CVE-2024-7402

CVE-2024-7402 concerns Netskope Client where a malicious insider with administrative privileges can tamper the client configuration via a local MITM on the client-channel. Impact per available data includes temporary or permanent configuration changes and possible removal of the agent, with CVSS ...

PT-2025-33116 · Netskope · Netskope Client

Name of the Vulnerable Software and Affected Versions: Netskope Client affected versions not specified Description: A malicious insider with administrative privileges can potentially tamper with the Netskope Client configuration by performing a Man-in-the-Middle MITM attack on the Netskope Client...

Tenable Agent Elevation of Privilege Vulnerability

Tenable Agent is a vulnerability scanning program from Tenable USA. Tenable Agent has an elevation of privilege vulnerability, which originates from a non-administrative user deleting arbitrary local system files with SYSTEM privileges, and can be exploited by an attacker to tamper with the syste...

SICK Field Analytics和SICK Media Server 数据伪造问题漏洞

SICK Field Analytics and SICK Media Server are both products of SICK GmbH, Germany.SICK Field Analytics is software for evaluating manufacturing data.SICK Media Server is a media server. A security vulnerability exists in SICK Field Analytics and SICK Media Server that stems from an unsigned back...

CVE-2022-32259

A vulnerability has been identified in SINEMA Remote Connect Server All versions V3.1. The system images for installation or update of the affected application contain unit test scripts with sensitive information. An attacker could gain information about testing architecture and also tamper with...

CVE-2021-42954

Zoho Remote Access Plus Server Windows Desktop Binary fixed from 10.1.2121.1 is affected by incorrect access control. The installation directory is vulnerable to weak file permissions by allowing full control for Windows Everyone user group non-admin or any guest users, thereby allowing privilege...

CVE-2020-10263

An issue was discovered on XIAOMI XIAOAI speaker Pro LX06 1.52.4. Attackers can get root shell by accessing the UART interface and then they can i read Wi-Fi SSID or password, ii read the dialogue text files between users and XIAOMI XIAOAI speaker Pro LX06, iii use Text-To-Speech tools pretend...

CVE-2020-2311

A missing permission check in Jenkins AWS Global Configuration Plugin 1.5 and earlier allows attackers with Overall/Read permission to replace the global AWS configuration...

ABB Cylon Aspect 3.08.02 (ethernetUpdate.php) - Authenticated Path Traversal

Exploit Title: ABB Cylon Aspect 3.08.02 ethernetUpdate.php - Authenticated Path Traversal Vendor: ABB Ltd. Product web page: https://www.global.abb Affected version: NEXUS Series, MATRIX-2 Series, ASPECT-Enterprise, ASPECT-Studio Firmware: =3.08.02 Summary: ASPECT is an award-winning scalable...

PT-2025-71: Control structure rewriting or heap-based buffer overflow during HTTP POST-content parsing in LCD KVM over IP switch CL5708IM

The vulnerability was identified in LCD KVM over IP switch CL5708IM firmware version v2.2.215. The discovered vulnerability allows an attacker to alter the device configuration or cause a denial‑of‑service. During HTTP POST content parsing, either control‑structure overwrite or a heap‑based buffe...

ABB Cylon Aspect 3.08.02 (ethernetUpdate.php) Authenticated Path Traversal

Summary ASPECT is an award-winning scalable building energy management and control solution designed to allow users seamless access to their building data through standard building protocols including smart devices. Description The ABB Cylon controller suffers from an authenticated path traversal...

CVE-2024-0012

An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to gain PAN-OS administrator privileges to perform administrative actions, tamper with the configuration, or exploit other authenticated privilege...

CVE-2024-0012 PAN-OS: Authentication Bypass in the Management Web Interface (PAN-SA-2024-0015)

An authentication bypass in Palo Alto Networks PAN-OS software enables an unauthenticated attacker with network access to the management web interface to gain PAN-OS administrator privileges to perform administrative actions, tamper with the configuration, or exploit other authenticated privilege...

The vulnerability of Siemens SINEC Security Monitor’s security software lies in its improper validation of user-input data against a list of allowed values. This allows a perpetrator to compromise the integrity of the affected application configuration.

The vulnerability of Siemens SINEC Security Monitor software-related security protection lies in improper verification of the data entered by users against a list of allowed values. Exploiting this vulnerability could allow a malicious actor, operating remotely, to compromise the integrity of the...

Improper Authorization

github.com/pomerium/pomerium is vulnerable to Improper Authorization. The vulnerability is due to incomplete validation of JSON Web Tokens JWT, allowing certain service account access tokens to be incorrectly treated as valid for databroker API authorization, potentially leading to data...

PT-2024-8243

Name of the Vulnerable Software and Affected Versions Palo Alto Networks PAN-OS versions prior to 10.2.12 Palo Alto Networks PAN-OS versions prior to 11.0.6 Palo Alto Networks PAN-OS versions prior to 11.1.5 Palo Alto Networks PAN-OS versions prior to 11.2.4 Description An authentication bypass i...

CVE-2024-31415

The Eaton Foreseer software provides the feasibility for the user to configure external servers for multiple purposes such as network management, user management, etc. The software uses encryption to store these configurations securely on the host machine. However, the keys used for this encrypti...

unbound: unrestricted reconfiguration enabled to anyone that may lead to local privilege escalation

A vulnerability was found in Unbound due to incorrect default permissions, allowing any process outside the unbound group to modify the unbound runtime configuration. If a process can connect over localhost to port 8953, it can alter the configuration of unbound.service. This flaw allows an...

CVE-2023-28797

Zscaler Client Connector for Windows before 4.1 writes/deletes a configuration file inside specific folders on the disk. A malicious user can replace the folder and execute code as a privileged user...

CVE-2023-3899

A vulnerability was found in subscription-manager that allows local privilege escalation due to inadequate authorization. The D-Bus interface com.redhat.RHSM1 exposes a significant number of methods to all users that could change the state of the registration. By using the...