CVE-2008-5703

gpsdrive aka gpsdrive-scripts 2.10pre4 allows local users to overwrite arbitrary files via a symlink attack on the a /tmp/.smswatch or b /tmp/gpsdrivepos temporary file, related to 1 examples/gpssmswatch and 2 src/splash.c, different vectors than CVE-2008-4959 and CVE-2008-5380...

CVE-2005-4791

Multiple untrusted search path vulnerabilities in SUSE Linux 10.0 cause the working directory to be added to LDLIBRARYPATH, which might allow local users to execute arbitrary code via 1 liferea or 2 banshee...

CVE-2008-4863

Untrusted search path vulnerability in BPYinterface in Blender 2.46 allows local users to execute arbitrary code via a Trojan horse Python file in the current working directory, related to an erroneous setting of sys.path by the PySysSetArgv function...

CVE-2008-2359

The default configuration of consolehelper in system-config-network before 1.5.10-1 on Fedora 8 lacks the USER=root directive, which allows local users of the workstation console to gain privileges and change the network configuration...

Information Disclosure

github.com/astaxie/beego is vulnerable to information disclosure. Local users are able to access and read session files due to excessive permissions 0777 configured on the files upon creation...

CVE-2019-16355

The File Session Manager in Beego 1.10.0 allows local users to read session files because of weak permissions for individual files...

CVE-2019-16354

The File Session Manager in Beego 1.10.0 allows local users to read session files because there is a race condition involving file creation within a directory with weak permissions...

Session fixation

The File Session Manager in Beego 1.10.0 allows local users to read session files because of weak permissions for individual files...

CVE-2019-16355

The CVE-2019-16355 entry concerns Beego’s File Session Manager in Beego 1.10.0, where local attackers can read session files due to weak per-file permissions. Multiple connected sources (Red Hat, OSV entries) reiterate that Beego’s File Session Manager permits information disclosure via improper ...

CVE-2019-16355

The File Session Manager in Beego 1.10.0 allows local users to read session files because of weak permissions for individual files...

CVE-2019-16354

The File Session Manager in Beego 1.10.0 allows local users to read session files because there is a race condition involving file creation within a directory with weak permissions...

CVE-2019-11773

Prior to 0.1, AIX builds of Eclipse OMR contain unused RPATHs which may facilitate code injection and privilege elevation by local users...

CVE-2019-11773

Prior to 0.1, AIX builds of Eclipse OMR contain unused RPATHs which may facilitate code injection and privilege elevation by local users...

CVE-2019-11773

CVE-2019-11773 affects AIX builds of Eclipse OMR prior to 0.1, where unused RPATHs may allow local code injection and privilege elevation. Root cause: unused RPATHs in the build. Impact: potential escalation by local users. Exploit details, affected versions beyond the stated range, and concrete ...

CVE-2019-11773

Prior to 0.1, AIX builds of Eclipse OMR contain unused RPATHs which may facilitate code injection and privilege elevation by local users. Recent assessments: timb-machine at March 05, 2021 12:22am UTC reported: Unlikely to be setUID, unlikely that you will have write control over the vulnerable...

CVE-2019-15752

Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-credential-wincred.exe file in %PROGRAMDATA%\DockerDesktop\version-bin\ as a low-privilege user, and then waiting for an admin or service user to authenticate with Docker, restar...

CVE-2019-15752

Docker Desktop Community Edition before 2.1.0.1 allows local users to gain privileges by placing a Trojan horse docker-credential-wincred.exe file in %PROGRAMDATA%\DockerDesktop\version-bin\ as a low-privilege user, and then waiting for an admin or service user to authenticate with Docker, restar...

hardware: Microarchitectural Data Sampling Uncacheable Memory (MDSUM)

Uncacheable memory on some microprocessors utilizing speculative execution may allow an authenticated user to potentially enable information disclosure via a side channel with local access...

CVE-2019-15315

Valve Steam Client for Windows through 2019-08-16 allows privilege escalation to NT AUTHORITY\SYSTEM because local users can replace the current versions of SteamService.exe and SteamService.dll with older versions that lack the CVE-2019-14743 patch...

Oracle Linux 8 : kernel (ELSA-2019-2411)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2019-2411 advisory. - x86 x86/entry/64: Use JMP instead of JMPQ Josh Poimboeuf 1724500 1724501 CVE-2019-1125 - x86 x86/speculation: Enable Spectre v1 swapgs mitigations Jo...