CVE-2010-3293

CVE-2010-3293 affects MailScanner. Multiple connected documents describe a local vulnerability that allows a local attacker to prevent virus signature updates, impacting integrity of antivirus definitions. Concrete root cause details (code path, component, affected versions) are not provided in t...

CVE-2010-3293

mailscanner can allow local users to prevent virus signatures from being updated...

IBM Cloud Orchestrator Security Bypass Vulnerability

IBM Cloud Orchestrator is a suite of cloud management solutions from IBM in the United States. The program provides extended internal and external deployment of cloud services and application program interfaces and tools to extend the integration with existing environments and other functions. A...

Amazon Linux 2 : keepalived (ALAS-2019-1323)

keepalived 2.0.8 didn't check for pathnames with symlinks when writing data to a temporary file upon a call to PrintData or PrintStats. This allowed local users to overwrite arbitrary files if fs.protectedsymlinks is set to 0, as demonstrated by a symlink from /tmp/keepalived.data or...

CVE-2019-4398

IBM Cloud Orchestrator and IBM Cloud Orchestrator Enterprise 2.5 through 2.5.0.9 and 2.4 through 2.4.0.5 could allow a local user to obtain sensitive information from SessionManagement cookies. IBM X-Force ID: 162259...

CVE-2019-18192

GNU Guix 1.0.1 allows local users to gain access to an arbitrary user's account because the parent directory of the user-profile directories is world writable, a similar issue to CVE-2019-17365...

CVE-2019-18192

CVE-2019-18192 affects GNU Guix 1.0.1. Local users can gain access to arbitrary user accounts because the parent directory of user-profile directories is world-writable, a condition similar to CVE-2019-17365. Red Hat and CNVD entries corroborate the same underlying issue. The available references...

Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2019-4823)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-4823 advisory. - scsi: sg: fixup infoleak when using SGGETREQUESTTABLE Hannes Reinecke Orabug: 26941755 CVE-2017-14991 Tenable has extracted the preceding...

CVE-2017-15537

The x86/fpu Floating Point Unit subsystem in the Linux kernel, when a processor supports the xsave feature but not the xsaves feature, does not correctly handle attempts to set reserved bits in the xstate header via the ptrace or rtsigreturn system call. This allows local users to read the FPU...

CVE-2018-10905

CloudForms Management Engine has a vulnerability that allows local users to execute arbitrary commands as root. An attacker with SSH access to the system can use the dRuby DRb module installed on the system to execute arbitrary shell commands using instanceeval. Mitigation Administrators of the...

CVE-2019-3805

A flaw was discovered in wildfly that would allow local users, who are able to execute init.d script, to terminate arbitrary processes on the system. An attacker could exploit this by modifying the PID file in /var/run/jboss-eap/ allowing the init.d script to terminate any process as root...

CVE-2019-17365

Summary: CVE-2019-17365 affects Nix up to version 2.3, where local users can gain access to arbitrary user accounts due to the parent directory of user-profile directories being world-writable. This local elevation of privilege is supported by multiple related entries (e.g., Red Hat and NVD recor...

CVE-2019-17365

Nix through 2.3 allows local users to gain access to an arbitrary user's account because the parent directory of the user-profile directories is world writable...

CVE-2019-3653

Improper access control vulnerability in Configuration tool in McAfee Endpoint Security ENS Prior to 10.6.1 October 2019 Update allows local user to gain access to security configuration via unauthorized use of the configuration tool...

CVE-2010-2953

Untrusted search path vulnerability in a certain Debian GNU/Linux patch for the couchdb script in CouchDB 0.8.0 allows local users to gain privileges via a crafted shared library in the current working directory...

CVE-2007-6595

ClamAV 0.92 allows local users to overwrite arbitrary files via a symlink attack on 1 temporary files used by the cligentempfd function in libclamav/others.c or on 2 .ascii files used by sigtool, when utf16-decode is enabled...

CVE-2007-6210

zabbixagentd 1.1.4 in ZABBIX before 1.4.3 runs "UserParameter" scripts with gid 0, which might allow local users to gain privileges...

CVE-2006-1390

The configuration of NetHack 3.4.3-r1 and earlier, Falcon's Eye 1.9.4a and earlier, and Slash'EM 0.0.760 and earlier on Gentoo Linux allows local users in the games group to modify saved games files to execute arbitrary code via buffer overflows and overwrite arbitrary files via symlink attacks...

CVE-2007-5201

The FTP backend for Duplicity before 0.4.9 sends the password as a command line argument when calling ncftp, which might allow local users to read the password by listing the process and its arguments...

CVE-2008-5843

Multiple untrusted search path vulnerabilities in pdfjam allow local users to gain privileges via a Trojan horse program in 1 the current working directory or 2 /var/tmp, related to the a pdf90, b pdfjoin, and c pdfnup scripts...