| CVE-2020-11936 | THẤP3.1 | gdbus setgid privilege escalation | 31/01/2025 |
| CVE-2022-28653 | CAO7.5 | Users can consume unlimited disk space in /var/crash | 31/01/2025 |
| CVE-2024-6219 | THẤP3.8 | Mark Laing discovered in LXD's PKI mode, until version 5.21.1, that a restricted certificate could be added to the trust store with its restrictions not honoured. | 06/12/2024 |
| CVE-2024-6156 | THẤP3.8 | Mark Laing discovered that LXD's PKI mode, until version 5.21.2, could be bypassed if the client's certificate was present in the trust store. | 06/12/2024 |
| CVE-2024-9312 | TRUNG BÌNH6.4 | Authd, through version 0.3.6, did not sufficiently randomize user IDs to prevent collisions. A local attacker who can register user names could spoof another user's ID and gain their privileges. | 10/10/2024 |
| CVE-2024-9313 | CAO8.8 | Authd PAM module before version 0.3.5 can allow broker-managed users to impersonate any other user managed by the same broker and perform any PAM operation with it, including authenticating as them. | 03/10/2024 |
| CVE-2024-8038 | TRUNG BÌNH5.5 | Vulnerable juju introspection abstract UNIX domain socket. An abstract UNIX domain socket responsible for introspection is available without authentication locally to network namespace users. This enables denial of service attacks. | 02/10/2024 |
| CVE-2024-8037 | TRUNG BÌNH6.5 | Vulnerable juju hook tool abstract UNIX domain socket. When combined with an attack of JUJU_CONTEXT_ID, any user on the local system with access to the default network namespace may connect to the @/var/lib/juju/agents/unit-xxxx-yyyy/agent.socket and perform actions that are normally reserved to a juju charm. | 02/10/2024 |
| CVE-2024-7558 | CAO8.0 | JUJU_CONTEXT_ID is a predictable authentication secret. On a Juju machine (non-Kubernetes) or Juju charm container (on Kubernetes), an unprivileged user in the same network namespace can connect to an abstract domain socket and guess the JUJU_CONTEXT_ID value. This gives the unprivileged user access to the same informa | 02/10/2024 |
| CVE-2024-8287 | CAO7.5 | Anbox Management Service, in versions 1.17.0 through 1.23.0, does not validate the TLS certificate provided to it by the Anbox Stream Agent. An attacker must be able to machine-in-the-middle the Anbox Stream Agent from within an internal network before they can attempt to take advantage of this. | 18/09/2024 |
| CVE-2024-6984 | THẤP3.8 | An issue was discovered in Juju that resulted in the leak of the sensitive context ID, which allows a local unprivileged attacker to access other sensitive data or relation accessible to the local charm. | 29/07/2024 |
| CVE-2024-29069 | CAO7.3 | In snapd versions prior to 2.62, snapd failed to properly check the
destination of symbolic links when extracting a snap. The snap format
is a squashfs file-system image and so can contain symbolic links and
other file types. Various file entries within the snap squashfs image
(such as icons and desktop files etc) are | 25/07/2024 |
| CVE-2024-29068 | TRUNG BÌNH6.6 | In snapd versions prior to 2.62, snapd failed to properly check the file
type when extracting a snap. The snap format is a squashfs file-system
image and so can contain files that are non-regular files (such as pipes
or sockets etc). Various file entries within the snap squashfs image
(such as icons etc) are directly | 25/07/2024 |
| CVE-2024-1724 | CAO8.2 | In snapd versions prior to 2.62, when using AppArmor for enforcement of
sandbox permissions, snapd failed to restrict writes to the $HOME/bin
path. In Ubuntu, when this path exists, it is automatically added to
the users PATH. An attacker who could convince a user to install a
malicious snap which used the 'home' plug | 25/07/2024 |
| CVE-2024-6714 | CAO7.8 | An issue was discovered in provd before version 0.1.5 with a setuid binary, which allows a local attacker to escalate their privilege. | 23/07/2024 |
| CVE-2024-6388 | TRUNG BÌNH5.5 | Marco Trevisan discovered that the Ubuntu Advantage Desktop Daemon, before version 1.12, leaks the Pro token to unprivileged users by passing the token as an argument in plaintext. | 27/06/2024 |
| CVE-2020-27352 | CAO8.8 | When generating the systemd service units for the docker snap (and other similar snaps), snapd does not specify Delegate=yes - as a result systemd will move processes from the containers created and managed by these snaps into the cgroup of the main daemon within the snap itself when reloading system units. This may gr | 21/06/2024 |
| CVE-2022-4968 | TRUNG BÌNH6.5 | netplan leaks the private key of wireguard to local users. Versions after 1.0 are not affected. | 07/06/2024 |
| CVE-2022-1242 | CAO7.8 | Apport can be tricked into connecting to arbitrary sockets as the root user | 03/06/2024 |
| CVE-2022-0555 | CAO8.4 | Subiquity Shows Guided Storage Passphrase in Plaintext with Read-all Permissions | 03/06/2024 |