PT-2020-21330

Name of the Vulnerable Software and Affected Versions momen affected versions not specified Description The momen package is a typosquatted version of a popular package with a similar name. It tracks users who have installed the incorrect package and uploads information to a remote server,...

PT-2020-21327

Name of the Vulnerable Software and Affected Versions requet affected versions not specified Description The requet package is a typosquatted version of a popular package with a similar name, designed to track users who install the incorrect package. Upon installation, it uploads information to a...

PT-2020-21144

Name of the Vulnerable Software and Affected Versions commnader affected versions not specified Description The issue concerns a typosquatted package that tracks users who have installed it by mistake, thinking it was a similarly named popular package. Upon installation, the package uploads certa...

PT-2020-21440

Name of the Vulnerable Software and Affected Versions rqeuest affected versions not specified Description The issue concerns a typosquatted package named rqeuest that tracks users who have installed it, thinking it was a similarly named popular package. This package uploads certain information to...

PT-2020-21489

Name of the Vulnerable Software and Affected Versions jajajejejiji affected versions not specified Description The issue concerns a typosquatted package that tracks users who have installed it by mistake, thinking it was a similarly named popular package. Upon installation, the package uploads...

PT-2020-21281

Name of the Vulnerable Software and Affected Versions wepack-cli versions affected versions not specified Description The issue concerns a typosquatted package that tracked users who installed it by mistake, thinking it was a similarly named popular package. Upon installation, the package uploade...

Security fix for the ALT Linux 8 package sudo version 1:1.8.31p2-alt1

Aug. 30, 2020 Evgeny Sinelnikov 1:1.8.31p2-alt1 - Update to latest release Fixes: CVE-2019-18634...

Security fix for the ALT Linux 8 package sudo version 1:1.9.2-alt1

Aug. 30, 2020 Evgeny Sinelnikov 1:1.9.2-alt1 - Update to latest release of the sudo 1.9 Fixes: CVE-2019-19232, CVE-2019-19234 - Added sudo event and I/O log server - Added send sudo I/O log to log server utility - Added selinux support - Added native audit support...

CVE-2020-14162

An issue was discovered in Pi-Hole through 5.0. The local www-data user has sudo privileges to execute the pihole core script as root without a password, which could allow an attacker to obtain root access via shell metacharacters to this script's setdns command...

CVE-2020-14162

An issue was discovered in Pi-Hole through 5.0. The local www-data user has sudo privileges to execute the pihole core script as root without a password, which could allow an attacker to obtain root access via shell metacharacters to this script's setdns command...

Command injection

An issue was discovered in Pi-Hole through 5.0. The local www-data user has sudo privileges to execute the pihole core script as root without a password, which could allow an attacker to obtain root access via shell metacharacters to this script's setdns command...

CVE-2020-14162

CVE-2020-14162 concerns Pi-Hole up to version 5.0, where the local www-data user has passwordless sudo to run the pihole core script as root via its setdns command. This enables potential root access through shell metacharacters in setdns. The vulnerability is described consistently across multip...

CVE-2020-14162

An issue was discovered in Pi-Hole through 5.0. The local www-data user has sudo privileges to execute the pihole core script as root without a password, which could allow an attacker to obtain root access via shell metacharacters to this script's setdns command...

Code Injection in z4nzu/hackingtool

Description The hackingtool by Z4nzu is a pool of pentest tools that is useful to hackers to do fast hacking from information gathering to web attacks to wireless hacking and much more which are provided in terminal UI. It is built using python3. However it uses os.system command in various place...

Security Bulletin: IBM Sterling Connect:Direct for UNIX Allows a User with Sudo Access Restricted to Certain Connect:Direct Executable Files to Expand Access Beyond the Restriction (CVE-2018-1903)

Summary UNIX system administrators may grant access to run certain executable files with expanded privilege via the sudo utility. Connect:Direct for UNIX has a vulnerability that could allow a user to escape this sudo executable file restriction and perform unauthorized commands with expanded...

Mida Solutions eFramework ajaxreq.php Command Injection

This module exploits a command injection vulnerability in Mida Solutions eFramework version 2.9.0 and prior. The ajaxreq.php file allows unauthenticated users to inject arbitrary commands in the PARAM parameter to be executed as the apache user. The sudo configuration permits the apache user to...

Security Bulletin: Multiple vulnerabilities in coreutils, sudo, jasper, bind, bash, libtirpc, nss and nss-util affect IBM SmartCloud Entry

Summary Multiple vulnerabilities have been identified in coreutils, sudo, jasper, bind, bash, libtirpc, nss and nss-util. coreutils, sudo, jasper, bind, bash, libtirpc, nss and nss-util shipped with IBM SmartCloud Entry Appliance. IBM SmartCloud Entry Appliance has addressed the vulnerabilities...

Security Bulletin: Multiple vulnerabilities in expat, nss,  bind ,  policycoreutils, sudo shipped with  SmartCloud Entry Appliance

Summary Multiple vulnerabilities have been idintified in Expat, nss, ISC BIND , policycoreutils and sudo libraries shipped with SmartCloud Entry Appliance. SmartCloud Entry Appliance has addressed the vulnerabilities. Vulnerability Details CVEID: CVE-2016-0718 DESCRIPTION: Expat is vulnerable to ...

Security Bulletin: Multiple vulnerabilities in sudo, glibc affect IBM SmartCloud Entry (CVE-2017-1000368 CVE-2017-1000366)

Summary Multiple vulnerabilities have been identified in sudo and glibc. Sudo and glibc are used by IBM SmartCloud Entry. IBM SmartCloud Entry has addressed the vulnerabilities Vulnerability Details CVEID: CVE-2017-1000368 DESCRIPTION: sudo could allow a local attacker to gain elevated privileges...

CVE-2020-10286

the main user account has restricted privileges but is in the sudoers group and there is not any mechanism in place to prevent sudo su or sudo -i to be run gaining unrestricted access to sensible files, encryption, or issue orders that disrupt robot operation...