Nixpkgs security tracker

Login with GitHub
⚠️ You are using a production deployment that is still only suitable for demo purposes. Any work done in this might be wiped later without notice.

Suggestions search

All statuses
Filter by:
With package: clickhouse-backup

Found 2 matching suggestions

View:
Compact
Detailed
Untriaged
Permalink CVE-2026-73664
8.6 HIGH
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): High (H)
  • User Interaction (UI): None (N)
  • Vulnerable System Impact Confidentiality (VC): High (H)
  • Vulnerable System Impact Integrity (VI): High (H)
  • Vulnerable System Impact Availability (VA): High (H)
  • Subsequent System Impact Confidentiality (SC): None (N)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): High (H)
  • Modified User Interaction (MUI): None (N)
  • Modified Vulnerable System Impact Confidentiality (MVC): High (H)
  • Modified Vulnerable System Impact Integrity (MVI): High (H)
  • Modified Vulnerable System Impact Availability (MVA): High (H)
  • Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
  • Exploit Maturity (E): Not Defined (X)
created 2 weeks, 2 days ago Activity log
  • Created suggestion 2 weeks, 2 days ago
FreePBX: Authenticated Arbitrary SSH Key Injection via Backup Module

FreePBX is an open source IP PBX. From 17.0.5.34 until 17.0.11, the publicKeySave AJAX endpoint in Backup.class.php accepts an authenticated administrator's SSH public key and appends it to /home/asterisk/.ssh/authorized_keys for the asterisk system user without reliably enforcing backup-only command and source restrictions. The key grants persistent shell access that can execute arbitrary commands, access FreePBX and call data, modify system files, and disrupt services. This issue is fixed in version 17.0.11.

Affected products

backup
  • ==>= 17.0.5.34, < 17.0.11

Matching in nixpkgs

pkgs.ghbackup

Backup your GitHub repositories with a simple command-line application written in Go

pkgs.dvdbackup

Tool to rip video DVDs from the command line

pkgs.qr-backup

Utility to generate paper backup of files using QR codes

pkgs.borgbackup

Deduplicating archiver with compression and encryption

pkgs.luckybackup

Powerful, fast and reliable backup & sync tool

pkgs.mylvmbackup

Tool for quickly creating full physical backups of a MySQL server's data files

  • nixos-unstable 0.16
    • nixpkgs-unstable 0.16
    • nixos-unstable-small 0.16
  • nixos-26.05 0.16
    • nixos-26.05-small 0.16
    • nixpkgs-26.05-darwin 0.16

pkgs.storebackup

Backup suite that stores files on other disks

  • nixos-unstable -
    • nixos-unstable-small 3.5.2

pkgs.rdiff-backup

Backup system trying to combine best a mirror and an incremental backup system

pkgs.virtnbdbackup

Backup utility for Libvirt/qemu/kvm

  • nixos-unstable 2.46
    • nixpkgs-unstable 2.46
    • nixos-unstable-small 2.49
  • nixos-26.05 2.46
    • nixos-26.05-small 2.46
    • nixpkgs-26.05-darwin 2.46

pkgs.rotate-backups

Simple command line interface for backup rotation

  • nixos-unstable 8.1
    • nixpkgs-unstable 8.1
    • nixos-unstable-small 8.1

pkgs.zfs-autobackup

ZFS backup, replicationand snapshot tool

  • nixos-unstable 3.3
    • nixpkgs-unstable 3.3
    • nixos-unstable-small 3.3
  • nixos-26.05 3.3
    • nixos-26.05-small 3.3
    • nixpkgs-26.05-darwin 3.3

pkgs.automysqlbackup

Script to run daily, weekly and monthly backups for your MySQL database

Package maintainers

Untriaged
Permalink CVE-2026-19062
5.5 MEDIUM
  • CVSS version (CVSS): 4.0
  • Attack Vector (AV): Network (N)
  • Attack Complexity (AC): Low (L)
  • Attack Requirement (AT): None (N)
  • Privileges Required (PR): None (N)
  • User Interaction (UI): None (N)
  • Vulnerable System Impact Confidentiality (VC): Low (L)
  • Vulnerable System Impact Integrity (VI): Low (L)
  • Vulnerable System Impact Availability (VA): Low (L)
  • Subsequent System Impact Confidentiality (SC): None (N)
  • Subsequent System Impact Integrity (SI): None (N)
  • Subsequent System Impact Availability (SA): None (N)
  • Exploit Maturity (E): POC (P)
  • Modified Attack Vector (MAV): Network (N)
  • Modified Attack Complexity (MAC): Low (L)
  • Modified Attack Requirement (MAT): None (N)
  • Modified Privileges Required (MPR): None (N)
  • Modified User Interaction (MUI): None (N)
  • Modified Vulnerable System Impact Confidentiality (MVC): Low (L)
  • Modified Vulnerable System Impact Integrity (MVI): Low (L)
  • Modified Vulnerable System Impact Availability (MVA): Low (L)
  • Modified Subsequent System Impact Confidentiality (MSC): Negligible (N)
  • Modified Subsequent System Impact Integrity (MSI): Negligible (N)
  • Modified Subsequent System Impact Availability (MSA): Negligible (N)
  • Safety (S): Not Defined (X)
  • Automatable (AU): Not Defined (X)
  • Recovery (R): Not Defined (X)
  • Value Density (V): Not Defined (X)
  • Vulnerability Response Effort (RE): Not Defined (X)
  • Provider Urgency (U): Not Defined (X)
  • Confidentiality Req. (CR): Not Defined (X)
  • Integrity Req. (IR): Not Defined (X)
  • Availability Req. (AR): Not Defined (X)
created 3 weeks, 2 days ago Activity log
  • Created suggestion 3 weeks, 2 days ago
chiuwingyan house selectall.action sql injection

A vulnerability has been found in chiuwingyan house up to dea6bcceaebe2b364a5a209747f48ecc2b2dc670. This affects an unknown part of the file /paid/selectall.action. The manipulation of the argument zuname leads to sql injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. Continious delivery with rolling releases is used by this product. Therefore, no version details of affected nor updated releases are available. The vendor was contacted early about this disclosure but did not respond in any way.

Affected products

house
  • ==dea6bcceaebe2b364a5a209747f48ecc2b2dc670

Matching in nixpkgs

pkgs.clickhouse-cpp

C++ client library for ClickHouse

  • nixos-unstable -
    • nixos-unstable-small 2.6.2

pkgs.agent-safehouse

Sandbox your local AI agents so they can read/write only what they need

  • nixos-unstable -