CVE-2022-24683

HashiCorp Nomad and Nomad Enterprise 0.9.2 through 1.0.17, 1.1.11, and 1.2.5 allow operators with read-fs and alloc-exec or job-submit capabilities to read arbitrary files on the host filesystem as root...

CVE-2022-24683

HashiCorp Nomad and Nomad Enterprise 0.9.2–1.0.17, 1.1.11, and 1.2.5 are reported vulnerable. The issue allows operators with read-fs and alloc-exec (or job-submit) capabilities to read arbitrary files on the host filesystem with root privileges. The CVE entry details the affected product/version...

CVE-2022-24683

HashiCorp Nomad and Nomad Enterprise 0.9.2 through 1.0.17, 1.1.11, and 1.2.5 allow operators with read-fs and alloc-exec or job-submit capabilities to read arbitrary files on the host filesystem as root...

PT-2022-4891 · D Link · Dlink Router

Name of the Vulnerable Software and Affected Versions: D-Link routers affected versions not specified Description: This issue allows network-adjacent attackers to execute arbitrary code on affected installations of multiple D-Link routers. Authentication is not required to exploit this issue. The...

Security Bulletin: Vulnerability in glibc library affects ProtecTIER(CVE-2014-5119)

Summary This bulletin addresses the vulnerability which uses a flaw in glibc that can allow a local unprivileged user to gain root access on Red Hat Enterprise Linux machines used by ProtecTIER Vulnerability Details CVEID: CVE-2014-5119 DESCRIPTION: The GNU C Library glibc is vulnerable to a...

CVE-2022-22945

VMware NSX Edge contains a CLI shell injection vulnerability. A malicious actor with SSH access to an NSX-Edge appliance can execute arbitrary commands on the operating system as root...

CVE-2022-22945

CVE-2022-22945 affects VMware NSX Data Center for vSphere (NSX-V) in the NSX Edge appliance. A CLI shell injection exists that allows a user with SSH access to an NSX-Edge appliance to execute arbitrary commands as root on the underlying OS (local privilege escalation). Reported cause: improper i...

Apple macOS CVMServer Use-After-Free Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Apple macOS. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the CVMServer daemon. Th...

CVE-2021-3560

It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privileges of the requestor to the root user. This flaw could be used by an unprivileged local attacker to, for example, create a new local administrator. The highest threat from this...

(Pwn2Own) Western Digital MyCloud PR4100 samba Configuration Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Western Digital MyCloud PR4100. Authentication is not required to exploit this vulnerability. The specific flaw exists within the configuration of the samba service. A crafted request can...

Tp-link AC1750: Input validation error vulnerability

The Tp-link AC1750 is a wireless router from China P&L Tp-link. The TP-Link AC1750 suffers from an input validation error vulnerability that stems from a specific flaw in the NetUSB.ko module. The issue is caused due to a lack of proper validation of user-supplied data, which could result in an...

EulerOS Virtualization 3.0.6.0 : sssd (EulerOS-SA-2022-1097)

According to the versions of the sssd packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - A flaw was found in SSSD, where the sssctl command was vulnerable to shell command injection via the logs- fetch and cache-expire...

EulerOS Virtualization 3.0.6.6 : sssd (EulerOS-SA-2022-1148)

According to the versions of the sssd packages installed, the EulerOS Virtualization installation on the remote host is affected by the following vulnerabilities : - A flaw was found in SSSD, where the sssctl command was vulnerable to shell command injection via the logs- fetch and cache-expire...

OESA-2022-1524 samba security update

A suite for Linux to interoperate with Windows. Security Fixes: This vulnerability allows remote attackers to execute arbitrary code as root on affected Samba installations that use the VFS module vfsfruit.CVE-2021-44142...

TSG Tokheim Profleet DiaLOG Fuel Management System SQL Injection Vulnerability

TSG Tokheim Profleet DiaLOG Fuel Management System is a fuel management system from TSG UK.A SQL injection vulnerability exists in TSG Tokheim Profleet DiaLOG Fuel Management System, which can be exploited by attackers to cause remote code execution as root user...

(Pwn2Own) TP-Link AC1750 NetUSB Out-Of-Bounds Read Remote Code Execution Vulnerability

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link AC1750 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the NetUSB.ko kernel module. The issue results from the lack of proper...

Updated samba packages fix security vulnerability

For CVE-2021-20316 and CVE-2021-44141, there is only a workaround and mitigation: All versions of Samba prior to 4.15.5 are vulnerable to a malicious client using a server symlink to determine if a file or directory exists in an area of the server file system not exported under the share...

AlmaLinux 8 : sssd (ALSA-2021:3151)

The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2021:3151 advisory. - A flaw was found in SSSD, where the sssctl command was vulnerable to shell command injection via the logs- fetch and cache-expire subcommands. This flaw allows a...

Rocky Linux 8 : sssd (RLSA-2021:3151)

The remote Rocky Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RLSA-2021:3151 advisory. - A flaw was found in SSSD, where the sssctl command was vulnerable to shell command injection via the logs- fetch and cache-expire subcommands. This flaw allows...

CVE-2022-23613

xrdp is an open source remote desktop protocol RDP server. In affected versions an integer underflow leading to a heap overflow in the sesman server allows any unauthenticated attacker which is able to locally access a sesman server to execute code as root. This vulnerability has been patched in...