CVE-2018-16987

Squash TM through 1.18.0 presents the cleartext passwords of external services in the administration panel, as demonstrated by a ta-server-password field in the HTML source code...

CVE-2018-16987

CVE-2018-16987 affects Squash TM up to version 1.18.0. The issue is that the administration panel exposes cleartext passwords of external services via a ta-server-password field in the HTML source, as demonstrated in multiple sources (NVD entry, Red Hat advisory, and related records). Affected co...

CVE-2018-16987

Squash TM through 1.18.0 presents the cleartext passwords of external services in the administration panel, as demonstrated by a ta-server-password field in the HTML source code...

CVE-2018-16987: Insufficiently Protected Credentials

Squash TM through 1.18.0 presents the cleartext passwords of external services in the administration panel, as demonstrated by a ta-server-password field in the HTML source code...

Squash YAML Code Execution (CVE-2013-5036)

A remote code execution vulnerability exists in Squash. The vulnerability is due to insufficient sanitization of user-supplied input while processing certain language expressions. An attacker could exploit this vulnerability by sending a crafted request to the affected software...

CVE-2016-0911

EMC Data Domain OS 5.4 through 5.7 before 5.7.2.0 has a default norootsquash option for NFS exports, which makes it easier for remote attackers to obtain filesystem access by leveraging client root privileges...

EMC Data Domain Insecure NFS Load Option Vulnerability

EMC Data Domain systems are data protection storage solutions. EMC Data Domain versions 5.4, 5.5, 5.6, and 5.7 have a security vulnerability that enables an administrator user to create NFS exports, and the default use of norootsquash also enables clients to load NFS exports with root privileges...

The vulnerability of the virtualization management library libvirt allows a attacker to trigger a service failure.

The vulnerability of the virStorageVolCreateXML program in the virtualization management library libvirt is related to lack of access control. Exploiting this vulnerability could allow a malicious actor to cause a service failure abrupt termination of operations by triggering a disconnected...

DEBIAN-CVE-2015-5247

The virStorageVolCreateXML API in libvirt 1.2.14 through 1.2.19 allows remote authenticated users with a read-write connection to cause a denial of service libvirtd crash by triggering a failed unlink after creating a volume on a rootsquash NFS pool...

Balloon Squash - Dangerous filesystem permissions, Insecure KeyStore vulnerabilities

HackApp vulnerability scanner discovered that application Balloon Squash published at the 'play' market has multiple vulnerabilities...

CVE-2013-5036

The Square Squash allows remote attackers to execute arbitrary code via a YAML document in the 1 namespace parameter to the deobfuscation function or 2 sourcemap parameter to the sourcemap function in app/controllers/api/v1controller.rb...

CVE-2013-5036

The CVE-2013-5036 issue pertains to Square Squash’s YAML processing, allowing remote code execution via a YAML document in (1) the namespace parameter to the deobfuscation function or (2) the sourcemap parameter to the sourcemap function in app/controllers/api/v1_controller.rb. Connected advisori...

CVE-2013-5036

The Square Squash allows remote attackers to execute arbitrary code via a YAML document in the 1 namespace parameter to the deobfuscation function or 2 sourcemap parameter to the sourcemap function in app/controllers/api/v1controller.rb...

CVE-2013-5036: Improper Control of Generation of Code

The Square Squash allows remote attackers to execute arbitrary code via a YAML document in the 1 namespace parameter to the deobfuscation function or 2 sourcemap parameter to the sourcemap function in app/controllers/api/v1controller.rb...

Squash - YAML Code Execution (Metasploit)

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' require 'zlib' class Metasploit3 'Squash YAML Code...

Squash YAML Code Execution

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' require 'zlib' class Metasploit3 'Squash YAML Code...

Squash YAML Code Execution Vulnerability

This Metasploit module exploits a remote code execution vulnerability in the YAML request processor of the Squash application. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on...

Read configs to prevent root login

This plugin uses ssh to Read configs to prevent root login: Check for /etc/securettys show all non console, check if root login is not possible via SSH, check for SYSLOGSUENAB in /etc/login.defs, check for perm 0644 on /etc/securettys /etc/login.defs /etc/sshd/sshdconfig, check if rootsquash is...

kernel: nfsd should drop CAP_MKNOD for non-root

nfsd in the Linux kernel before 2.6.28.9 does not drop the CAPMKNOD capability before handling a user request in a thread, which allows local users to create device nodes, as demonstrated on a filesystem that has been exported with the rootsquash option...

kernel: nfsd should drop CAP_MKNOD for non-root

nfsd in the Linux kernel before 2.6.28.9 does not drop the CAPMKNOD capability before handling a user request in a thread, which allows local users to create device nodes, as demonstrated on a filesystem that has been exported with the rootsquash option...