PHP remote file inclusion vulnerability in php121db.php in osDate 2.0.8 and possibly earlier versions allows remote attackers to execute arbitrary PHP code via a URL in the php121dir parameter.
Description of problem: I noticed that puppetmasterd does not initialize its supplementary groups, which may lead to allow puppetmasterd to access files, it should not. E.g. if it is started with "service puppetmaster start", it still has access to all files that allow read access for the supplementary groups of root, e.g. raw disk devices.
I filed an upstream bug report including patches (one needs still to be tested) here: http://projects.reductivelabs.com/issues/show/1806
Version-Release number of selected component (if applicable): puppet-0.24.6-1.fc10 puupet-0.24.6-1.el5
How reproducible: always
Steps to Reproduce: 1. # service puppetmaster start 2. # cat /proc/$(ps --User puppet -o pid | tail -n 1)/status | grep Group Actual results: The output matches "id -G root".
Expected results: The output should match "id -G puppet", i.e. the process should run with the supplementary groups of puppet.
The default supplementary groups of root include the group disk, which e.g. provides raw read access on disk devices.
Additional info: I am not sure, whether this really classifies as a security vulnerability, because https://fedoraproject.org/wiki/Security/Classifications only mentions code execution and denial of service, but imho unwanted access to restricted information is a security vulnerability, too.
Micro-Star International (MSI) Center Pro <= 2.0.16.0 is vulnerable to multiple Privilege Escalation (LPE/EoP) vulnerabilities in the atidgllk.sys, atillk64.sys, MODAPI.sys, NTIOLib.sys, NTIOLibX64.sys, WinRing0.sys, WinRing0x64.sys drivers components. All the vulnerabilities are triggered by sending specific IOCTL requests.
SQL Injection vulnerability discovered in Unified Office Total Connect Now that would allow an attacker to extract sensitive information through a cookie parameter.
Linux deployments of StorageGRID (formerly StorageGRID Webscale) versions 11.6.0 through 11.6.0.2 deployed with a Linux kernel version less than 4.7.0 are susceptible to a vulnerability which could allow a remote unauthenticated attacker to view limited metrics information and modify alert email recipients and content.
A memory leak was discovered in the backport of fixes for CVE-2018-16864 in Red Hat Enterprise Linux (since version v219-62.2) and CentOS. Function dispatchmessagereal() in journald-server.c does not free the memory allocated by setiovecfieldfree() to store the CMDLINE= entry. A local attacker may use this flaw to make systemd-journald crash.
However systemd-journald crash is automatically restarted by systemd by default.
End of life: 3/31/2017, End of support: 1/31/2014, Latest version: 5.11
End of life: 3/31/2017, End of support: 1/31/2014, Latest version: 5.11