CVE-2017-8985: Exposure of Sensitive Information to an Unauthorized Actor

HPE XP Storage using Hitachi Global Link Manager HGLM has a local authenticated information disclosure vulnerability in HGLM version HGLM 6.3.0-00 to 8.5.2-00...

PT-2018-8480

Name of the Vulnerable Software and Affected Versions HPE XP Storage using Hitachi Global Link Manager HGLM versions 6.3.0-00 through 8.5.2-00 Description The issue is a local authenticated information disclosure. Recommendations For versions 6.3.0-00 through 8.5.2-00, update to a version that...

CVE-2018-0123

A Path Traversal vulnerability in the diagnostic shell for Cisco IOS and IOS XE Software could allow an authenticated, local attacker to use certain diagnostic shell commands that can overwrite system files. These system files may be sensitive and should not be able to be overwritten by a user of...

CVE-2018-0012: Undefined Security Weakness

Junos Space is affected by a privilege escalation vulnerability that may allow a local authenticated attacker to gain root privileges...

Microsoft Windows - 'nt!NtQueryInformationProcess (information class 76_ QueryProcessEnergyValues)' Kernel Stack Memory Disclosure

/ We have discovered that the nt!NtQueryInformationProcess system call invoked with the 76 information class discloses portions of uninitialized kernel stack memory to user-mode clients. The specific information class is handled by an internal nt!PsQueryProcessEnergyValues function. While we don'...

Security Advisory - Memory Leak Vulnerability in Some Huawei FireWall Products

Some Huawei FireWall products have a memory leak vulnerability due to memory don't be released when an local authenticated attacker execute special commands many times. An attacker could exploit it to cause memory leak, which may further lead to system exceptions.Vulnerability ID:...

CVE-2017-12331

A vulnerability in Cisco NX-OS System Software could allow an authenticated, local attacker to bypass signature verification when loading a software patch. The vulnerability is due to insufficient NX-OS signature verification for software patches. An authenticated, local attacker could exploit th...

CVE-2017-6223

Ruckus Wireless Zone Director Controller firmware releases ZD9.9.x, ZD9.10.x, ZD9.13.0.x less than 9.13.0.0.232 contain OS Command Injection vulnerabilities in the ping functionality that could allow local authenticated users to execute arbitrary privileged commands on the underlying operating...

Command injection

Ruckus Wireless Zone Director Controller firmware releases ZD9.9.x, ZD9.10.x, ZD9.13.0.x less than 9.13.0.0.232 contain OS Command Injection vulnerabilities in the ping functionality that could allow local authenticated users to execute arbitrary privileged commands on the underlying operating...

CVE-2017-6223

Ruckus Wireless Zone Director Controller firmware releases ZD9.9.x, ZD9.10.x, ZD9.13.0.x less than 9.13.0.0.232 contain OS Command Injection vulnerabilities in the ping functionality that could allow local authenticated users to execute arbitrary privileged commands on the underlying operating...

CVE-2017-6223: Improper Neutralization of Special Elements used in an OS Command

Ruckus Wireless Zone Director Controller firmware releases ZD9.9.x, ZD9.10.x, ZD9.13.0.x less than 9.13.0.0.232 contain OS Command Injection vulnerabilities in the ping functionality that could allow local authenticated users to execute arbitrary privileged commands on the underlying operating...

PT-2017-16952

Name of the Vulnerable Software and Affected Versions Ruckus Wireless Zone Director Controller firmware versions ZD9.x through ZD10.0.1.x less than 10.0.1.0.17 MR1 release Ruckus Wireless Unleashed AP Firmware versions 200.0.x through 200.4.x Description The issue allows local authenticated users...

CVE-2017-6224: Improper Neutralization of Special Elements used in an OS Command

Ruckus Wireless Zone Director Controller firmware releases ZD9.x, ZD10.0.0.x, ZD10.0.1.x less than 10.0.1.0.17 MR1 release and Ruckus Wireless Unleashed AP Firmware releases 200.0.x, 200.1.x, 200.2.x, 200.3.x, 200.4.x. contain OS Command Injection vulnerabilities that could allow local...

PT-2017-16951

Name of the Vulnerable Software and Affected Versions Ruckus Wireless Zone Director Controller firmware releases ZD9.9.x through ZD9.10.x Ruckus Wireless Zone Director Controller firmware releases ZD9.13.0.x less than 9.13.0.0.232 Description The issue concerns OS Command Injection vulnerabilitie...

CVE-2017-14773

Skybox Manager Client Application prior to 8.5.501 is prone to an elevation of privileges vulnerability during authentication of a valid user in a debugger-pause state. The vulnerability can only be exploited by a local authenticated attacker...

CVE-2017-14771: Improper Input Validation

Skybox Manager Client Application prior to 8.5.501 is prone to an arbitrary file upload vulnerability due to insufficient input validation of user-supplied files path when uploading files via the application. During a debugger-pause state, a local authenticated attacker can upload an arbitrary fi...

CVE-2017-14770: Exposure of Sensitive Information to an Unauthorized Actor

Skybox Manager Client Application prior to 8.5.501 is prone to an information disclosure vulnerability of user password hashes. A local authenticated attacker can access the password hashes in a debugger-pause state during the authentication process...

CVE-2017-14773: Undefined Security Weakness

Skybox Manager Client Application prior to 8.5.501 is prone to an elevation of privileges vulnerability during authentication of a valid user in a debugger-pause state. The vulnerability can only be exploited by a local authenticated attacker...

CVE-2017-14771

Skybox Manager Client Application prior to 8.5.501 is prone to an arbitrary file upload vulnerability due to insufficient input validation of user-supplied files path when uploading files via the application. During a debugger-pause state, a local authenticated attacker can upload an arbitrary fi...

PT-2017-13686

Name of the Vulnerable Software and Affected Versions Skybox Manager Client Application versions prior to 8.5.501 Description The issue is related to an elevation of privileges during the authentication of a valid user in a debugger-pause state. This can only be exploited by a local authenticated...