Command Injection in FSA sniffer module

An instance of improper neutralization of special elements in FortiSandbox's sniffer module may allow an authenticated administrator to execute commands on the underlying system's shell via altering the content of its configuration file...

CVE-2021-3613

CVE-2021-3613 affects OpenVPN Connect for Windows (versions 3.2.0–3.3.0). A local user can load arbitrary dynamic loadable libraries via an OpenSSL configuration file, enabling arbitrary code execution with the same privileges as OpenVPNConnect.exe. Public sources confirm the affected range and i...

CVE-2021-3613

OpenVPN Connect 3.2.0 through 3.3.0 allows local users to load arbitrary dynamic loadable libraries via an OpenSSL configuration file if present, which allows the user to run arbitrary code with the same privilege level as the main OpenVPN process OpenVPNConnect.exe...

CVE-2021-3606

OpenVPN before version 2.5.3 on Windows allows local users to load arbitrary dynamic loadable libraries via an OpenSSL configuration file if present, which allows the user to run arbitrary code with the same privilege level as the main OpenVPN process openvpn.exe...

CVE-2021-3606

OpenVPN CVE-2021-3606 affects OpenVPN for Windows prior to 2.5.3. The vulnerability allows local users to load arbitrary dynamic libraries via an OpenSSL configuration file, enabling code execution with the same privileges as the OpenVPN process (openvpn.exe). Connected advisories confirm remedia...

jenkins-2-plugins/config-file-provider: Does not configure its XML parser to prevent XML external entity (XXE) attacks.

A flaw was found in the config-file-provider Jenkins plugin. The plugin XML parser wasn't configure to prevent XML external entity XXE attacks. An attacker with the ability to define Maven configuration files can use this vulnerability to prepare a crafted configuration file that uses external...

Code injection

An issue exists within the SSH console of Akkadian Provisioning Manager 4.50.02 which allows a low-level privileged user to escape the web configuration file editor and escalate privileges...

The vulnerability of the portal/patient/_machine_config.php component of the software for managing medical organizations OpenEMR allows a intruder to gain unauthorized access to protected information.

The vulnerability of the portal/patient/machineconfig.php component of the software for managing medical organizations OpenEMR is related to insufficient checking of permission assignment for critical resources. Exploiting this vulnerability may allow a malicious actor, operating remotely, to gai...

CVE-2021-33542

Phoenix Contact Classic Automation Worx Software Suite in Version 1.87 and below is affected by a remote code execution vulnerability. Manipulated PC Worx or Config+ projects could lead to a remote code execution when unallocated memory is freed because of incompletely initialized data. The...

CVE-2021-33542

Phoenix Contact Classic Automation Worx Software Suite in Version 1.87 and below is affected by a remote code execution vulnerability. Manipulated PC Worx or Config+ projects could lead to a remote code execution when unallocated memory is freed because of incompletely initialized data. The...

VMware Workstation Tools Uncontrolled Search Path Element Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of VMware Workstation. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the VGAuthService...

jenkins-2-plugins/config-file-provider: Does not perform permission checks in several HTTP endpoints.

A flaw was found in the config-file-provider Jenkins plugin. The plugin does not perform permission checks in several HTTP endpoints, as a consequence an attacker with Overall/Read permission is allowed to enumerate configuration file IDs...

Cisco Webex Meetings DLL Injection (cisco-sa-webex-dll-inject-XNmcSGTU)

According to its self-reported version, Cisco Webex Meetings is affected by an dll injection vulnerability due to incorrect handling of directory paths at run time. An authenticated, local attacker can exploit this, by inserting a configuration file in a specific path in the system, to execute...

Cisco Webex Teams for Windows DLL Injection (cisco-sa-webex-dll-inject-XNmcSGTU)

According to its self-reported version, Cisco Webex Teams for Windows is affected by an dll injection vulnerability due to incorrect handling of directory paths at run time. An authenticated, local attacker can exploit this, by inserting a configuration file in a specific path in the system, to...

Cisco Webex Network Recording Player and Cisco Webex Player DLL Injection (cisco-sa-webex-dll-inject-XNmcSGTU)

According to its self-reported version, Cisco Webex Network Recording Player is affected by an dll injection vulnerability due to incorrect handling of directory paths at run time. An authenticated, local attacker can exploit this, by inserting a configuration file in a specific path in the syste...

CVE-2021-22759

A CWE-416: Use after free vulnerability exists inIGSS Definition Def.exe V15.0.0.21140 and prior that could result in loss of data or remote code execution due to use of unchecked input data, when a malicious CGF file is imported to IGSS Definition...

CVE-2021-22756

A CWE-125: Out-of-bounds read vulnerability exists inIGSS Definition Def.exe V15.0.0.21140 and prior that could result in disclosure of information or remote code execution due to lack of user-supplied data validation, when a malicious CGF file is imported to IGSS Definition...

CVE-2021-22755

A CWE-787: Out-of-bounds write vulnerability exists inIGSS Definition Def.exe V15.0.0.21140 and prior that could result in disclosure of information or remote code execution due to lack of sanity checks on user-supplied data, when a malicious CGF file is imported to IGSS Definition...

CVE-2021-22757

A CWE-125: Out-of-bounds read vulnerability exists inIGSS Definition Def.exe V15.0.0.21140 and prior that could result in disclosure of information or remote code execution due to lack of sanity checks on user-supplied input data, when a malicious CGF file is imported to IGSS Definition...

CVE-2021-22756

A CWE-125: Out-of-bounds read vulnerability exists inIGSS Definition Def.exe V15.0.0.21140 and prior that could result in disclosure of information or remote code execution due to lack of user-supplied data validation, when a malicious CGF file is imported to IGSS Definition...