31 matches found
CVE-2021-25253
root@kitploit: Exploit Title: Trend Micro OfficeScan Client 10.0 - ACL Service LPE Date: 2023/05/04 Exploit Author: msd0pe Vendor Homepage: https://www.trendmicro.com My Github: https://github.com/msd0pe-1 Trend Micro OfficeScan クライアント: バージョン = icacls "C:\Program Files x86\Trend Micro\OfficeScan...
KINGSOFT-WPS-Office-LPE
JVN アドバイザリ https://jvn.jp/en/vu/JVNVU90673830/ 以下のCVE番号が割り当てられています: CVE-2022-25943 KINGSOFT WPS Office LPE WPS Office は、珠海に本拠を置く中国のソフトウェア開発会社キングソフトが開発した、Microsoft Windows、macOS、Linux、iOS、Android、HarmonyOS向けのオフィススイートです。 WPSの調査...
CVE-2021-36934
CVE-2021-36934 CVE-2021-36934 PowerShell 수정 이 PowerShell 스크립트는 CVE-2021-36934를 수정합니다. Joran Slingerland의 원본 스크립트를 기반으로 합니다 https://github.com/JoranSlingerland https://github.com/JoranSlingerland/CVE-2021-36934/blob/main/CVE-2021-36934.ps1 PowerShell 스크립트는 다음을 수행합니다: $env:windir\Logs\ 아래에...
CVE-2020-10551
CVEID : CVE-2020-10551 受影响的产品及版本 : QQBrowser（10.5.3870.400 之前的全部版本） 问题类型 : CWE-284: 不恰当的访问控制 概述 QQ浏览器是腾讯开发的一款网页浏览器，也是中国最常用的网页浏览器之一。在测试过程中，我们发现了一个漏洞，该漏洞允许非特权本地攻击者以 NT AUTHORITY\SYSTEM 身份执行代码。 QQ浏览器 10.5.3870.400 之前的所有版本均未正确为 TsService.exe 文件设置 ACL。恶意本地攻击者可能覆盖该文件，从而获得对 NT AUTHORITY\SYSTEM...
EUVD-2026-72322
Affected versions of MISP allow any authenticated user to access TemplatesController::uploadFile because the ACL entry for templates/uploadFile used the wildcard . This bypasses the intended role restrictions applied to neighboring template-management operations. The upload handler accepts...
CVE-2026-52766
YesWiki (PHP-based wiki system) is vulnerable to unauthenticated arbitrary page deletion prior to version 4.6.6 . The {{erasespamedcomments}} action (actions/EraseSpamedCommentsAction.php) processes a suppr[] array from POST and deletes pages whose tags match, with no authorization check in the a...
CVE-2026-72840
OpenWrt LuCI contains an overly permissive ACL definition in luci-mod-system-mounts that grants write access to /etc/crontabs/root to users intended only for mount configuration. Authenticated users with only the mount-configuration ACL group can append arbitrary cron entries via ubus file.write,...
Microsoft Security Advisory CVE-2026-62909 – .NET Elevation of Privilege Vulnerability
Executive summary Microsoft is releasing this security advisory to provide information about a vulnerability in .NET diagnostics IPC. This advisory also provides guidance on what developers can do to update their applications to remove this vulnerability. A missing error check in .NET causes an...
CVE-2026-41115
A flaw was found in Apache Kafka. An improper authorization vulnerability exists in the CONSUMERGROUPDESCRIBE API, where it incorrectly validates the DESCRIBE operation instead of the READ operation on the GROUP resource. This discrepancy can lead to misconfigured Access Control Lists ACLs,...
CVE-2026-41115
An improper authorization vulnerability has been identified in Apache Kafka. The implementation of the CONSUMERGROUPDESCRIBE 69 API validates the DESCRIBE operation on the GROUP resource instead of the READ operation that documented in the official kafka documentation and the KIP-848. This...
CVE-2026-41115 Apache Kafka: Improper Authorization in CONSUMER_GROUP_DESCRIBE API
An improper authorization vulnerability has been identified in Apache Kafka. The implementation of the CONSUMERGROUPDESCRIBE 69 API validates the DESCRIBE operation on the GROUP resource instead of the READ operation that documented in the official kafka documentation and the KIP-848. This...
CVE-2026-41115
Summary: CVE-2026-41115 describes an improper authorization issue in Apache Kafka related to the CONSUMER_GROUP_DESCRIBE API. The vulnerability discussion notes a discrepancy between ACLs and documented permissions, but states that the correct permission for the API is DESCRIBE GROUP and that the...
WordPress plugin Woocommerce Envato Affiliates 安全漏洞
WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. There is...
Linux Distros Unpatched Vulnerability : CVE-2026-24413
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Icinga 2 is an open source monitoring system. Starting in version 2.3.0 and prior to versions 2.13.14, 2.14.8, and 2.15.2, the Icinga 2 MSI did not set...
MiracleLinux 7 : pki-core-10.5.1-13.1.el7 (AXSA:2018-3231:02)
The remote MiracleLinux 7 host has packages installed that are affected by a vulnerability as referenced in the AXSA:2018-3231:02 advisory. pki-core: Mishandled ACL configuration in AAclAuthz.java reverses rules that allow and deny access CVE-2018-1080 Tenable has extracted the preceding...
PT-2025-43771
Missing Authorization vulnerability in sunshinephotocart Sunshine Photo Cart sunshine-photo-cart allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Sunshine Photo Cart: from n/a through = 3.5.3...
EUVD-2019-4673
Malware in sbrugna...
EUVD-2020-2603
Malware in sbrugna...