CVSS: 9.8EPSS: 1%CPEs: 10EXPL: 0CVE-2019-3463
https://notcve.org/view.php?id=CVE-2019-3463
Insufficient sanitization of arguments passed to rsync can bypass the restrictions imposed by rssh, a restricted shell that should restrict users to perform only rsync operations, resulting in the execution of arbitrary shell commands. El saneamiento insuficiente de los argumentos que se pasan a rsync puede omitir las restricciones impuestas por rssh, un shell restringido que debería hacer que los usuarios solo puedan realizar operaciones rsync, lo que resulta en la ejecución de comandos shell arbitrarios. • http://seclists.org/fulldisclosure/2021/May/78 http://www.securityfocus.com/bid/106839 https://lists.debian.org/debian-lts-announce/2019/02/msg00007.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HO3MDU3AH5SLYBKHH5PJ6PHC63ASIF42 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KR2OHTHMJVV4DO3HDRFQQZ5JENHDJQEN https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T42YYNWJZG422GATWAHAEK4A24OKY557 https:/&#x • CWE-88: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') •
CVSS: 9.8EPSS: 1%CPEs: 10EXPL: 0CVE-2019-3464
https://notcve.org/view.php?id=CVE-2019-3464
Insufficient sanitization of environment variables passed to rsync can bypass the restrictions imposed by rssh, a restricted shell that should restrict users to perform only rsync operations, resulting in the execution of arbitrary shell commands. El saneamiento insuficiente de las variables de entorno que se pasan a rsync puede omitir las restricciones impuestas por rssh, un shell restringido que debería hacer que los usuarios solo puedan realizar operaciones rsync, lo que resulta en la ejecución de comandos shell arbitrarios. • http://seclists.org/fulldisclosure/2021/May/78 http://www.securityfocus.com/bid/106839 https://lists.debian.org/debian-lts-announce/2019/02/msg00007.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HO3MDU3AH5SLYBKHH5PJ6PHC63ASIF42 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KR2OHTHMJVV4DO3HDRFQQZ5JENHDJQEN https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T42YYNWJZG422GATWAHAEK4A24OKY557 https:/&#x • CWE-665: Improper Initialization •
CVSS: 7.8EPSS: 0%CPEs: 10EXPL: 1CVE-2019-1000018
https://notcve.org/view.php?id=CVE-2019-1000018
rssh version 2.3.4 contains a CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in allowscp permission that can result in Local command execution. This attack appear to be exploitable via An authorized SSH user with the allowscp permission. rssh 2.3.4 contiene un CWE-77: neutralización indebida de elementos especiales empleados en un comando (inyección de comandos) en el permiso allowscp que puede resultar en la ejecución local de comandos. El ataque parece ser explotable mediante un usuario SSH autorizado mediante el permiso allowscp. • http://seclists.org/fulldisclosure/2021/May/78 https://esnet-security.github.io/vulnerabilities/20190115_rssh https://lists.debian.org/debian-lts-announce/2019/01/msg00027.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/HO3MDU3AH5SLYBKHH5PJ6PHC63ASIF42 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/KR2OHTHMJVV4DO3HDRFQQZ5JENHDJQEN https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/T42YYNWJZG422GATWAHAEK4A2 • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •
CVSS: 4.4EPSS: 0%CPEs: 3EXPL: 0CVE-2012-2251
https://notcve.org/view.php?id=CVE-2012-2251
rssh 2.3.2, as used by Debian, Fedora, and others, when the rsync protocol is enabled, allows local users to bypass intended restricted shell access via a (1) "-e" or (2) "--" command line option. rssh v2.3.2, tal y como como se usa en Debian, Fedora, y otros, cuando el protocolo rsync está habilitado, permite a los usuarios locales eludir las restricciones de acceso a través de una opción (1) "-e" o (2) "--" de la línea de comandos. • http://archives.neohapsis.com/archives/bugtraq/2012-11/0101.html http://secunia.com/advisories/51307 http://www.debian.org/security/2012/dsa-2578 http://www.openwall.com/lists/oss-security/2012/11/27/15 http://www.securityfocus.com/bid/56708 https://bugzilla.redhat.com/show_bug.cgi?id=877279 https://exchange.xforce.ibmcloud.com/vulnerabilities/80334 • CWE-20: Improper Input Validation •
CVSS: 4.4EPSS: 0%CPEs: 14EXPL: 0CVE-2012-2252
https://notcve.org/view.php?id=CVE-2012-2252
Incomplete blacklist vulnerability in rssh before 2.3.4, when the rsync protocol is enabled, allows local users to bypass intended restricted shell access via the --rsh command line option. Vulnerabilidad de lista negra incompleta en rssh antes de v2.3.4, cuando el protocolo rsync está activado, permite a los usuarios locales eludir las restricciones de acceso a la interfaz de comandos a través de la opción --rsh de la línea de comandos. • http://archives.neohapsis.com/archives/bugtraq/2012-11/0101.html http://osvdb.org/87926 http://secunia.com/advisories/51307 http://secunia.com/advisories/51343 http://www.debian.org/security/2012/dsa-2578 http://www.openwall.com/lists/oss-security/2012/11/27/15 http://www.openwall.com/lists/oss-security/2012/11/28/2 http://www.openwall.com/lists/oss-security/2012/11/28/3 http://www.securityfocus.com/bid/56708 https://bugzilla.redhat.com/show_bug.cgi?i •