Vulmon
Recent Vulnerabilities
Research Posts
Trends
Blog
About
Contact
Vulmon Alerts
By Relevance
By Risk Score
By Publish Date
shadow project shadow vulnerabilities and exploits
(subscribe to this query)
7.8
CVSSv3
CVE-2016-6252
Integer overflow in shadow 4.2.1 allows local users to gain privileges via crafted input to newuidmap.
Shadow Project Shadow 4.2.1
5.3
CVSSv3
CVE-2018-7169
An issue exists in shadow 4.5. newgidmap (in shadow-utils) is setuid and allows an unprivileged user to be placed in a user namespace where setgroups(2) is permitted. This allows an malicious user to remove themselves from a supplementary group, which may allow access to certain ...
Shadow Project Shadow 4.5
3.3
CVSSv3
CVE-2023-29383
In Shadow 4.13, it is possible to inject control characters into fields provided to the SUID program chfn (change finger). Although it is not possible to exploit this directly (e.g., adding a new user fails because \n is in the block list), it is possible to misrepresent the /etc...
Shadow Project Shadow 4.13
7.8
CVSSv3
CVE-2019-19882
shadow 4.8, in certain circumstances affecting at least Gentoo, Arch Linux, and Void Linux, allows local users to obtain root access because setuid programs are misconfigured. Specifically, this affects shadow 4.8 when compiled using --with-libpam but without explicitly passing -...
Shadow Project Shadow 4.8
5.5
CVSSv3
CVE-2016-15024
A vulnerability was found in doomsider shadow. It has been classified as problematic. Affected is an unknown function. The manipulation leads to denial of service. Attacking locally is a requirement. The complexity of an attack is rather high. The exploitability is told to be dif...
Doomsider Shadow Project Doomsider Shadow
5.4
CVSSv3
CVE-2023-23833
Auth. (contributor+) Cross-Site Scripting (XSS) vulnerability in Steven Henty Drop Shadow Boxes plugin <= 1.7.10 versions.
Drop Shadow Boxes Project Drop Shadow Boxes
9.8
CVSSv3
CVE-2017-12424
In shadow prior to 4.5, the newusers tool could be made to manipulate internal data structures in ways unintended by the authors. Malformed input may lead to crashes (with a buffer overflow or other memory corruption) or other unspecified behaviors. This crosses a privilege bound...
Shadow Project Shadow
Debian Debian Linux 9.0
7.8
CVSSv3
CVE-2005-4890
There is a possible tty hijacking in shadow 4.x prior to 4.1.5 and sudo 1.x prior to 1.7.4 via "su - user -c program". The user session can be escaped to the parent session by using the TIOCSTI ioctl to push characters into the input buffer to be read by the next proces...
Debian Shadow
Sudo Project Sudo
Debian Debian Linux 8.0
Debian Debian Linux 9.0
Debian Debian Linux 10.0
Redhat Enterprise Linux 5
Redhat Enterprise Linux 4
Redhat Enterprise Linux 6.0
2 Github repositories
NA
CVE-2012-5390
The standard universe shadow (condor_shadow.std) component in Condor 7.7.3 up to and including 7.7.6, 7.8.0 prior to 7.8.5, and 7.9.0 does no properly check privileges, which allows remote malicious users to gain privileges via a crafted standard universe job.
Condor Project Condor 7.9.0
Condor Project Condor 7.8.0
Condor Project Condor 7.8.2
Condor Project Condor 7.8.4
Condor Project Condor 7.8.1
Condor Project Condor 7.8.3
Condor Project Condor 7.7.3
Condor Project Condor 7.7.4
Condor Project Condor 7.7.5
Condor Project Condor 7.7.6
7.5
CVSSv3
CVE-2021-45043
HD-Network Real-time Monitoring System 2.0 allows ../ directory traversal to read /etc/shadow via the /language/lang s_Language parameter.
Hd-network Real-time Monitoring System Project Hd-network Real-time Monitoring System 2.0
1 Github repository
CVSSv3
CVSSv2
CVSSv3
VMScore
Recommendations:
CVE-2024-32976
CVE-2024-33557
CVE-2024-36801
CVE-2024-35654
authentication bypass
CVE-2024-24919
CSRF
code execution
CVE-2024-27348
Vulnerability Notification Service
You don’t have to wait for vulnerability scanning results
Get Started
1
2
NEXT »