CVE-2019-18255

HMI/SCADA iFIX Versions 6.1 and prior allows a local authenticated user to modify system-wide iFIX configurations through section objects. This may allow privilege escalation...

Security Bulletin: An Eclipse Jetty vulnerability affects IBM Rational Functional Tester

Summary IBM Rational Functional Tester is affected by an Eclipse Jetty vulnerability that can allow a local authenticated user to gain elevated privileges on the system. By sending a specially-crafted request, an authenticated user could exploit this vulnerability to gain elevated privileges...

Security Bulletin: An Eclipse Jetty vulnerability affects IBM Rational Performance Tester (CVE-2020-27216)

Summary IBM Rational Performance Tester is affected by an Eclipse Jetty vulnerability than can allow a local authenticated user to gain eleved privileges on the system. By sending a specially-crafted request, an authenticated user could exploit this vulnerability to gain elevated privileges...

CVE-2021-36342

Dell BIOS contains an improper input validation vulnerability. A local authenticated malicious user may potentially exploit this vulnerability by using an SMI to gain arbitrary code execution in SMRAM...

CVE-2020-26199

Dell EMC Unity, Unity XT, and UnityVSA versions prior to 5.0.4.0.5.012 contain a plain-text password storage vulnerability. A user credentials including the Unisphere admin privilege user password is stored in a plain text in multiple log files. A local authenticated attacker with access to the l...

CVE-2020-29489

Dell EMC Unity, Unity XT, and UnityVSA versions prior to 5.0.4.0.5.012 contains a plain-text password storage vulnerability. A user credentials including the Unisphere admin privilege user password is stored in a plain text in a system file. A local authenticated attacker with access to the syste...

Input validation

Brocade Fabric OS versions before v9.0.0, v8.2.2c, v8.2.1e, v8.1.2k, v8.2.0CBN3, v7.4.2g contain an improper input validation weakness in the command line interface when secccrypptocfg is invoked. The vulnerability could allow a local authenticated user to run arbitrary commands and perform...

CVE-2020-15375

Brocade Fabric OS versions before v9.0.0, v8.2.2c, v8.2.1e, v8.1.2k, v8.2.0CBN3, v7.4.2g contain an improper input validation weakness in the command line interface when secccrypptocfg is invoked. The vulnerability could allow a local authenticated user to run arbitrary commands and perform...

Vulnerability fixed in Nagios XI

Nagios has fixed several vulnerabilities in Nagios XI. The vulnerabilities allow a local, authenticated malicious person potentially able to launch attacks that result in the following categories of damage: Cross-Site Scripting XSS. Remote code execution Administrator/Root privileges Increased us...

Security Bulletin: Red Hat OpenShift on IBM Cloud is affected by a GNU GRUB2 security vulnerability (CVE-2020-10713)

Summary Red Hat OpenShift on IBM Cloud is affected by a security vulnerability in GNU GRUB2 that could allow a local authenticated attacker to execute arbitrary code on the system. CVE-2020-10713 Vulnerability Details CVEID: CVE-2020-10713 Description: GNU GRUB2 could allow a local authenticated...

Security Bulletin: IBM Cloud Kubernetes Service is affected by a GNU GRUB2 security vulnerability (CVE-2020-10713)

Summary IBM Cloud Kubernetes Service is affected by a security vulnerability in GNU GRUB2 that could allow a local authenticated attacker to execute arbitrary code on the system. CVE-2020-10713 Vulnerability Details CVEID: CVE-2020-10713 Description: GNU GRUB2 could allow a local authenticated...

CVE-2020-15372

A vulnerability in the command-line interface in Brocade Fabric OS before Brocade Fabric OS v8.2.2a1, 8.2.2c, v7.4.2g, v8.2.0CBN3, v8.2.1e, v8.1.2k, v9.0.0, could allow a local authenticated attacker to modify shell variables, which may lead to an escalation of privileges or bypassing the logging...

CVE-2020-1159

An elevation of privilege vulnerability exists in the way that the StartTileData.dll handles file creation in protected locations. An attacker who successfully exploited the vulnerability could execute code with elevated permissions. To exploit the vulnerability, a locally authenticated attacker...

CVE-2020-10056

A vulnerability has been identified in License Management Utility LMU All versions V2.4. The lmgrd service of the affected application is executed with local SYSTEM privileges on the server while its configuration can be modified by local users. The vulnerability could allow a local authenticated...

CVE-2020-16281

The Kommbox component in Rangee GmbH RangeeOS 8.0.4 could allow a local authenticated attacker to escape from the restricted environment and execute arbitrary code due to unrestricted context menus being accessible...

Design/Logic Flaw

The Kommbox component in Rangee GmbH RangeeOS 8.0.4 could allow a local authenticated attacker to escape from the restricted environment and execute arbitrary code due to unrestricted context menus being accessible...

CVE-2020-16281

The Kommbox component in Rangee GmbH RangeeOS 8.0.4 could allow a local authenticated attacker to escape from the restricted environment and execute arbitrary code due to unrestricted context menus being accessible...

Vulnerabilities fixed in Cisco Data Center Network Manager

Cisco has fixed several vulnerabilities in the Data Center Network Manager. The vulnerabilities allow a local authenticated malicious party to conduct attacks that can lead to the following types of damage: Cross-Site Scripting XSS. Manipulation of data Access to system data Increased user...

PT-2020-3158 · Microsoft · Windows Kernel +1

Name of the Vulnerable Software and Affected Versions: Windows Kernel affected versions not specified Description: The issue is related to errors in handling objects in memory. It allows an attacker to elevate their privileges by executing a specially crafted application, potentially leading to...

CVE-2020-1254

An elevation of privilege vulnerability exists when Windows Modules Installer Service improperly handles class object members.A locally authenticated attacker could run arbitrary code with elevated system privileges, aka 'Windows Modules Installer Service Elevation of Privilege Vulnerability'...