pmix: race condition allows attackers to obtain ownership of arbitrary files

OpenPMIx PMIx is vulnerable to a race condition during execution of library code with UID 0, which allows attackers to obtain ownership of arbitrary files...

PT-2024-11945 · Cisco · Cisco Firepower Management Center

Name of the Vulnerable Software and Affected Versions: Cisco Firepower Management Center FMC Software affected versions not specified Description: A vulnerability in the web-based management interface of Cisco Firepower Management Center FMC Software could allow an authenticated, remote attacker ...

TOTOLINK EX200 Hardcoded Password Vulnerability

The TOTOLINK EX200 is a 2.4G wireless range extender from China's TOTOLINK. It is designed to extend the coverage of existing Wi-Fi networks and eliminate "blind spots". The TOTOLINK EX200 suffers from a hard-coded password vulnerability that originates from the /etc/shadow.sample file, which can...

Exploit for Classic Buffer Overflow in Qnap Qts

!Profile Visitorshttps://komarev.com/ghpvc/?username=d0rb&la...

ZkTeco OEM 路径遍历漏洞

ZkTeco OEM is an intelligent system from the Chinese company ZkTeco. A path traversal vulnerability exists in ZkTeco OEM that originates from allowing an attacker to write to any file on the system with root privileges. The following products and versions are affected: ZkTeco ProFace X, Smartec...

CVE-2024-35187

Stalwart Mail Server is an open-source mail server. Prior to version 0.8.0, attackers who achieved Arbitrary Code Execution as the stalwart-mail user including web interface admins can gain complete root access to the system. Usually, system services are run as a separate user not as root to...

CVE-2024-35187 Stalwart Mail Server has privilege escalation by design

Stalwart Mail Server is an open-source mail server. Prior to version 0.8.0, attackers who achieved Arbitrary Code Execution as the stalwart-mail user including web interface admins can gain complete root access to the system. Usually, system services are run as a separate user not as root to...

CVE-2024-35187

CVE-2024-35187 affects Stalwart Mail Server prior to version 0.8.0. Attacks achieving Arbitrary Code Execution as the stalwart-mail user (including web interface admins) can obtain complete root privileges, effectively breaking the intended service isolation. The issue is mitigated by upgrading t...

CVE-2024-35187 Stalwart Mail Server has privilege escalation by design

Stalwart Mail Server is an open-source mail server. Prior to version 0.8.0, attackers who achieved Arbitrary Code Execution as the stalwart-mail user including web interface admins can gain complete root access to the system. Usually, system services are run as a separate user not as root to...

CVE-2024-20326

A vulnerability in the ConfD CLI and the Cisco Crosswork Network Services Orchestrator CLI could allow an authenticated, low-privileged, local attacker to read and write arbitrary files as root on the underlying operating system. This vulnerability is due to improper authorization enforcement whe...

CVE-2024-20389

CVE-2024-20389 affects the ConfD CLI and Cisco Crosswork NSO CLI. The issue stems from improper authorization enforcement when specific CLI commands are used, allowing an authenticated, low-privileged, local attacker to read and write arbitrary files as root on the underlying OS. Exploitation is ...

CVE-2024-20389

A vulnerability in the ConfD CLI and the Cisco Crosswork Network Services Orchestrator CLI could allow an authenticated, low-privileged, local attacker to read and write arbitrary files as root on the underlying operating system. This vulnerability is due to improper authorization enforcement whe...

CVE-2024-20326

A vulnerability in the ConfD CLI and the Cisco Crosswork Network Services Orchestrator CLI could allow an authenticated, low-privileged, local attacker to read and write arbitrary files as root on the underlying operating system. This vulnerability is due to improper authorization enforcement whe...

Cisco Crosswork Network Services Orchestrator 安全漏洞

Cisco Crosswork Network Services Orchestrator is a network automation and orchestration platform from Cisco. A security vulnerability exists in the Cisco Crosswork Network Services Orchestrator CLI, ConfD CLI, which arises from improper execution of authorization when using certain CLI commands a...

Siemens SIMATIC CN 4100 Hard-Coded Password Vulnerability

The Siemens SIMATIC CN 4100 is a communication node from Siemens, Germany. A hard-coded password vulnerability exists in the Siemens SIMATIC CN 4100, which can be exploited by an attacker to gain root access to the device...

PT-2024-26367 · Unknown · Stalwart Mail Server

Name of the Vulnerable Software and Affected Versions: Stalwart Mail Server versions prior to 0.8.0 Description: The issue affects Stalwart Mail Server, an open-source mail server, where attackers who achieved Arbitrary Code Execution as the stalwart-mail user, including web interface admins, can...

Stalwart Mail Server 安全漏洞

Stalwart Mail Server is an all-in-one mail server from Stalwart Labs. A security vulnerability exists in Stalwart Mail Server versions prior to 0.8.0 that originates from a vulnerability that allows an attacker to gain full root access to the system...

CVE-2024-35187: Incorrect Authorization

Stalwart Mail Server is an open-source mail server. Prior to version 0.8.0, attackers who achieved Arbitrary Code Execution as the stalwart-mail user including web interface admins can gain complete root access to the system. Usually, system services are run as a separate user not as root to...

CVE-2024-20366

A vulnerability in the Tail-f High Availability Cluster Communications HCC function pack of Cisco Crosswork Network Services Orchestrator NSO could allow an authenticated, local attacker to elevate privileges to root on an affected device. This vulnerability exists because a user-controlled searc...

CVE-2024-20366

A vulnerability in the Tail-f High Availability Cluster Communications HCC function pack of Cisco Crosswork Network Services Orchestrator NSO could allow an authenticated, local attacker to elevate privileges to root on an affected device. This vulnerability exists because a user-controlled searc...