CVE-2022-41347

An issue was discovered in Zimbra Collaboration ZCS 8.8.x and 9.x e.g., 8.8.15. The Sudo configuration permits the zimbra user to execute the NGINX binary as root with arbitrary parameters. As part of its intended functionality, NGINX can load a user-defined configuration file, which includes...

CVE-2022-30759

In Nokia One-NDS aka Network Directory Server through 20.9, some Sudo permissions can be exploited by some users to escalate to root privileges and execute arbitrary commands...

CVE-2021-30462

VestaCP through 0.9.8-24 allows the admin user to escalate privileges to root because the Sudo configuration does not require a password to run /usr/local/vesta/bin scripts...

CVE-2021-35064

KramerAV VIAWare, all tested versions, allow privilege escalation through misconfiguration of sudo. Sudoers permits running of multiple dangerous commands, including unzip, systemctl and dpkg...

CVE-2021-24011

A privilege escalation vulnerability in FortiNAC version below 8.8.2 may allow an admin user to escalate the privileges to root by abusing the sudo privileges...

CVE-2021-43043

An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. The apache user could read arbitrary files such as /etc/shadow by abusing an insecure Sudo rule...

CVE-2020-27985

Security Onion v2 prior to 2.3.10 has an incorrect sudo configuration, which allows the administrative user to obtain root access without using the sudo password by editing and executing /home//SecurityOnion/setup/so-setup...

CVE-2020-25618

An issue was discovered in SolarWinds N-Central 12.3.0.670. The sudo configuration has incorrect access control because the nable web user account is effectively able to run arbitrary OS commands as root i.e., the use of root privileges is not limited to specific programs listed in the sudoers fi...

CVE-2020-13695

In QuickBox Community Edition through 2.5.5 and Pro Edition through 2.1.8, the local www-data user has sudo privileges to execute grep as root without a password, which allows an attacker to obtain sensitive information via a grep of a /root/.db or /etc/shadow file...

CVE-2019-9891

The function getoptsimple as described in Advanced Bash Scripting Guide ISBN 978-1435752184 allows privilege escalation and execution of commands when used in a shell script called, for example, via sudo...

CVE-2011-5275

The install script in Domain Technologie Control DTC before 0.34.1 gives sudo permissions for chrootuid to the dtc user, which makes it easier for context-dependent users to gain privileges...

[SECURITY] Fedora 41 Update: sudo-rs-0.2.6-1.fc41

A memory safe implementation of sudo and su...

[SECURITY] Fedora 42 Update: sudo-rs-0.2.6-1.fc42

A memory safe implementation of sudo and su...

Fedora 41 : sudo-rs (2025-6a67917349)

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-6a67917349 advisory. Update to version 0.2.6. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has not...

Security Bulletin: Vulnerability in Sudo affects IBM Integrated Analytics System (Sailfish)[CVE-2023-22809, CVE-2023-28486, CVE-2023-28487, CVE-2023-42465].

Summary The Sudo package is used by IBM Integrated Analytics System . IBM Integrated Analytics System has addressed the applicable CVECVE-2023-22809, CVE-2023-28486, CVE-2023-28487, CVE-2023-42465. Vulnerability Details CVEID:CVE-2023-22809 DESCRIPTION: In Sudo before 1.9.12p2, the sudoedit aka -...

CVE-2025-46718

A flaw was found in sudo-rs. This vulnerability allows users with limited sudo privileges to enumerate the sudoers file, revealing sensitive information about other users' permissions via the -U flag. Mitigation Mitigation for this issue is either not available or the currently available options ...

CVE-2025-46717

A flaw was found in sudo-rs. This vulnerability allows discovery of file existence via the --list command, which can reveal sensitive information...

Alibaba Cloud Linux 3 : 0034: sudo (ALINUX3-SA-2024:0034)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2024:0034 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2023-28486: Sudo before 1.9.13 does no...

Alibaba Cloud Linux 3 : 0113: sudo (ALINUX3-SA-2022:0113)

The remote Alibaba Cloud Linux 3 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALINUX3-SA-2022:0113 advisory. Package updates are available for Alibaba Cloud Linux 3 that fix the following vulnerabilities: CVE-2019-14287: In Sudo before 1.8.28, an...

sudo-rs Allows Low Privilege Users to Enumerate Privileges of Others

Summary Users with limited sudo privileges e.g. execution of a single command can list sudo privileges of other users using the -U flag. This doesn't happen with the original sudo. PoC The initial test has been done in a container running Ubuntu 24.04 and installing oxidizr, running sudo-rs 0.2.2...