21896 matches found
CVE-2018-12441
The CorsairService Service in Corsair Utility Engine is installed with insecure default permissions, which allows unprivileged local users to execute arbitrary commands via modification of the CorsairService BINARYPATHNAME, leading to complete control of the affected system. The issue exists due ...
Default configuration
The CorsairService Service in Corsair Utility Engine is installed with insecure default permissions, which allows unprivileged local users to execute arbitrary commands via modification of the CorsairService BINARYPATHNAME, leading to complete control of the affected system. The issue exists due ...
CVE-2018-12441
The CorsairService Service in Corsair Utility Engine is installed with insecure default permissions, which allows unprivileged local users to execute arbitrary commands via modification of the CorsairService BINARYPATHNAME, leading to complete control of the affected system. The issue exists due ...
CVE-2018-12441
The CorsairService in Corsair Utility Engine has insecure default permissions: the Everyone group is granted SERVICE_ALL_ACCESS, enabling unprivileged local users to modify CorsairService BINARY_PATH_NAME and execute arbitrary commands, resulting in complete control of the system. Connected docum...
GHSA-C7J7-P5JQ-26FF Insecure use of temporary files in passenger
Phusion Passenger before 4.0.38 allows local users to write to certain files and directories via a symlink attack on 1. controlprocess.pid or 2. a generation- file...
CVE-2018-17775
Seqrite End Point Security v7.4 has "Everyone: F" permission for %PROGRAMFILES%\Seqrite\Seqrite, which allows local users to gain privileges by replacing an executable file with a Trojan horse...
CVE-2018-17775
Seqrite End Point Security v7.4 has "Everyone: F" permission for %PROGRAMFILES%\Seqrite\Seqrite, which allows local users to gain privileges by replacing an executable file with a Trojan horse...
MagniComp SysInfo Privilege Escalation Vulnerability - Linux
MagniComp SysInfo is prone to a privilege escalation vulnerability. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
DEBIAN-CVE-2015-9267
Nullsoft Scriptable Install System NSIS before 2.49 uses temporary folder locations that allow unprivileged local users to overwrite files. This allows a local attack in which either a plugin or the uninstaller can be replaced by a Trojan horse program...
CVE-2015-9267
Nullsoft Scriptable Install System NSIS before 2.49 uses temporary folder locations that allow unprivileged local users to overwrite files. This allows a local attack in which either a plugin or the uninstaller can be replaced by a Trojan horse program...
CVE-2018-17776
PCProtect Anti-Virus v4.8.35 has "Everyone: F" permission for %PROGRAMFILESX86%\PCProtect, which allows local users to gain privileges by replacing an executable file with a Trojan horse...
CVE-2018-17154
Removed by vendor...
PT-2018-12642 · Ibm +2 · Sos-Collector +2
Name of the Vulnerable Software and Affected Versions: sos-collector affected versions not specified Description: A flaw was discovered in sos-collector where it fails to properly set default permissions for newly created files, making them readable by any local user. A local attacker can exploit...
CVE-2018-14327
The installer for the Alcatel OSPREY3MINI Modem component on EE EE40VB 4G mobile broadband modems with firmware before EE400002.0045 sets weak permissions Everyone:Full Control for the "Web Connecton\EE40" and "Web Connecton\EE40\BackgroundService" directories, which allows local users to gain...
CVE-2018-14327
CVE-2018-14327 affects the Alcatel OSPREY3_MINI Modem on EE40VB 4G mobiles prior to firmware EE40_00_02.00_45. The vulnerability arises from weak directory permissions (Everyone: Full Control) on Web Connecton\EE40 and Web Connecton\EE40\BackgroundService created by the installer, enabling a loca...
CVE-2018-14327
The installer for the Alcatel OSPREY3MINI Modem component on EE EE40VB 4G mobile broadband modems with firmware before EE400002.0045 sets weak permissions Everyone:Full Control for the "Web Connecton\EE40" and "Web Connecton\EE40\BackgroundService" directories, which allows local users to gain...
cfme: Improper access control in dRuby allows local users to execute arbitrary commands as root
CloudForms Management Engine has a vulnerability that allows local users to execute arbitrary commands as root. An attacker with SSH access to the system can use the dRuby DRb module installed on the system to execute arbitrary shell commands using instanceeval...
kernel: mm: use-after-free in do_get_mempolicy function allows local DoS or other unspecified impact
The dogetmempolicy function in mm/mempolicy.c in the Linux kernel allows local users to hit a use-after-free bug via crafted system calls and thus cause a denial of service DoS or possibly have unspecified other impact. Due to the nature of the flaw, privilege escalation cannot be fully ruled out...