76 matches found
CVE-2022-34213
Jenkins Squash TM Publisher Squash4Jenkins Plugin 1.0.0 and earlier stores passwords unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system...
CVE-2018-16987
Squash TM through 1.18.0 presents the cleartext passwords of external services in the administration panel, as demonstrated by a ta-server-password field in the HTML source code...
CLSA-2025-1742805183 grub2: Fix of 5 CVEs
CVE-2025-0624: net: Out-of-bounds write in grubnetsearchconfigfile - CVE-2025-0690: read: Integer overflow may lead to out-of-bounds write - CVE-2025-1118: commands/dump: The dump command is not in lockdown when secure boot is enabled - CVE-2025-0678: squash4: Integer overflow may lead to heap...
The vulnerability of the grub_malloc() function in the squash4 module of the Grub2 operating system allows a hacker to execute arbitrary code.
The vulnerability of the grubmalloc function in the squash4 module of the Grub2 operating system involves executing an operation beyond the boundaries of the buffer in memory. Exploiting this vulnerability could allow an attacker to execute arbitrary code...
CVE-2025-0678
A flaw was found in grub2. When reading data from a squash4 filesystem, grub's squash4 fs module uses user-controlled parameters from the filesystem geometry to determine the internal buffer size, however, it improperly checks for integer overflows. A maliciously crafted filesystem may lead some ...
AZL-57669 CVE-2025-0678 affecting package grub2 for versions less than 2.06-15
A flaw was found in grub2. When reading data from a squash4 filesystem, grub's squash4 fs module uses user-controlled parameters from the filesystem geometry to determine the internal buffer size, however, it improperly checks for integer overflows. A maliciously crafted filesystem may lead some ...
UBUNTU-CVE-2025-0678
A flaw was found in grub2. When reading data from a squash4 filesystem, grub's squash4 fs module uses user-controlled parameters from the filesystem geometry to determine the internal buffer size, however, it improperly checks for integer overflows. A maliciously crafted filesystem may lead some ...
PT-2024-25928 · Fog · Fog
Name of the Vulnerable Software and Affected Versions: FOG versions 1.5.10 and earlier Description: The issue allows local users to gain privileges by mounting a crafted NFS share due to the lack of no root squash and insecure settings. To exploit this, an attacker must mount an NFS share and add...
CVE-2024-24579
stereoscope is a go library for processing container images and simulating a squash filesystem. Prior to version 0.0.1, it is possible to craft an OCI tar archive that, when stereoscope attempts to unarchive the contents, will result in writing to paths outside of the unarchive temporary director...
CVE-2024-24579 Tar path traversal in stereoscope when processing OCI tar archives
stereoscope is a go library for processing container images and simulating a squash filesystem. Prior to version 0.0.1, it is possible to craft an OCI tar archive that, when stereoscope attempts to unarchive the contents, will result in writing to paths outside of the unarchive temporary director...
The vulnerability of the SQFS file analyzer of the 7-Zip compressor allows a hacker to execute arbitrary code.
The vulnerability of the SQFS-file analyzer of the 7-Zip compressor is related to errors in processing input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by causing the user to open malicious links or files...
SUSE CVE-2009-1072
nfsd in the Linux kernel before 2.6.28.9 does not drop the CAPMKNOD capability before handling a user request in a thread, which allows local users to create device nodes, as demonstrated on a filesystem that has been exported with the rootsquash option...
SUSE CVE-2015-5247
The virStorageVolCreateXML API in libvirt 1.2.14 through 1.2.19 allows remote authenticated users with a read-write connection to cause a denial of service libvirtd crash by triggering a failed unlink after creating a volume on a rootsquash NFS pool...
SUSE CVE-2018-1000028
Linux kernel version after commit bdcf0a423ea1 - 4.15-rc4+, 4.14.8+, 4.9.76+, 4.4.111+ contains a Incorrect Access Control vulnerability in NFS server nfsd that can result in remote users reading or writing files they should not be able to via NFS. This attack appear to be exploitable via NFS...
DENX U-Boot 缓冲区错误漏洞
DENX U-Boot is a content management system. A security vulnerability exists in versions prior to DENX U-Boot v2022.07, which stems from a flaw in the metadata read process, and U-Boot's squash file system contains a heap-based buffer overflow vulnerability...
CVE-2022-34213
Jenkins Squash TM Publisher Squash4Jenkins Plugin 1.0.0 and earlier stores passwords unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system...
CVE-2022-34213
Jenkins Squash TM Publisher Squash4Jenkins Plugin 1.0.0 and earlier stores passwords unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system...
CVE-2022-34213
Jenkins Squash TM Publisher Squash4Jenkins Plugin 1.0.0 and earlier stores passwords unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system...
Design/Logic Flaw
Jenkins Squash TM Publisher Squash4Jenkins Plugin 1.0.0 and earlier stores passwords unencrypted in its global configuration file on the Jenkins controller where they can be viewed by users with access to the Jenkins controller file system...
CVE-2022-34213
CVE-2022-34213 affects the Jenkins Squash TM Publisher (Squash4Jenkins) Plugin (versions 1.0.0 and earlier). The vulnerability arises from storing passwords unencrypted in the plugin’s global configuration on the Jenkins controller (org.jenkinsci.squashtm.core.SquashTMPublisher.xml). As a result,...