polkit: Local privilege escalation in pkexec due to incorrect handling of argument vector

A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters coun...

polkit: Local privilege escalation in pkexec due to incorrect handling of argument vector

A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters coun...

polkit: Local privilege escalation in pkexec due to incorrect handling of argument vector

A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters coun...

polkit: Local privilege escalation in pkexec due to incorrect handling of argument vector

A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters coun...

polkit: Local privilege escalation in pkexec due to incorrect handling of argument vector

A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters coun...

polkit: Local privilege escalation in pkexec due to incorrect handling of argument vector

A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters coun...

The vulnerability of the web interface of the Cisco Modeling Labs network modeling tool allows a perpetrator to execute arbitrary commands.

The vulnerability of the Cisco Modeling Labs network modeling tool’s web interface is related to the implementation or modification of arguments. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...

The vulnerability of the data collection and aggregation application from Cisco DNA Spaces Connector’s controllers and access points relates to the implementation or modification of arguments, allowing attackers to execute arbitrary commands with root privileges.

The vulnerability of the data collection and aggregation application from Cisco DNA Spaces Connector lies in the implementation or modification of arguments. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands with root privileges...

Command Injection

Overview Affected versions of this package are vulnerable to Command Injection. The vulnerability arises out of improper neutralization of arguments in line 71 of freediskspace.js. Remediation There is no fixed version for freediskspace. Credit: John Hopkins Security Labs...

The vulnerability of the command-line interface (CLI) of the programmatically defined Cisco SD-WAN network allows a attacker to enhance their privileges and execute arbitrary code.

The vulnerability of the command-line interface CLI of Cisco SD-WAN software-defined networks is related to the implementation or modification of arguments. Exploiting this vulnerability can allow an attacker to enhance their privileges and execute arbitrary code...

PT-2019-7484 · Pippin Williamson · Easy Digital Downloads

Name of the Vulnerable Software and Affected Versions: Easy Digital Downloads EDD versions 1.8.x through 1.8.6 Easy Digital Downloads EDD versions 1.9.x through 1.9.9 Easy Digital Downloads EDD versions 2.0.x through 2.0.4 Easy Digital Downloads EDD versions 2.1.x through 2.1.10 Easy Digital...

OPENSUSE-SU-2019:1277-1 Security update for kauth

This update for kauth fixes the following issues: Security issue fixed: - CVE-2019-7443: Fixed an insecure handling of arguments in helpers by removing the support of passing gui variants bsc1124863. This update was imported from the openSUSE:Leap:15.0:Update update project...

OPENSUSE-SU-2019:1051-1 Security update for kauth

This update for kauth fixes the following issues: Security issue fixed: - CVE-2019-7443: Fixed an insecure handling of arguments in helpers by removing the support of passing gui variants bsc1124863. This update was imported from the openSUSE:Leap:15.0:Update update project...

The vulnerability of the command-line interface of the Cisco Nexus Operating System allows a hacker to execute any command they desire.

The vulnerability of the command-line interface of the Cisco Nexus Operating System is related to insufficient checking of arguments passed in commands. Exploiting this vulnerability allows a local attacker to execute arbitrary commands...

OPENSUSE-SU-2019:0247-1 Security update for kauth

This update for kauth fixes the following issues: Security issue fixed: - CVE-2019-7443: Fixed an insecure handling of arguments in helpers by removing the support of passing gui variants bsc1124863. This update was imported from the openSUSE:Leap:15.0:Update update project...

Denial Of Service (DoS)

node-static is vulnerable to denial of service DoS. The attack exists because it does not properly handle the argument 'path', allowing the attacker to input the path \u0000 NULL to crash fs.stat with the error message "TypeError ERRINVALIDARGVALUE: The argument 'path' must be a string or...

Adobe Acrobat Pro DC Onix ReadBTreeT::FindKeyInInteriorPage Out-Of-Bounds Read Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Adobe Acrobat Pro DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

[slackware-security] ghostscript

New ghostscript packages are available for Slackware 14.2 and -current to fix security issues. Here are the details from the Slackware 14.2 ChangeLog: patches/packages/ghostscript-9.25-i586-1slack14.2.txz: Upgraded. This release fixes problems with argument handling, some unintended results of th...

DEBIAN-CVE-2018-13300

In FFmpeg 3.2 and 4.0.1, an improper argument AVCodecParameters passed to the avprivrequestsample function in the handleeac3 function in libavformat/movenc.c may trigger an out-of-array read while converting a crafted AVI file to MPEG4, leading to a denial of service and possibly an information...

Adobe Acrobat Pro DC PutItemValue Type Confusion Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on vulnerable installations of Adobe Acrobat Pro DC. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...