Where
AND
AND
-Infinity
0

Trending

Last week
Last month
Last year

redhat/sudoLast updated 25 August 2025

Risk 81
Severity
9
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

A flaw was found in sudo before version 1.8.28. When sudo is configured to allow a user to run commands as an arbitrary user via the 'ALL' keyword in a 'Runas' specification, it is possible to run commands as root.

1 / 4
Source: Red Hat

Remedy

This vulnerability only affects configurations of sudo that have a runas user list that includes an exclusion of root. The most simple example is: ~~~ someuser ALL=(ALL, !root) /usr/bin/somecommand ~~~ The exclusion is specified using an excalamation mark (!). In this example, the "root" user is specified by name. The root user may also be identified in other ways, such as by user id: ~~~ someuser ALL=(ALL, !#0) /usr/bin/somecommand ~~~ or by reference to a runas alias: ~~~ Runas_Alias MYGROUP = root, adminuser someuser ALL=(ALL, !MYGROUP) /usr/bin/somecommand ~~~ To ensure your sudoers configuration is not affected by this vulnerability, we recommend examining each sudoers entry that includes the `!` character in the runas specification, to ensure that the root user is not among the exclusions. These can be found in the /etc/sudoers file or files under /etc/sudoers.d.
First published (updated )
CVE-2019-14287

redhat/procps-ngInteger Overflow

Risk 89
Severity
9.8
Integer Overflow
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Last updated 25 August 2025

1 / 3
Source: Ubuntu
First published (updated )
CVE-2018-1126

redhat/librelpBuffer Overflow

Risk 90
Severity
9.8
Buffer Overflow
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Last updated 25 August 2025

1 / 3
Source: Ubuntu
First published (updated )
CVE-2018-1000140

redhat/python-paramikoLast updated 25 August 2025

Risk 90
Severity
9.8
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

A flaw was found in the implementation of transport.py in Paramiko before 1.17.6, 1.18.x before 1.18.5, 2.0.x before 2.0.8, 2.1.x before 2.1.5, 2.2.x before 2.2.3, 2.3.x before 2.3.2, and 2.4.x before 2.4.1 does not properly check whether authentication is completed before processing other requests, as demonstrated by channel-open. A customized SSH client can simply skip the authentication step.

Upstream Issue:

https://github.com/paramiko/paramiko/issues/1175

Upstream Patch:

https://github.com/paramiko/paramiko/commit/fa29bd8446c8eab237f5187d28787727b4610516

1 / 3
Source: Red Hat
First published (updated )
CVE-2018-7750

debian/openjdk-8Oracle Java SE and Java SE Embedded Remote Code Execution Vulnerability

Risk 100
Severity
9.8
Exploited
AV:N/AC:L/Au:N/C:C/I:C/A:C

An unspecified flaw was found in the Libraries component in OpenJDK. ObjectInputStream's readSerialData() could, in certain cases, incorrectly perform deserialization of data from serialized input. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions.

1 / 5
First published (updated )
CVE-2015-2590

Adobe Flash PlayerAdobe Flash Player Use-After-Free Vulnerability

Risk 100
Severity
9.8
Exploited
Use After Free, Buffer Overflow
AV:N/AC:L/Au:N/C:C/I:C/A:C

Use-after-free vulnerability in the ByteArray class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13.x through 13.0.0.296 and 14.x through 18.0.0.194 on Windows and OS X and 11.x through 11.2.202.468 on Linux allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via crafted Flash content that overrides a valueOf function, as exploited in the wild in July 2015.

1 / 2
First published (updated )
CVE-2015-5119

IBM JavaUnspecified vulnerability in IBM Java 8 before SR1, 7 R1 before SR2 FP11, 7 before SR9, 6 R1 before …

Risk 86
Severity
9.8
AV:N/AC:L/Au:N/C:P/I:P/A:P

Unspecified vulnerability in IBM Java 8 before SR1, 7 R1 before SR2 FP11, 7 before SR9, 6 R1 before SR8 FP4, 6 before SR16 FP4, and 5.0 before SR16 FP10 allows remote attackers to gain privileges via unknown vectors related to the Java Virtual Machine.

First published (updated )
CVE-2015-0192

Adobe Flash PlayerAdobe Flash Player Memory Corruption Vulnerability

Risk 100
Severity
9.8
Exploited
AV:N/AC:L/Au:N/C:C/I:C/A:C

Adobe Flash Player before 13.0.0.281 and 14.x through 17.x before 17.0.0.169 on Windows and OS X and before 11.2.202.457 on Linux allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors, as exploited in the wild in April 2015, a different vulnerability than CVE-2015-0347, CVE-2015-0350, CVE-2015-0352, CVE-2015-0353, CVE-2015-0354, CVE-2015-0355, CVE-2015-0360, CVE-2015-3038, CVE-2015-3041, and CVE-2015-3042.

1 / 2
First published (updated )
CVE-2015-3043

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203