The PAM module pam_cap.so of libcap configuration supports group names starting with “@”, during actual parsing, configurations not starting with “@” are incorrectly recognized as group names. This may result in nonintended users being granted an inherited capability set, potentially leading to security risks. Attackers can exploit this vulnerability to achieve local privilege escalation on systems where /etc/security/capability.conf is used to configure user inherited privileges by constructing specific usernames.
Unrestricted Upload of File with Dangerous Type vulnerability in kodeshpa Simplified allows Using Malicious Files. This issue affects Simplified: from n/a through 1.0.6.
Affected products
simplified
=<1.0.6
Matching in nixpkgs
pkgs.gnomeExtensions.net-speed-simplified
A Net Speed extension With Loads of Customization. Fork of simplenetspeed
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in CodegearThemes Designer allows DOM-Based XSS. This issue affects Designer: from n/a through 1.6.0.
updated 1 year ago
by @fricklerhandwerkActivity log
Created automatic suggestion
1 year ago
@fricklerhandwerkdismissed
1 year ago
sensitive data exposure in cloud-init logs
Sensitive data could be exposed in logs of cloud-init before version 23.1.2. An attacker could use this information to find hashed passwords and possibly escalate their privilege.
Affected products
cloud-init
<23.1.2
Matching in nixpkgs
pkgs.cloud-init
Provides configuration and customization of cloud instance
updated 1 year ago
by @fricklerhandwerkActivity log
Created automatic suggestion
1 year ago
@fricklerhandwerkdismissed
1 year ago
An authenticated user who has read access to the juju …
An authenticated user who has read access to the juju controller model, may construct a remote request to download an arbitrary file from the controller's filesystem.
Affected products
juju
<3.0.3
<2.9.38
Matching in nixpkgs
pkgs.juju
Open source modelling tool for operating software in the cloud
Missing Authorization vulnerability in Eugen Bobrowski Debug Tool allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Debug Tool: from n/a through 2.2.
Affected products
debug-tool
=<2.2
Matching in nixpkgs
pkgs.python311Packages.django-debug-toolbar
Configurable set of panels that display debug information about the current request/response
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Chris Roberts Annie allows Stored XSS.This issue affects Annie: from n/a through 2.1.1.
Affected products
annie
=<2.1.1
Matching in nixpkgs
pkgs.wannier90
Calculation of maximally localised Wannier functions
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Alex Furr and Simon Ward Progress Tracker allows DOM-Based XSS.This issue affects Progress Tracker: from n/a through 0.9.3.