CVE-2023-28029

Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentially exploit this vulnerability in order to modify a UEFI variable...

CVE-2023-25937

Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentially exploit this vulnerability in order to modify a UEFI variable...

CVE-2023-28033

Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentially exploit this vulnerability in order to modify a UEFI variable...

CVE-2023-28028

Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with administrator privileges may potentially exploit this vulnerability in order to modify a UEFI variable...

CVE-2023-28800

When using local accounts for administration, the redirect url parameter was not encoded correctly, allowing for an XSS attack providing admin login...

ManageEngine ADManager Plus Command Injection

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'ManageEngine ADManager Plus ChangePasswordAction Authenticated Command Injection', 'Description' = %q ManageEngine ADManager Plus prior to build...

ManageEngine ADManager Plus ChangePasswordAction Authenticated Command Injection

ManageEngine ADManager Plus prior to build 7181 is vulnerable to an authenticated command injection due to insufficient validation of user input when performing the ChangePasswordAction function before passing it into a string that is later used as an OS command to execute. By making a POST reque...

CVE-2023-28700

OMICARD EDM backend system’s file uploading function does not restrict upload of file with dangerous type. A local area network attacker with administrator privileges can exploit this vulnerability to upload and run arbitrary executable files to perform arbitrary system commands or disrupt servic...

Palo Alto Cortex XDR Agent 7.5.x < 7.5.101-CE Cleartext Credential

The version of Palo Alto Cortex XDR Agent installed on the remote Windows host is 7.5 prior to 7.5.101-CE. It is, therefore, affected by an information exposure vulnerability in the Palo Alto Networks Cortex XDR agent on Windows devices that allows a local system administrator to disclose the adm...

MobileTrans 安全漏洞

MobileTrans is one of the best mobile data transfer apps from MobileTrans with the fastest cross-platform transfer speeds between iOS and Android. A security vulnerability exists in MobileTrans version v4.0.11, which stems from the presence of a weak service privilege vulnerability that allows a...

CVE-2023-20880

VMware Aria Operations contains a privilege escalation vulnerability. A malicious actor with administrative access to the local system can escalate privileges to 'root'...

May 9, 2023—KB5026370 (OS Build 20348.1726)

None None...

April 11, 2023—KB5025239 (OS Build 22621.1555)

None None...

LAPS : Randomizing Local Admin Passwords in Non-persistent Environments

Use LAPS inLocal Admin Passwords for Non-persistent Environments...

K31440025: OpenSSH vulnerability CVE-2016-10009

Security Advisory Description Untrusted search path vulnerability in ssh-agent.c in ssh-agent in OpenSSH before 7.4 allows remote attackers to execute arbitrary local PKCS11 modules by leveraging control over a forwarded agent-socket. CVE-2016-10009 Impact Running the ssh-agent program requires a...

SUSE CVE-2007-5848

Buffer overflow in CUPS in Apple Mac OS X 10.4.11 allows local admin users to execute arbitrary code via a crafted URI to the CUPS service...

Palo Alto Networks Cortex XDR 安全漏洞

Palo Alto Networks Cortex XDR is an extended detection and response platform that natively integrates network, endpoint, cloud, and third-party data from Palo Alto Networks, USA. A security vulnerability exists in the Palo Alto Networks Cortex XDR agent that originates from a local system...

CVE-2023-0599 Rapid7 Metasploit Pro Stored XSS

Rapid7 Metasploit Pro versions 4.21.2 and lower suffer from a stored cross site scripting vulnerability, due to a lack of JavaScript request string sanitization. Using this vulnerability, an authenticated attacker can execute arbitrary HTML and script code in the target browser against another...

CVE-2022-32482

Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user with admin privileges may potentially exploit this vulnerability in order to modify a UEFI variable...

Dell BIOS 输入验证错误漏洞

Dell BIOS is embedded software on a small memory chip on a computer motherboard from Dell, Inc. A security vulnerability exists in Dell BIOS that stems from an incorrect input validation vulnerability that could be exploited by a malicious, locally authenticated user with administrator privileges...