Privilege escalation

upsMonitor in ViewPower aka ViewPowerHTML 1.04-21012 through 1.04-21353 has insecure permissions for the service binary that enable an Authenticated User to modify files, allowing for privilege escalation...

CVE-2021-30490

upsMonitor in ViewPower aka ViewPowerHTML 1.04-21012 through 1.04-21353 has insecure permissions for the service binary that enable an Authenticated User to modify files, allowing for privilege escalation...

PT-2022-10017 · Viewpower · Upsmonitor

Name of the Vulnerable Software and Affected Versions: upsMonitor in ViewPower aka ViewPowerHTML versions 1.04-21012 through 1.04-21353 Description: The issue is related to insecure permissions for the service binary, allowing an authenticated user to modify files and enabling privilege escalatio...

PT-2022-4991 · Planex · Planex Mzk-Dp150N

Name of the Vulnerable Software and Affected Versions: Planex MZK-DP150N versions 1.42 through 1.43 Description: The issue is related to insecure permissions in the administration interface, allowing attackers to execute system commands as root via the etc ro/web/syscmd.asp file. This can be...

Builder XtremeRAT 3.7 MVID-2022-0623 Insecure Permissions

Discovery / credits: Malvuln John Page aka hyp3rlinx c 2022 Original source: https://malvuln.com/advisory/7f314e798c150aedd9ce41ed39318f65.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Builder XtremeRAT v3.7 Vulnerability: Insecure Permissions Description: The malware builds...

kotlin: vulnerable Java API was used for temporary file and folder creation which could result in information disclosure

In JetBrains Kotlin before 1.4.21, a vulnerable Java API was used for temporary file and folder creation. An attacker was able to read data from such files and list directories due to insecure permissions...

CVE-2022-30929

Mini-Tmall v1.0 is vulnerable to Insecure Permissions via tomcat-embed-jasper...

CVE-2022-30929

Mini-Tmall v1.0 is vulnerable to Insecure Permissions via tomcat-embed-jasper...

Design/Logic Flaw

Mini-Tmall v1.0 is vulnerable to Insecure Permissions via tomcat-embed-jasper...

CVE-2022-30929

Mini-Tmall v1.0 is vulnerable to Insecure Permissions via tomcat-embed-jasper...

CVE-2022-30929

CVE-2022-30929 affects Mini-Tmall v1.0 and is described as vulnerable to insecure permissions via the Tomcat Jasper embedding component (tomcat-embed-jasper). Several connected sources reiterate an insecure privilege/permission issue, including Red Hat and CNNVD entries, which label it as an inse...

Fortinet FortiManager和FortiAnalyzer 操作系统命令注入漏洞

Fortinet FortiManager and Fortinet FortiAnalyzer are both products from Fortinet, Inc. Fortinet FortiManager is a centralized network security management platform. The platform supports centralized management of any number of Fortinet devices, and can be grouped into different management domains...

PT-2022-6521 · Nomachine · Nomachine

Name of the Vulnerable Software and Affected Versions: NoMachine version 7.9.2 Description: The issue is related to incorrect permissions for the folder C:ProgramDataNoMachinevaruninstall of NoMachine, which allows attackers to perform a DLL hijacking attack and execute arbitrary code. This is du...

Backdoor.Win32.Shark.btu MVID-2022-0615 Insecure Permissions

Discovery / credits: Malvuln John Page aka hyp3rlinx c 2022 Original source: https://malvuln.com/advisory/5a83f8b8c8a8b7a85b3ff632aa60e793.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Backdoor.Win32.Shark.btu Vulnerability: Insecure Permissions Description: The malware writ...

Yashma Ransomware Builder 1.2 MVID-2022-0613 Insecure Permissions

Discovery / credits: Malvuln John Page aka hyp3rlinx c 2022 Original source: https://malvuln.com/advisory/13e878ed7e547523cffc5728f6ba4190.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Yashma Ransomware Builder v1.2 Vulnerability: Insecure Permissions Description: The malwar...

CVE-2022-34012

Insecure permissions in OneBlog v2.3.4 allows low-level administrators to reset the passwords of high-level administrators who hold greater privileges...

CVE-2022-34012

Insecure permissions in OneBlog v2.3.4 allows low-level administrators to reset the passwords of high-level administrators who hold greater privileges...

CVE-2022-34012

Insecure permissions in OneBlog v2.3.4 allows low-level administrators to reset the passwords of high-level administrators who hold greater privileges...

Design/Logic Flaw

Insecure permissions in OneBlog v2.3.4 allows low-level administrators to reset the passwords of high-level administrators who hold greater privileges...

CVE-2022-34012

CVE-2022-34012 affects OneBlog v2.3.4. The issue is insecure permissions that let low-privilege administrators reset passwords of higher-privilege admins, implying a privilege-override flaw in authorization controls. The root cause is improper privilege checks within OneBlog’s admin flows. Docume...