1849 matches found
CVE-2019-11503
snap-confine as included in snapd before 2.39 did not guard against symlink races when performing the chdir to the current working directory of the calling user, aka a "cwd restore permission bypass."...
CVE-2019-11502
CVE-2019-11502 concerns snap-confine in snapd before 2.38, where ownership of a snap application's resources could be set to the UID/GID of the first calling user. This allowed that user to access a private /tmp directory, a local authority issue that attackers could exploit to modify or read tra...
CVE-2019-11502
snap-confine in snapd before 2.38 incorrectly set the ownership of a snap application to the uid and gid of the first calling user. Consequently, that user had unintended access to a private /tmp directory...
CVE-2019-11502
snap-confine in snapd before 2.38 incorrectly set the ownership of a snap application to the uid and gid of the first calling user. Consequently, that user had unintended access to a private /tmp directory...
Authentication Bypass
github.com/snapcore/snapweb is vulnerable to authentication bypass. The identity of the user and the origin of a connection is not verified before allowing controls to install or remove snap packages. An unauthenticated remote attacker is able to add a malicious snap package from the store and us...
CVE-2016-1587
The Snapweb interface before version 0.21.2 was exposing controls to install or remove snap packages without controlling the identity of the user, nor the origin of the connection. An attacker could have used the controls to remotely add a valid, but malicious, snap package, from the Store,...
Information disclosure
The Snapweb interface before version 0.21.2 was exposing controls to install or remove snap packages without controlling the identity of the user, nor the origin of the connection. An attacker could have used the controls to remotely add a valid, but malicious, snap package, from the Store,...
snap - seccomp BBlacklist for TIOCSTI can be Circumvented Exploit
/ snap uses a seccomp filter to prevent the use of the TIOCSTI ioctl; in the source code, this filter is expressed as follows: TIOCSTI allows for faking input man ttyioctl TODO: this should be scaled back even more ioctl - !TIOCSTI In the X86-64 version of the compiled seccomp filter, this result...
snap - seccomp BBlacklist for TIOCSTI can be Circumvented
snap - seccomp BBlacklist for TIOCSTI can be Circumvented / snap uses a seccomp filter to prevent the use of the TIOCSTI ioctl; in the source code, this filter is expressed as follows: TIOCSTI allows for faking input man ttyioctl TODO: this should be scaled back even more ioctl - !TIOCSTI In the...
snap seccomp TIOCSTI Blacklist Circumvention
snap: seccomp blacklist for TIOCSTI can be circumvented Related CVE Numbers: CVE-2019-7303. snap uses a seccomp filter to prevent the use of the TIOCSTI ioctl; in the source code, this filter is expressed as follows: TIOCSTI allows for faking input man ttyioctl TODO: this should be scaled back ev...
snap - seccomp BBlacklist for TIOCSTI can be Circumvented
/ snap uses a seccomp filter to prevent the use of the TIOCSTI ioctl; in the source code, this filter is expressed as follows: TIOCSTI allows for faking input man ttyioctl TODO: this should be scaled back even more ioctl - !TIOCSTI In the X86-64 version of the compiled seccomp filter, this result...
Flaw in snapd Allows Root Access to Linux Servers
A local privilege-escalation vulnerability in Canonical’s snapd package has been uncovered, which would allow any user to obtain administrator privileges and immediate root access to affected Linux system servers. Snapd is used by Linux users to download and install apps in the .snap file format...
snapd < 2.37 (Ubuntu) - dirty_sock Local Privilege Escalation (2)
Exploit for linux platform in category local exploits !/usr/bin/env python3 """ dirtysock: Privilege Escalation in Ubuntu via snapd In January 2019, current versions of Ubuntu Linux were found to be vulnerable to local privilege escalation due to a bug in the snapd API. This repository contains t...
snapd < 2.37 (Ubuntu) - 'dirty_sock' Local Privilege Escalation (1)
!/usr/bin/env python3 """ dirtysock: Privilege Escalation in Ubuntu via snapd In January 2019, current versions of Ubuntu Linux were found to be vulnerable to local privilege escalation due to a bug in the snapd API. This repository contains the original exploit POC, which is being made available...
Ubuntu snapd < 2.37.1 - Local Privilege Escalation
dirtysock: Privilege Escalation in Ubuntu via snapd In January 2019, current versions of Ubuntu Linux were found to be vulnerable to local privilege escalation due to a bug in the snapd API. This repository contains the original exploit POC, which is being made available for research and educatio...
Fedora 28 : mosquitto (2018-9a6af7815a)
Release 1.5.3 Security : - Fix CVE-2018-12543. If a message is sent to Mosquitto with a topic that begins with $, but is not $SYS, then an assert that should be unreachable is triggered and Mosquitto will exit. Broker : - Elevate log level to warning for situation when socket limit is hit. - Remo...
Fedora 29 : mosquitto (2018-ff1fdf28aa)
Release 1.5.3 Security : - Fix CVE-2018-12543. If a message is sent to Mosquitto with a topic that begins with $, but is not $SYS, then an assert that should be unreachable is triggered and Mosquitto will exit. Broker : - Elevate log level to warning for situation when socket limit is hit. - Remo...
WordPress Snap Creek Duplicator Code Injection (CVE-2018-17207)
An exploitable remote code execution vulnerability exists in WordPress Duplicator server. A WordPress plugin Snap Creek Duplicator restores a backup, resulting in remote code execution. An attacker can send a single authenticated HTTP request to trigger this vulnerability...
WordPress Snap Creek Duplicator Code Injection
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Snap Creek Duplicator WordPress plugin code injection', 'Description' = %q When the WordPress plugin Snap Creek Duplicator restores a backup, it...
WordPress Snap Creek Duplicator Code Injection Exploit
When the WordPress plugin Snap Creek Duplicator restores a backup, it leaves dangerous files in the filesystem such as installer.php and installer-backup.php. These files allow anyone to call a function that overwrite the wp-config.php file AND this function does not sanitize POST parameters befo...