45 matches found
Dariusz Personal Management System Backend command injection vulnerability
Versions 2.1.0 and earlier of the Dariusz Personal Management System Backend contain a command injection vulnerability. This vulnerability arises because the tree command in the storage module fails to escape folder paths. Authentication-authorized attackers can create directories containing shel...
Gopass path traversal vulnerability
Versions of Gopass prior to 1.17.0 contain a path traversal vulnerability. This vulnerability stems from improper handling of paths in the file system backend. Attackers can exploit the ../ entries in Prune and IsDir to gain write access to shared Git sync storage, thereby creating specially...
CVE-2026-55775 OpenBao's System Backend allows Unauthorized Management of the containing Namespace
OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, OpenBao users granted capabilities on /sys/namespaces/root within a non-root namespace could exploit special handling of the literal root path in namespace canonicalization. The /sys/namespaces/ endpoint family ca...
CVE-2026-55775 OpenBao's System Backend allows Unauthorized Management of the containing Namespace
OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, OpenBao users granted capabilities on /sys/namespaces/root within a non-root namespace could exploit special handling of the literal root path in namespace canonicalization. The /sys/namespaces/ endpoint family ca...
CVE-2026-55775 OpenBao's System Backend allows Unauthorized Management of the containing Namespace
OpenBao is an open source identity-based secrets management system. Prior to 2.5.5, OpenBao users granted capabilities on /sys/namespaces/root within a non-root namespace could exploit special handling of the literal root path in namespace canonicalization. The /sys/namespaces/ endpoint family ca...
GO-2026-5517 OpenBao's System Backend allows Unauthorized Management of the containing Namespace in github.com/openbao/openbao
OpenBao's System Backend allows Unauthorized Management of the containing Namespace in github.com/openbao/openbao...
GHSA-MWR2-WMGP-CRJ6 OpenBao's System Backend allows Unauthorized Management of the containing Namespace
Summary A user that is granted namespace management /sys/namespaces capabilities within a non-root namespace "the victim namespace" can abuse special handling of the literal path "root" in namespace path canonicalization to manage the victim namespace itself. Details Several endpoints under...
EUVD-2026-13796
Calling gethostbyaddr or gethostbyaddrr with a configured nsswitch.conf that specifies the library's DNS backend in the GNU C Library version 2.34 to version 2.43 could, with a crafted response from the configured DNS server, result in a violation of the DNS specification that causes the...
CVE-2026-33054
Mesop is a Python-based UI framework that allows users to build web applications. Versions 1.2.2 and below contain a Path Traversal vulnerability that allows any user supplying an untrusted statetoken through the UI stream payload to arbitrarily target files on the disk under the standard...
Security update for glibc
This update for glibc fixes the following issues: CVE-2026-0915: resolv: Fix NSS DNS backend for getnetbyaddr bsc1256822, BZ 33802 CVE-2025-15281: posix: Reset wordexpt fields with WRDEREUSE bsc1257005, BZ 33814 CVE-2025-8058: posix: Fix double-free after allocation failure in regcomp bsc1246965,...
CVE-2024-38970
vaeThink 1.0.2 is vulnerable to Information Disclosure via the system backend,access management administrator function...
CVE-2024-48176
Lylme Spage version v1.9.5 is vulnerable to Incorrect Access Control due to a lack of limits on login attempts and a verification code that does not refresh after a failed login. This allows an attacker to perform a brute-force
PT-2024-33010
Name of the Vulnerable Software and Affected Versions Lylme Spage version 1.9.5 Description The issue is related to Incorrect Access Control, where there is no limit on the number of login attempts. Additionally, the verification code does not refresh after a failed login, allowing attackers to...
CVE-2024-48176
Lylme Spage v1.9.5 is vulnerable to Incorrect Access Control. There is no limit on the number of login attempts, and the verification code will not be refreshed after a failed login, which allows attackers to blast the username and password and log into the system backend...
CVE-2024-48176
Lylme Spage v1.9.5 is vulnerable to Incorrect Access Control. There is no limit on the number of login attempts, and the verification code will not be refreshed after a failed login, which allows attackers to blast the username and password and log into the system backend...
CVE-2024-48176
Lylme Spage v1.9.5 is vulnerable to Incorrect Access Control. There is no limit on the number of login attempts, and the verification code will not be refreshed after a failed login, which allows attackers to blast the username and password and log into the system backend...
CVE-2024-38970
vaeThink 1.0.2 is vulnerable to Information Disclosure via the system backend,access management administrator function...
CVE-2024-38970
vaeThink 1.0.2 is vulnerable to Information Disclosure via the system backend,access management administrator function...
