IBM DB2 Buffer Overflow Vulnerability (CNVD-2020-36384)

IBM DB2 is a set of relational database management system from IBM in the United States. The main execution environments for this system are UNIX, Linux, IBMi, z/OS, and Windows server versions. A buffer overflow vulnerability exists in IBM DB2 including DB2 Connect Server on Linux, UNIX, and...

Check Point ZoneAlarm Symlink Following Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Check Point ZoneAlarm. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the ZoneAlarm...

CVE-2020-8022

A Incorrect Default Permissions vulnerability in the packaging of tomcat on SUSE Enterprise Storage 5, SUSE Linux Enterprise Server 12-SP2-BCL, SUSE Linux Enterprise Server 12-SP2-LTSS, SUSE Linux Enterprise Server 12-SP3-BCL, SUSE Linux Enterprise Server 12-SP3-LTSS, SUSE Linux Enterprise Server...

VMware Workstation Shader Bytecode Parsing Out-Of-Bounds Read Information Disclosure Vulnerability

This vulnerability allows local attackers to disclose sensitive information on affected installations of VMware Workstation. An attacker must first obtain the ability to execute low-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within...

VMware Workstation EHCI Time-Of-Check Time-Of-Use Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of VMware Workstation. An attacker must first obtain the ability to execute high-privileged code on the target guest system in order to exploit this vulnerability. The specific flaw exists within the EHCI...

CVE-2020-8014

A UNIX Symbolic Link Symlink Following vulnerability in the packaging of kopano-spamd of openSUSE Leap 15.1, openSUSE Tumbleweed allowed local attackers with the privileges of the kopano user to escalate to root. This issue affects: openSUSE Leap 15.1 kopano-spamd versions prior to...

CVE-2020-8014

Removed by vendor...

CVE-2020-8022

A Incorrect Default Permissions vulnerability in the packaging of tomcat on SUSE Enterprise Storage 5, SUSE Linux Enterprise Server 12-SP2-BCL, SUSE Linux Enterprise Server 12-SP2-LTSS, SUSE Linux Enterprise Server 12-SP3-BCL, SUSE Linux Enterprise Server 12-SP3-LTSS, SUSE Linux Enterprise Server...

CVE-2020-8024

A Incorrect Default Permissions vulnerability in the packaging of hylafax+ of openSUSE Leap 15.2, openSUSE Leap 15.1, openSUSE Factory allows local attackers to escalate from user uucp to users calling hylafax binaries. This issue affects: openSUSE Leap 15.2 hylafax+ versions prior to...

CVE-2020-8024 Problematic permissions in hylafax+ packaging allow escalation from uucp to other users

A Incorrect Default Permissions vulnerability in the packaging of hylafax+ of openSUSE Leap 15.2, openSUSE Leap 15.1, openSUSE Factory allows local attackers to escalate from user uucp to users calling hylafax binaries. This issue affects: openSUSE Leap 15.2 hylafax+ versions prior to...

CVE-2020-8024

CVE-2020-8024 describes an Incorrect Default Permissions issue in the packaging of hylafax+ for openSUSE Leap 15.1, Leap 15.2, and Factory. The root cause is incorrect default permissions in the hylafax+ packaging, enabling local attackers with user uucp to escalate privileges to the hylafax bina...

Cisco AnyConnect Path Traversal / Privilege Escalation

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Cisco AnyConnect Priv Esc through Path Traversal', 'Description' = %q The installer component of Cisco AnyConnect Secure Mobility Client for...

Security Bulletin: Muluple vulnerabilities in Ubuntu affect IBM Workload Scheduler 9.5

Summary Multiple vulnerabilities have been found in Ubuntu and potentially affect container images of IBM Workload Scheduler 9.5 Vulnerability Details CVEID: CVE-2019-11481 DESCRIPTION: Ubuntu Apport could allow a local attacker to cause a denial of service. By reading user-controlled settings fi...

Docker Desktop Execution with Unnecessary Privileges Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Docker Desktop. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Troubleshoot...

MGASA-2020-0245 Updated libzypp packages fix security vulnerability

Libzypp from mageia 7 is affected by a security issue. This update fixes this. Incorrect Default Permissions vulnerability in libzypp allowed local attackers to read a cookie store used by libzypp, exposing private cookies...

(0Day) (Pwn2Own) Apple macOS Quarantine Attribute Bypass Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Apple macOS. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of download...

Microsoft Windows win32kfull PDEVOBJ Use-After-Free Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Microsoft Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of...

Amazon Linux 2 : xorg-x11-server (ALAS-2020-1433)

It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2020-1433 advisory. It was discovered that libX11 does not properly validate input coming from the server, causing XListExtensions and XGetFontPath functions to produce an invalid list of elements that in turn make...

Atlassian Companion app code issue vulnerability

The Atlassian Companion app is an application from Atlassian Australia that enables users to edit Confluence files in their preferred desktop application. A code issue vulnerability exists in the file editing functionality in versions of the Atlassian Companion app prior to 1.0.0. A local attacke...

CVE-2020-4019

The file editing functionality in the Atlassian Companion App before version 1.0.0 allows local attackers to have the app run a different executable in place of the app's cmd.exe via a untrusted search path vulnerability...