CVE-2011-2916

MediumCVSS 5.5/10Last modified Jun 16, 2026

Description

qtnx 0.9 stores non-custom SSH keys in a world-readable configuration file. If a user has a world-readable or world-executable home directory, another local system user could obtain the private key used to connect to remote NX sessions.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-312

Affected software

No affected versions have been published.

Timeline

Published
Nov 15, 2019
Last modified
Jun 16, 2026
NVD status
Modified

Related CVEs from 2011

CVE-2011-29177.5SQL injection vulnerability in administrator/index2.php in Mambo CMS 4.6.5 and earlier allows remote attackers to execute arbitrary SQL commCVE-2011-29185.5The Performance Events subsystem in the Linux kernel before 3.1 does not properly handle event overflows associated with PERF_COUNT_SW_CPU_CCVE-2011-29194.3Cross-site scripting (XSS) vulnerability in Spacewalk 1.6, as used in Red Hat Network (RHN) Satellite, allows remote attackers to inject arbCVE-2011-29205.5A flaw was found in Spacewalk and Red Hat Network Satellite. This cross-site scripting (XSS) vulnerability allows a remote attacker to injecCVE-2011-29219.8ktsuss versions 1.4 and prior has the uid set to root and does not drop privileges prior to executing user specified commands, which can resCVE-2011-29227.8ktsuss versions 1.4 and prior spawns the GTK interface to run as root. This can allow a local attacker to escalate privileges to root and usCVE-2011-29235.5foomatic-rip filter, all versions, used insecurely creates temporary files for storage of PostScript data by rendering the data when the debCVE-2011-29245.5foomatic-rip filter v4.0.12 and prior used insecurely creates temporary files for storage of PostScript data by rendering the data when the CVE-2011-29254.6Cumin in Red Hat Enterprise Messaging, Realtime, and Grid (MRG) 2.0 records broker authentication credentials in a log file, which allows loCVE-2011-29275.4A flaw was found in Spacewalk and Red Hat Network Satellite. This vulnerability, known as cross-site scripting (XSS), allows remote attackerCVE-2011-29284.9The befs_follow_link function in fs/befs/linuxvfs.c in the Linux kernel before 3.1-rc3 does not validate the length attribute of long symlinCVE-2011-29295.0The template selection functionality in actionpack/lib/action_view/template/resolver.rb in Ruby on Rails 3.0.x before 3.0.10 and 3.1.x befor
CVE-2011-2916: Medium severity, CVSS 5.5 | Vulnix