5437 matches found
CVE-2025-34323: Incorrect Permission Assignment for Critical Resource
Nagios Log Server versions prior to 2026R1.0.1 are vulnerable to local privilege escalation due to a combination of sudo misconfiguration and group-writable application directories. The 'www-data' user is a member of the 'nagios' group, which has write access to...
Nagios Log Server 安全漏洞
Nagios Log Server is a suite of centralized log management, monitoring, and analysis software from Nagios, Inc. A security vulnerability exists in Nagios Log Server versions prior to 2026R1.0.1, which stems from an insecure interaction between sudo rules and filesystem permissions, which could le...
FreeBSD : sudo-rs -- Partial password reveal when password timeout occurs (c1ceaaea-c2e7-11f0-8372-98b78501ef2a)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the c1ceaaea-c2e7-11f0-8372-98b78501ef2a advisory. Trifecta Tech Foundation reports: When typing partial passwords but not pressing return for a long time...
FreeBSD : sudo-rs -- Authenticating user not recorded properly in timestamp (bf6c9252-c2ec-11f0-8372-98b78501ef2a)
The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the bf6c9252-c2ec-11f0-8372-98b78501ef2a advisory. Trifecta Tech Foundation reports: With Defaults targetpw or Defaults rootpw enabled, the password of th...
PT-2025-47192
Name of the Vulnerable Software and Affected Versions Nagios Log Server versions prior to 2026R1.0.1 Description Nagios Log Server versions prior to 2026R1.0.1 have a local privilege escalation issue. This is due to an unsafe interaction between sudo rules and file system permissions. The web...
sudo-rs doesn't record authenticating user properly in timestamp
Summary When Defaults targetpw or Defaults rootpw is enabled, the password of the target account or root account instead of the invoking user is used for authentication. sudo-rs prior to 0.2.10 incorrectly recorded the invoking user’s UID instead of the authenticated-as user's UID in the...
GHSA-Q428-6V73-FC4Q sudo-rs doesn't record authenticating user properly in timestamp
Summary When Defaults targetpw or Defaults rootpw is enabled, the password of the target account or root account instead of the invoking user is used for authentication. sudo-rs prior to 0.2.10 incorrectly recorded the invoking user’s UID instead of the authenticated-as user's UID in the...
EUVD-2025-150364
sudo-rs doesn't record authenticating user properly in timestamp...
CVE-2025-64517
A flaw was found in sudo-rs. This vulnerability allows authentication bypass via incorrect recording of the authenticating user in the timestamp...
EUVD-2025-179923
Malicious code in byte-root-test-kappa-sudo npm...
Malicious code in sudo-emulate-stack-deploy-psi (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 56ac55148fee2d109b41c3075f3a4e39294e50decd8f2b0fef35db75ce9175b9 This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-176944
Malicious code in psi-sudo-key-simulate-double npm...
EUVD-2025-180321
Malicious code in array-eta-sudo-new-cron npm...
EUVD-2025-180123
Malicious code in bash-serialize-decode-grid-sudo npm...
EUVD-2025-179377
Malicious code in decompress-sed-sudo-index-nu npm...
EUVD-2025-178414
Malicious code in info-byte-simulate-cat-sudo npm...
MAL-2025-187468 Malicious code in info-byte-simulate-cat-sudo (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 0027d2338d6014bc490d64b292626df8d2de44402c81596a7920b4d4fc8d485b This package appears to be part of the tea.xyz token reward campaign that flooded npm. These packages typically contain autopublish scripts auto.js,...
EUVD-2025-179278
Malicious code in dog-water-double-sudo-export npm...