4070 matches found
CVE-2022-36438
AsusSwitch.exe on ASUS personal computers running Windows sets weak file permissions, leading to local privilege escalation this also can be used to delete files within the system arbitrarily. This affects ASUS System Control Interface 3 before 3.1.5.0, and AsusSwitch.exe before 1.0.10.0...
Amazon Linux 2022 : curl, curl-minimal, libcurl (ALAS2022-2022-145)
It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2022-2022-145 advisory. A vulnerability was found in curl. This issue occurs because a malicious server can serve excessive amounts of Set-Cookie: headers in an HTTP response to curl, which stores all of them. This fl...
CVE-2022-33922
Dell GeoDrive, versions prior to 2.2, contains Insecure File and Folder Permissions vulnerabilities. A low privilege attacker could potentially exploit this vulnerability, leading to the execution of arbitrary code in the SYSTEM security context. Dell recommends customers to upgrade at the earlie...
CVE-2022-33922
Dell GeoDrive, versions prior to 2.2, contains Insecure File and Folder Permissions vulnerabilities. A low privilege attacker could potentially exploit this vulnerability, leading to the execution of arbitrary code in the SYSTEM security context. Dell recommends customers to upgrade at the earlie...
CVE-2022-33922
Dell GeoDrive, versions prior to 2.2, contains Insecure File and Folder Permissions vulnerabilities. A low privilege attacker could potentially exploit this vulnerability, leading to the execution of arbitrary code in the SYSTEM security context. Dell recommends customers to upgrade at the earlie...
PT-2022-21911 · Dell · Dell Geodrive
Name of the Vulnerable Software and Affected Versions: Dell GeoDrive versions prior to 2.2 Description: The issue is related to Insecure File and Folder Permissions, which could be exploited by a low privilege attacker to execute arbitrary code in the SYSTEM security context. Recommendations: For...
CVE-2022-20864 Cisco IOS XE ROM Monitor Software for Catalyst Switches Information Disclosure Vulnerability
A vulnerability in the password-recovery disable feature of Cisco IOS XE ROM Monitor ROMMON Software for Cisco Catalyst Switches could allow an unauthenticated, local attacker to recover the configuration or reset the enable password. This vulnerability is due to a problem with the file and boot...
MyBB < 1.8.31 RCE Vulnerability (GHSA-hxhm-rq9f-7xj7)
MyBB is prone to a remote code execution RCE vulnerability. SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mybb:mybb";...
CVE-2020-15332
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has weak /opt/axess/etc/default/axess permissions...
CVE-2020-15329
Zyxel CloudCNM SecuManager 3.1.0 and 3.1.1 has weak Data.fs permissions...
GO-2022-1008 Unauthorized file access in github.com/containers/buildah
SGID programs executed in a container can access files that have negative group permissions for the user's primary group. Consider a file which is owned by user u1 and group g1, permits user and other read access, and does NOT permit group read access. This file is readable by u1 and all other...
CVE-2022-38466
A vulnerability has been identified in CoreShield One-Way Gateway OWG Software All versions V2.2. The default installation sets insecure file permissions that could allow a local attacker to escalate privileges to local administrator...
CVE-2022-38466
A vulnerability has been identified in CoreShield One-Way Gateway OWG Software All versions V2.2. The default installation sets insecure file permissions that could allow a local attacker to escalate privileges to local administrator...
CVE-2022-38466
A vulnerability has been identified in CoreShield One-Way Gateway OWG Software All versions V2.2. The default installation sets insecure file permissions that could allow a local attacker to escalate privileges to local administrator...
CVE-2022-38466: Improper Access Control
A vulnerability has been identified in CoreShield One-Way Gateway OWG Software All versions V2.2. The default installation sets insecure file permissions that could allow a local attacker to escalate privileges to local administrator...
Siemens Mobility CoreShield OWG Software
1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Low attack complexity Vendor: Siemens Mobility Equipment: CoreShield One-Way Gateway OWG Software Vulnerability: Improper Access Control 2. RISK EVALUATION Successful exploitation of this vulnerability could allow an attacker to leverage the default...
CVE-2022-36088 GoCD Windows installations outside default location inadequately restrict installation file permissions
GoCD is a continuous delivery server. Windows installations via either the server or agent installers for GoCD prior to 22.2.0 do not adequately restrict permissions when installing outside of the default location. This could allow a malicious user with local access to the server GoCD Server or...
pcs: obtaining an authentication token for hacluster user could lead to privilege escalation
A vulnerability was found in the PCS project. This issue occurs due to incorrect permissions on a Unix socket used for internal communication between PCS daemons. A privilege escalation could happen by obtaining an authentication token for a hacluster user. With the "hacluster" token, this flaw...
Oracle Linux 9 : curl (ELSA-2022-6157)
The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2022-6157 advisory. - fix unpreserved file permissions CVE-2022-32207 - fix HTTP compression denial of service CVE-2022-32206 Tenable has extracted the preceding descripti...
