL 8 : cloud-init (RHSA-2021:3371)
The remote Redhat Enterprise Linux 8 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2021:3371 advisory. The cloud-init packages provide a set of init scripts for cloud instances. Cloud instances need special scripts to run during initialization to...
cloud-init: randomly generated passwords logged in clear-text to world-readable file
A flaw was found in cloud-init. When a system is configured through cloud-init and the "Set Passwords" module is used with "chpasswd" directive and "RANDOM", the randomly generated password for the relative user is written in clear-text in a file readable by any existing user of the system. The...
jersey: Local information disclosure via system temporary directory
Eclipse Jersey 2.28 to 2.33 and Eclipse Jersey 3.0.0 to 3.0.1 contains a local information disclosure vulnerability. This is due to the use of the File.createTempFile which creates a file inside of the system temporary directory with the permissions: -rw-r--r--. Thus the contents of this file are...
cloud-init: randomly generated passwords logged in clear-text to world-readable file
A flaw was found in cloud-init. When a system is configured through cloud-init and the "Set Passwords" module is used with "chpasswd" directive and "RANDOM", the randomly generated password for the relative user is written in clear-text in a file readable by any existing user of the system. The...
OPENSUSE-SU-2021:2682-1 Security update for rpm
This update for rpm fixes the following issues: - Changed default package verification level to 'none' to be compatible to rpm-4.14.1 - Made illegal obsoletes a warning - Fixed a potential access of freed mem in ndb's glue code bsc1179416 - Added support for enforcing signature policy and payload...