CVE-2023-1076

MEDIUM Year: 2023
CVSS v3 Score
5.5
Medium
Weakness Type
CWE-791
View all →

Vulnerability Description

A flaw was found in the Linux Kernel. The tun/tap sockets have their socket UID hardcoded to 0 due to a type confusion in their initialization function. While it will be often correct, as tuntap devices require CAP_NET_ADMIN, it may not always be the case, e.g., a non-root user only having that capability. This would make tun/tap sockets being incorrectly treated in filtering/routing decisions, possibly bypassing network filters.

Related Vulnerabilities

CVE-2020-36827

MEDIUM
CVSS:5.4(Medium)

The XAO::Web module before 1.84 for Perl mishandles < and > characters in JSON output during use of json-embed in Web::Action.

CWE-7912020

CVE-2025-0716

MEDIUM
CVSS:4.8(Medium)

Improper sanitization of the value of the 'href' and 'xlink:href' attributes in '<image>' SVG elements in AngularJS allows attackers to bypass common image source restrictions. This can lead to a form...

CWE-7912025

CVE-2025-2040

MEDIUM
CVSS:6.3(Medium)

A vulnerability classified as critical was found in zhijiantianya ruoyi-vue-pro 2.4.1. Affected by this vulnerability is an unknown functionality of the file /admin-api/bpm/model/deploy. The manipulat...

CWE-7912025

CVE-2025-5325

MEDIUM
CVSS:6.3(Medium)

A vulnerability has been found in zhilink 智互联(深圳)科技有限公司 ADP Application Developer Platform 应用开发者平台 1.0.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the f...

CWE-7912025

CVE-2024-8373

MEDIUM
CVSS:4.3(Medium)

Improper sanitization of the value of the [srcset] attribute in <source> HTML elements in AngularJS allows attackers to bypass common image source restrictions, which can also lead to a form of Conten...

CWE-7912024