68 matches found
ghostlock-pfem10
GhostLock — OPPO Find X5 Pro PFEM10 English · 中文 ColorOS 16 上の OPPO Find X5 Pro 向け GhostLock CVE-2026-43499 ポート。uid=0 の子プロセスとロード済みの kernelsu.ko に到達する。root プロセスは傍受される。 脆弱性 CVE-2026-43499 — futex PI の use-after-free。removewaiter は、current が requeuer である場合に current-piblockedon をクリアする。これは...
CVE-2026-55887
MCP Gateway allows easy and secure running and deployment of MCP servers. From 0.21.0 until 0.42.2, Docker MCP Gateway YAML-unmarshalled the attacker-controlled io.docker.server.metadata OCI image label into the broad catalog.Server structure for direct docker:// references and catalog snapshot...
OESA-2026-3719 containerd security update
containerd is an industry-standard container runtime with an emphasis on simplicity, robustness and portability. It is available as a daemon for Linux and Windows, which can manage the complete container lifecycle of its host system: image transfer and storage, container execution and supervision...
Unity Linux 20.1060e Security Update: containerd (UTSA-2026-107041)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-107041 advisory. containerd is an open-source container runtime. In versions prior to 1.7.32, 2.0.9, 2.2.4 and 2.3.1, containers launched with a numeric User directive that cannot be...
CVE-2026-46680: Improper Privilege Management
containerd is an open-source container runtime. In versions prior to 1.7.32, 2.0.9, 2.2.4 and 2.3.1, containers launched with a numeric User directive that cannot be parsed as a 32-bit integer are incorrectly treated as a username, leading to runAsNonRoot evasion. If a crafted image provides an...
CVE-2025-57851: Incorrect Default Permissions
A container privilege escalation flaw was found in certain Multicluster Engine for Kubernetes images. This issue stems from the /etc/passwd file being created with group-writable permissions during build time. In certain conditions, an attacker who can execute commands within an affected containe...
CVE-2026-30892: Improper Privilege Management
crun is an open source OCI Container Runtime fully written in C. In versions 1.19 through 1.26, the crun exec option -u --user is incorrectly parsed. The value 1 is interpreted as UID 0 and GID 0 when it should have been UID 1 and GID 0. The process thus runs with higher privileges than expected...
CVE-1999-0555
A Unix account with a name other than "root" has UID 0, i.e. root privileges...
EUVD-2019-8867
Malware in sbrugna...
CVE-2025-57852 Openshift-ai: privilege escalation via excessive /etc/passwd permissions
A container privilege escalation flaw was found in KServe ModelMesh container images. This issue stems from the /etc/passwd file being created with group-writable permissions during build time. In certain conditions, an attacker who can execute commands within an affected container, even as a...
Do Not Allow Non-root Users with UID 0
The user with UID 0 is the super administrator user in the Linux system. By convention, the user name is root. The UID of a non-root user cannot be 0. If the UID of the root user is changed to another value and the UID of another user for example, the test user is changed to 0, the test user is...
ROS-20240402-01
A vulnerability in the PMIx process control interface is related to the execution of library code with UID 0. Exploitation of the vulnerability could allow an attacker acting remotely to gain access to sensitive data...
Fedora 39 : openmpi / pmix / prrte / slurm (2023-1185eca900)
The remote Fedora 39 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2023-1185eca900 advisory. Security fix for CVE-2023-41915 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus h...
Debian DSA-5547-1 : pmix - security update
The remote Debian 11 / 12 host has packages installed that are affected by a vulnerability as referenced in the dsa-5547 advisory. Francois Diakhate reported that a race condition in pmix, a library implementing Process Management Interface PMI Exascale API, could allow a malicious user to obtain...
Debian dla-3643 : libpmi-pmix-dev - security update
The remote Debian 10 host has packages installed that are affected by a vulnerability as referenced in the dla-3643 advisory. - ------------------------------------------------------------------------- Debian LTS Advisory DLA-3643-1 [email protected] https://www.debian.org/lts/security/...
Fedora 37 : openmpi / pmix / prrte / slurm (2023-155d2f22f1)
The remote Fedora 37 host has packages installed that are affected by multiple vulnerabilities as referenced in the FEDORA-2023-155d2f22f1 advisory. Security fix for CVE-2023-41915 Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus h...
Amazon Linux 2023 : pmix, pmix-devel, pmix-pmi (ALAS2023-2023-363)
It is, therefore, affected by a vulnerability as referenced in the ALAS2023-2023-363 advisory. OpenPMIx PMIx before 4.2.6 and 5.0.x before 5.0.1 allows attackers to obtain ownership of arbitrary files via a race condition during execution of library code with UID 0. CVE-2023-41915 Tenable has...
SUSE SLES15: libmca_common_dstore1 / libpmix2 / pmix / pmix-devel / pmix-headers / etc (SUSE-SU-2023:3859-1)
The remote SUSE Linux SLES15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2023:3859-1 advisory. - CVE-2023-41915: Fixed a potential vulnerability where a chown may follow a user-created link bsc1215190. - Install pmix-plugin-munge if...