sssctlruncommand() is a wrapper for running commands via a shell, using glibc's system() function call. sssctlcacheexpire() and sssctllogsfetch() allow user provided arguments, and pass them to sssctlruncommand() sssctl is limited to root user, however, if an administrator allows unprivileged users to provide arguments to the command (e.g.: via sudo), this could be used to elevate privileges via a shell injection.
Although there are no known default configuration where this flaw could be exploited, the admin could have manually created sudo rules to let regular users use sssctl commands, or could be tricked into running a specially crafted sssctl command.
References:
https://sssd.io/release-notes/sssd-2.6.0.html
Affected Node.js versions can be exploited to perform HTTP desync attacks and deliver malicious payloads to unsuspecting users. The payloads can be crafted by an attacker to hijack user sessions, poison cookies, perform clickjacking, and a multitude of other attacks depending on the architecture of the underlying system.
Downloads & release details
Node.js v10.19.0 (LTS) - https://nodejs.org/en/blog/release/v10.19.0/ Node.js v12.15.0 (LTS) - https://nodejs.org/en/blog/release/v12.15.0/ Node.js v13.8.0 (LTS) - https://nodejs.org/en/blog/release/v13.8.0/
The Samba vfsfruit module uses extended file attributes (EA, xattr) to provide "...enhanced compatibility with Apple SMB clients and interoperability with a Netatalk 3 AFP fileserver." Samba versions prior to 4.13.17, 4.14.12 and 4.15.5 with vfsfruit configured allow out-of-bounds heap read and write via specially crafted extended file attributes. A remote attacker with write access to extended file attributes can execute arbitrary code with the privileges of smbd, typically root.
A vulnerability was found in SQLAlchemy 1.2.17. An SQL Injection when the orderby parameter can be controlled.
Upstream issue:
https://github.com/sqlalchemy/sqlalchemy/issues/4481
Upstream patch:
https://github.com/sqlalchemy/sqlalchemy/commit/30307c4616ad67c01ddae2e1e8e34fabf6028414
Buffer overflow in system firmware for EDK II may allow unauthenticated user to potentially enable escalation of privilege and/or denial of service via network access.
A flaw was found in the way Samba, as an Active Directory Domain Controller, implemented Kerberos name-based authentication. The Samba AD DC, could become confused about the user a ticket represents if it did not strictly require a Kerberos PAC and always use the SIDs found within. The result could include total domain compromise.