sudo-rs: Path Traversal vulnerability

Impact An issue was discovered where usernames containing the . and / characters could result in the corruption of specific files on the filesystem. As usernames are generally not limited by the characters they can contain, a username appearing to be a relative path can be constructed. For exampl...

TTSPlanning SQL Injection Vulnerability

TTSPlanning is a solar power monitoring application from TTSPlanning Japan. TTSPlanning suffers from a SQL injection vulnerability that stems from the fact that manipulation of the parameter uid can lead to sql injection...

CVE-2023-24548

creationtimestamp| type| source ---|---|--- 2023-08-29 20:17:40+00:00| seen| https://t.me/cibsecurity/69364...

CVE-2023-4436

A vulnerability, which was classified as critical, has been found in SourceCodester Inventory Management System 1.0. This issue affects some unknown processing of the file app/action/editupdate.php. The manipulation of the argument userid leads to sql injection. The attack may be initiated...

CVE-2023-30477

creationtimestamp| type| source ---|---|--- 2023-08-14 18:24:31+00:00| seen| https://t.me/cibsecurity/68447...

PT-2023-25413 · WordPress · Simple Author Box

Name of the Vulnerable Software and Affected Versions: The Simple Author Box WordPress plugin versions prior to 2.52 Description: The issue is related to the disclosure of arbitrary user information due to a lack of verification of the user ID before outputting information about that user. This c...

CVE-2023-33993

creationtimestamp| type| source ---|---|--- 2023-08-08 07:13:49+00:00| seen| https://t.me/cibsecurity/67935...

CVE-2023-2309

creationtimestamp| type| source ---|---|--- 2023-07-24 14:25:57+00:00| seen| https://t.me/cibsecurity/67143...

CVE-2023-32050

creationtimestamp| type| source ---|---|--- 2023-07-11 22:35:59+00:00| seen| https://t.me/cibsecurity/66430...

CVE-2021-33223

An issue discovered in SeedDMS 6.0.15 allows an attacker to escalate privileges via the userid and role parameters in the out.UsrMgr.php file...

UBUNTU-CVE-2023-0386

A flaw was found in the Linux kernel, where unauthorized access to the execution of the setuid file with capabilities was found in the Linux kernel’s OverlayFS subsystem in how a user copies a capable file from a nosuid mount into another mount. This uid mapping bug allows a local user to escalat...

CVE-2022-45636

creationtimestamp| type| source ---|---|--- 2023-03-21 21:35:07+00:00| seen| https://t.me/cibsecurity/60404...

CVE-2023-24859

creationtimestamp| type| source ---|---|--- 2023-03-14 19:30:17+00:00| seen| https://t.me/cibsecurity/60002...

CLSA-2023-1678396066 systemd: Fix of CVE-2022-4415

CVE-2022-4415: coredump: do not allow user to access coredumps with changed uid/gid/capabilities...

CVE-2023-22805

creationtimestamp| type| source ---|---|--- 2023-02-15 20:46:42+00:00| seen| https://t.me/cibsecurity/58251...

SUSE CVE-2007-3099

usr/mgmtipc.c in iscsid in open-iscsi iscsi-initiator-utils before 2.0-865 checks the client's UID on the listening AFLOCAL socket instead of the new connection, which allows remote attackers to access the management interface and cause a denial of service iscsid exit or iSCSI connection loss...

SUSE CVE-2007-6206

The docoredump function in fs/exec.c in Linux kernel 2.4.x and 2.6.x up to 2.6.24-rc3, and possibly other versions, does not change the UID of a core dump file if it exists before a root process creates a core dump in the same location, which might allow local users to obtain sensitive informatio...

SUSE CVE-2013-1979

The scmsetcred function in include/net/scm.h in the Linux kernel before 3.8.11 uses incorrect uid and gid values during credentials passing, which allows local users to gain privileges via a crafted application...

SUSE CVE-2013-4340

wp-admin/includes/post.php in WordPress before 3.6.1 allows remote authenticated users to spoof the authorship of a post by leveraging the Author role and providing a modified userID parameter...

SUSE CVE-2016-6190

SOGo before 2.3.12 and 3.x before 3.1.1 does not restrict access to the UID and DTSTAMP attributes, which allows remote authenticated users to obtain sensitive information about appointments with the "View the Date & Time" restriction, as demonstrated by correlating UIDs and DTSTAMPs between all...