Vendors / Shadow Project Records 5 All Threatist records
Exploited (KEV) 0 None in CISA KEV
CVSS critical 1
CVSS high 2
Exploited now Shadow Project records in CISA KEV No Shadow Project vulnerabilities are listed in CISA KEV.
Components Products in the NVD configurations · select one to filter the records Priority MEDIUM 49
In Shadow 4.13, it is possible to inject control characters into fields provided to the SUID program chfn (change finger).
CVSS 3.1 LOW 3.3· Local · Low privileges · No interaction · EPSS 0.00426 · Published 2023-04-14 · No fix listed CWE-125
Priority MEDIUM 47
In shadow before 4.5, the newusers tool could be made to manipulate internal data structures in ways unintended by the authors.
CVSS 3.1 CRITICAL 9.8· Network · No auth · No interaction · EPSS 0.02659 · Published 2017-08-04 · No fix listed CWE-119
Priority LOW 35
shadow 4.8, in certain circumstances affecting at least Gentoo, Arch Linux, and Void Linux, allows local users to obtain root access because setuid programs are misconfigured.
CVSS 3.1 HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00515 · Published 2019-12-18 · No fix listed CWE-732
Priority LOW 34
Integer overflow in shadow 4.2.1 allows local users to gain privileges via crafted input to newuidmap.
CVSS 3.0 HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00409 · Published 2017-02-17 · No fix listed CWE-190
Priority LOW 27
An issue was discovered in shadow 4.5.
CVSS 3.0 MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.01566 · Published 2018-02-15 · No fix listed CWE-732
Open these records in search → All records by CVSS severity
1 2 1 1 0
THREATIST.IORead the docs