Denial Of Service (DoS)

kernel is vulnerable to denial of service. It was found that reporting emulation failures to user space could lead to either a local CVE-2014-7842 or a L2-L1 CVE-2010-5313 denial of service. In the case of a local denial of service, an attacker must have access to the MMIO area or be able to acce...

Credential Disclosure Through A Brute Force Attack

Red Hat CloudForms Management Engine delivers the insight, control, and automation needed to address the challenges of managing virtual environments. CloudForms Management Engine is built on Ruby on Rails, a model-view-controller MVC framework for web application development. Action Pack implemen...

CVE-2019-3938

Crestron AM-100 with firmware 1.6.0.2 and AM-101 with firmware 2.7.0.2 stores usernames, passwords, and other configuration options in the file generated via the "export configuration" feature. The configuration file is encrypted using the awenc binary. The same binary can be used to decrypt any...

CVE-2019-8454

A local attacker can create a hard-link between a file to which the Check Point Endpoint Security client for Windows before E80.96 writes and another BAT file, then by impersonating the WPAD server, the attacker can write BAT commands into that file that will later be run by the user or the syste...

Oracle VM VirtualBox 5.2.x < 5.2.28 / 6.0.x < 6.0.6 (Apr 2019 CPU)

The version of Oracle VM VirtualBox running on the remote host is 5.2.x prior to 5.2.28 or 6.0.x prior to 6.0.6. It is, therefore, affected by multiple vulnerabilities as noted in the April 2019 Critical Patch Update advisory : - Multiple unspecified vulnerabilities in the Core component of Oracl...

Microsoft Windows CVE-2019-0844 Local Information Disclosure Vulnerability

Description Microsoft Windows is prone to a local information-disclosure vulnerability. Local attackers can exploit this issue to obtain sensitive information that may lead to further attacks. Technologies Affected Microsoft Windows 10 Version 1607 for 32-bit Systems Microsoft Windows 10 Version...

CVE-2018-3968

The vulnerability CVE-2018-3968 affects Das U-Boot versions 2013.07-rc1 through 2014.07-rc2, where verified boot lacks proper FIT signature enforcement. This allows a local attacker who can supply a boot image to bypass verified boot and execute an unsigned kernel embedded in a legacy image forma...

Design/Logic Flaw

In PuTTY versions before 0.71 on Windows, local attackers could hijack the application by putting a malicious help file in the same directory as the executable...

CVE-2019-9896

PuTTY (Windows) before version 0.71 is affected by CVE-2019-9896. An attacker could hijack the application by placing a malicious help file in the same directory as the PuTTY executable. OpenSUSE and Nessus references confirm this Windows‑only issue. The remediation is to upgrade to upstream rele...

CVE-2019-9896

In PuTTY versions before 0.71 on Windows, local attackers could hijack the application by putting a malicious help file in the same directory as the executable...

CVE-2018-17483

CVE-2018-17483 affects Lobby Track Desktop in kiosk mode, where an error in Reports enables a local attacker viewing the driver’s license column to obtain driver’s license numbers and other personal information. The NVD entry confirms an information disclosure vulnerability with local access; the...

CUJO Smart Firewall dhcpd.conf verified boot bypass

Summary An exploitable vulnerability exists in the verified boot protection of the CUJO Smart Firewall. It is possible to add arbitrary shell commands into the dhcpd.conf file, that persist across reboots and firmware updates, and thus allow for executing unverified commands. To trigger this...

Intel Graphics Driver for Windows User Mode Driver Buffer Overflow Vulnerability

Intel Graphics Driver for Windows is an Intel graphics card driver for the Windows platform.User Mode Driver is one of the user mode drivers. A buffer overflow vulnerability exists in the User Mode Driver of the Intel Graphics Driver for Windows. A local attacker could exploit this vulnerability ...

CVE-2018-1980

IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server 9.7, 10.1, 10.5, and 11.1 is vulnerable to a buffer overflow, which could allow an authenticated local attacker to execute arbitrary code on the system as root. IBM X-ForceID: 154078...

CVE-2019-1613

A vulnerability in the CLI of Cisco NX-OS Software could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system of an affected device. The vulnerability is due to insufficient validation of arguments passed to certain CLI commands. An attacker coul...

CVE-2019-1604

CVE-2019-1604 affects Cisco NX-OS Software privilege escalation via an incorrect authorization check for user accounts and their GID. An authenticated, local attacker can exploit a logic error to run higher-privileged commands on the Linux shell of affected devices. Affected platforms and version...

Cisco WebEx Meetings Privilege Escalation

SecureAuth - SecureAuth Labs Advisory http://www.secureauth.com/ Cisco WebEx Meetings Elevation of Privilege Vulnerability Version 2 1. Advisory Information Title: Cisco WebEx Meetings Elevation of Privilege Vulnerability Version 2 Advisory ID: CORE-2018-0012 Advisory URL:...

CVE-2019-7006 Avaya one-X Communicator Weak Encryption

Avaya one-X Communicator uses weak cryptographic algorithms in the client authentication component that could allow a local attacker to decrypt sensitive information. Affected versions include all 6.2.x versions prior to 6.2 SP13...

CVE-2019-5780

The CVE-2019-5780 entry refers to Google Chrome on macOS with insufficient restrictions on Apple Events before Chrome 72.0.3626.81, allowing a local attacker to execute JavaScript via Apple Events. Affects Chrome versions prior to the 72.0.3626.81 update. Root cause: insufficient restriction of A...

CVE-2019-3812

QEMU, through version 2.10 and through version 3.1.0, is vulnerable to an out-of-bounds read of up to 128 bytes in the hw/i2c/i2c-ddc.c:i2cddc function. A local attacker with permission to execute i2c commands could exploit this to read stack memory of the qemu process on the host...