Pardus Software Center
Monthly
Path traversal (CWE-22) in TUBITAK BILGEM's Pardus Software Center before 1.0.3 lets a remote attacker craft package or repository content whose file paths escape the intended install directory, resulting in high-severity confidentiality, integrity, and availability impact with a scope change (CVSS 9.6). Exploitation requires the victim to interact (UI:R), typically by installing or opening attacker-supplied content, and there is no public exploit identified at time of analysis. EPSS is very low (0.03%, 10th percentile) and CISA SSVC records exploitation as 'none', indicating no observed activity despite the critical score.
Privilege escalation in TUBITAK BILGEM's Pardus Software Center before 1.0.3 allows an attacker to hijack a privileged process, enabling full compromise of confidentiality, integrity, and availability on affected Pardus Linux systems. The flaw stems from improper privilege management (CWE-269) and requires user interaction to trigger, but no prior authentication per the CVSS vector. There is no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.04%), consistent with CISA SSVC scoring exploitation as 'none'.
A path traversal vulnerability on Pardus Software Center's "extractArchive" function could allow anyone on the same network to do a man-in-the-middle and write files on the system. Rated medium severity (CVSS 5.3), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Path traversal (CWE-22) in TUBITAK BILGEM's Pardus Software Center before 1.0.3 lets a remote attacker craft package or repository content whose file paths escape the intended install directory, resulting in high-severity confidentiality, integrity, and availability impact with a scope change (CVSS 9.6). Exploitation requires the victim to interact (UI:R), typically by installing or opening attacker-supplied content, and there is no public exploit identified at time of analysis. EPSS is very low (0.03%, 10th percentile) and CISA SSVC records exploitation as 'none', indicating no observed activity despite the critical score.
Privilege escalation in TUBITAK BILGEM's Pardus Software Center before 1.0.3 allows an attacker to hijack a privileged process, enabling full compromise of confidentiality, integrity, and availability on affected Pardus Linux systems. The flaw stems from improper privilege management (CWE-269) and requires user interaction to trigger, but no prior authentication per the CVSS vector. There is no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.04%), consistent with CISA SSVC scoring exploitation as 'none'.
A path traversal vulnerability on Pardus Software Center's "extractArchive" function could allow anyone on the same network to do a man-in-the-middle and write files on the system. Rated medium severity (CVSS 5.3), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.