PT-2018-17641

Name of the Vulnerable Software and Affected Versions JEXTN Membership version 3.1.0 Description A SQL Injection issue exists in the JEXTN Membership component for Joomla. This issue can be exploited via the usr plan parameter in a "view=myplans&task=myplans.usersubscriptions" request...

PT-2018-17642

Name of the Vulnerable Software and Affected Versions Joomla! JE PayperVideo component version 3.0.0 Description A SQL Injection issue exists in the JE PayperVideo component for Joomla!, specifically via the usr plan parameter in a "view=myplans&task=myplans.usersubscriptions" request...

PT-2017-14584

Name of the Vulnerable Software and Affected Versions PNP4Nagios versions prior to 0.6.27 Description The issue allows local users to gain privileges by leveraging access to an unprivileged account, as /usr/bin/npcd and npcd.cfg are owned by this account but are used for root code execution...

PT-2017-14507

Name of the Vulnerable Software and Affected Versions mail-filter/assp versions 1.9.8.13030 and earlier Description The issue allows local users to gain privileges by leveraging access to the assp user account. This can be achieved by installing a Trojan horse /usr/share/assp/assp.pl script...

PT-2017-13288

Name of the Vulnerable Software and Affected Versions Mahara versions prior to 15.04.14 Mahara versions 16.x prior to 16.04.8 Mahara versions 16.10.x prior to 16.10.5 Mahara versions 17.x prior to 17.04.3 Description An issue allows unauthorized access to a user's account if the browser is closed...

PT-2017-19011

Name of the Vulnerable Software and Affected Versions Mahara versions 15.04 through 15.04.13 Mahara versions 16.04 through 16.04.7 Mahara versions 16.10 through 16.10.4 Mahara versions 17.04 through 17.04.2 Description The issue allows a user to submit potentially dangerous payload, such as XSS...

PT-2017-18845

Name of the Vulnerable Software and Affected Versions TerraMaster TOS versions prior to 3.0.34 Description A Shell metacharacter injection issue in the /usr/www/include/ajax/GetTest.php file allows for remote code execution as root. Recommendations For versions prior to 3.0.34, update to version...

CVE-2017-14312: Improper Privilege Management

Nagios Core through 4.3.4 initially executes /usr/sbin/nagios as root but supports configuration options in which this file is owned by a non-root account and similarly can have nagios.cfg owned by a non-root account, which allows local users to gain privileges by leveraging access to this non-ro...

CVE-2017-1000372

A flaw exists in OpenBSD's implementation of the stack guard page that allows attackers to bypass it resulting in arbitrary code execution using setuid binaries such as /usr/bin/at. This affects OpenBSD 6.1 and possibly earlier versions...

PT-2017-2389

Name of the Vulnerable Software and Affected Versions OpenBSD versions 6.1 and earlier NetBSD affected versions not specified Description The issue is related to a flaw in the implementation of the stack guard page, which can be bypassed, allowing for arbitrary code execution. This can be achieve...

CVE-2017-1000372: Undefined Security Weakness

A flaw exists in OpenBSD's implementation of the stack guard page that allows attackers to bypass it resulting in arbitrary code execution using setuid binaries such as /usr/bin/at. This affects OpenBSD 6.1 and possibly earlier versions...

CVE-2017-5631: Improper Neutralization of Input During Web Page Generation

An issue was discovered in KMCIS CaseAware. Reflected cross site scripting is present in the user parameter i.e., "usr" that is transmitted in the login.php query string...

PT-2017-16631

Name of the Vulnerable Software and Affected Versions KMCIS CaseAware affected versions not specified Description An issue was discovered in KMCIS CaseAware, where reflected cross-site scripting is present in the usr parameter transmitted in the "login.php" query string. Recommendations At the...

CVE-2017-5671

Honeywell Intermec PM23, PM42, PM43, PC23, PC43, PD43, and PC42 industrial printers before 10.11.013310 and 10.12.x before 10.12.013309 have /usr/bin/lua installed setuid to the itadmin account, which allows local users to conduct a BusyBox jailbreak attack and obtain root privileges by overwriti...

CVE-2017-5671

CVE-2017-5671 affects Honeywell Intermec PM23/PM42/PM43/PC23/PC43/PD43/PC42 printers (firmware before 10.11.013310 and 10.12.x before 10.12.013309). The vulnerability arises because /usr/bin/lua is installed setuid to the itadmin account, enabling local users to perform a BusyBox jailbreak and es...

PT-2017-16661

Name of the Vulnerable Software and Affected Versions Honeywell Intermec PM23, PM42, PM43, PC23, PC43, PD43, and PC42 industrial printers versions prior to 10.11.013310 Honeywell Intermec PM23, PM42, PM43, PC23, PC43, PD43, and PC42 industrial printers versions 10.12.x prior to 10.12.013309...

CVE-2017-5198: Undefined Security Weakness

SolarWinds LEM aka SIEM before 6.3.1 has an incorrect sudo configuration, which allows local users to obtain root access by editing /usr/local/contego/scripts/hostname.sh...

PT-2017-16383

Name of the Vulnerable Software and Affected Versions SolarWinds LEM aka SIEM versions prior to 6.3.1 Description The issue is related to an incorrect sudo configuration, allowing local users to gain root access. This can be achieved by editing the /usr/local/contego/scripts/hostname.sh script...

PT-2016-5309

Name of the Vulnerable Software and Affected Versions IBM Spectrum Scale versions 4.1.1.x through 4.1.1.7 IBM Spectrum Scale versions 4.2.x through 4.2.0.3 General Parallel File System GPFS versions 3.5.x through 3.5.0.31 General Parallel File System GPFS versions 4.1.x through 4.1.1.7 Descriptio...

PT-2016-5310

Name of the Vulnerable Software and Affected Versions IBM Spectrum Scale versions 4.1.1.x through 4.1.1.7 IBM Spectrum Scale versions 4.2.x through 4.2.0.3 General Parallel File System GPFS versions 3.5.x through 3.5.0.31 General Parallel File System GPFS versions 4.1.x through 4.1.1.7 Descriptio...