unix Archives - CVE Vulnerability

CVE-2007-5616

Sun, 26 Feb 2023 09:07:46 +0000

ssh-signer in SSH Tectia Client and Server 5.x before 5.2.4, and 5.3.x before 5.3.6, on Unix and Linux allows local users to gain privileges via unspecified vectors.

The post CVE-2007-5616 appeared first on CVE Vulnerability.

CVE-2020-6294

Sun, 26 Feb 2023 06:42:40 +0000

Xvfb of SAP Business Objects Business Intelligence Platform, versions – 4.2, 4.3, platform on Unix does not perform any authentication checks for functionalities that require user identity.

The post CVE-2020-6294 appeared first on CVE Vulnerability.

CVE-2019-9895

Sun, 26 Feb 2023 06:35:07 +0000

In PuTTY versions before 0.71 on Unix, a remotely triggerable buffer overflow exists in any kind of server-to-client forwarding.

The post CVE-2019-9895 appeared first on CVE Vulnerability.

CVE-2019-15162

Sun, 26 Feb 2023 06:30:49 +0000

rpcapd/daemon.c in libpcap before 1.9.1 on non-Windows platforms provides details about why authentication failed, which might make it easier for attackers to enumerate valid usernames.

The post CVE-2019-15162 appeared first on CVE Vulnerability.

CVE-2021-44717

Thu, 23 Feb 2023 14:12:45 +0000

Go before 1.16.12 and 1.17.x before 1.17.5 on UNIX allows write operations to an unintended file or unintended network connection as a consequence of erroneous closing of file descriptor 0 after file-descriptor exhaustion.

The post CVE-2021-44717 appeared first on CVE Vulnerability.

CVE-2021-40830

Thu, 23 Feb 2023 14:11:50 +0000

The AWS IoT Device SDK v2 for Java, Python, C++ and Node.js appends a user supplied Certificate Authority (CA) to the root CAs instead of overriding it on Unix systems. TLS handshakes will thus succeed if the peer can be verified either from the user-supplied CA or the system’s default trust-store. Attackers with access to a host’s trust stores or are able to compromise a certificate authority already in the host’s trust store (note: the attacker must also be able to spoof DNS in this case) may be able to use this issue to bypass CA pinning. An attacker could then spoof the MQTT broker, and either drop traffic and/or respond with the attacker’s data, but they would not be able to forward this data on to the MQTT broker because the attacker would still need the user’s private keys to authenticate against the MQTT broker. The ‘aws_tls_ctx_options_override_default_trust_store_*’ function within the aws-c-io submodule has been updated to override the default trust store. This corrects this issue. This issue affects: Amazon Web Services AWS IoT Device SDK v2 for Java versions prior to 1.5.0 on Linux/Unix. Amazon Web Services AWS IoT Device SDK v2 for Python versions prior to 1.6.1 on Linux/Unix. Amazon Web Services AWS IoT Device SDK v2 for C++ versions prior to 1.12.7 on Linux/Unix. Amazon Web Services AWS IoT Device SDK v2 for Node.js versions prior to 1.5.3 on Linux/Unix. Amazon Web Services AWS-C-IO 0.10.4 on Linux/Unix.

The post CVE-2021-40830 appeared first on CVE Vulnerability.

CVE-2021-29825

Thu, 23 Feb 2023 14:09:06 +0000

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) could disclose sensitive information when using ADMIN_CMD with LOAD or BACKUP. IBM X-Force ID: 204470.

The post CVE-2021-29825 appeared first on CVE Vulnerability.

CVE-2021-29763

Thu, 23 Feb 2023 14:09:05 +0000

IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 11.1 and 11.5 under very specific conditions, could allow a local user to keep running a procedure that could cause the system to run out of memory.and cause a denial of service. IBM X-Force ID: 202267.

The post CVE-2021-29763 appeared first on CVE Vulnerability.

CVE-2021-21384

Thu, 23 Feb 2023 14:07:00 +0000

shescape is a simple shell escape package for JavaScript. In shescape before version 1.1.3, anyone using _Shescape_ to defend against shell injection may still be vulnerable against shell injection if the attacker manages to insert a into the payload. For an example see the referenced GitHub Security Advisory. The problem has been patched in version 1.1.3. No further changes are required.

The post CVE-2021-21384 appeared first on CVE Vulnerability.

CVE-2022-45461

godfreyd94 — Thu, 23 Feb 2023 05:21:26 +0000

The Java Admin Console in Veritas NetBackup through 10.1 and related Veritas products on Linux and UNIX allows authenticated non-root users (that have been explicitly added to the auth.conf file) to execute arbitrary commands as root.

The post CVE-2022-45461 appeared first on CVE Vulnerability.