CVE-2024-4712 Arbitrary File Creation in PaperCut NG/MF Web Print Image Handler

An arbitrary file creation vulnerability exists in PaperCut NG/MF that only affects Windows servers with Web Print enabled. This specific flaw exists within the image-handler process, which can incorrectly create files that don’t exist when a maliciously formed payload is provided. This can lead ...

CVE-2024-4712

CVE-2024-4712 and CVE-2024-8405 describe an arbitrary file creation issue in PaperCut NG/MF on Windows servers with Web Print enabled, affecting the image-handler/web‑print.exe process. The flaws allow a malicious payload to cause the creation of files that shouldn’t exist, potentially enabling l...

CVE-2024-3037 Arbitrary File Deletion in PaperCut NG/MF Web Print

An arbitrary file deletion vulnerability exists in PaperCut NG/MF, specifically affecting Windows servers with Web Print enabled. To exploit this vulnerability, an attacker must first obtain local login access to the Windows Server hosting PaperCut NG/MF and be capable of executing low-privilege...

DEBIAN-CVE-2021-3429

When instructing cloud-init to set a random password for a new user account, versions before 21.2 would write that password to the world-readable log file /var/log/cloud-init-output.log. This could allow a local user to log in as another user...

SUSE CVE-2010-0014

System Security Services Daemon SSSD before 1.0.1, when the krb5 authprovider is configured but the KDC is unreachable, allows physically proximate attackers to authenticate, via an arbitrary password, to the screen-locking program on a workstation that has any user's Kerberos ticket-granting...

Oracle Database Server 安全漏洞

Oracle Database Server is a set of relational database management system of the United States Oracle Oracle. The database management system provides data management, distributed processing, and other functions. A security vulnerability exists in Oracle Database - Enterprise Edition Sharding that...

GHSA-4WHX-7P29-MQ22 TiDB authentication bypass vulnerability

Impact Under certain conditions, an attacker can construct malicious authentication requests to bypass the authentication process, resulting in privilege escalation or unauthorized access. Only users using TiDB 5.3.0 are affected by this vulnerability. Patches Please upgrade to TiDB 5.3.1 or high...

TiDB authentication bypass vulnerability

Impact Under certain conditions, an attacker can construct malicious authentication requests to bypass the authentication process, resulting in privilege escalation or unauthorized access. Only users using TiDB 5.3.0 are affected by this vulnerability. Patches Please upgrade to TiDB 5.3.1 or high...

Authentication flaw

TiDB is an open-source NewSQL database that supports Hybrid Transactional and Analytical Processing HTAP workloads. Under certain conditions, an attacker can construct malicious authentication requests to bypass the authentication process, resulting in privilege escalation or unauthorized access...

CVE-2022-31011 TiDB authentication bypass vulnerability

TiDB is an open-source NewSQL database that supports Hybrid Transactional and Analytical Processing HTAP workloads. Under certain conditions, an attacker can construct malicious authentication requests to bypass the authentication process, resulting in privilege escalation or unauthorized access...

CVE-2022-31011 TiDB authentication bypass vulnerability

TiDB is an open-source NewSQL database that supports Hybrid Transactional and Analytical Processing HTAP workloads. Under certain conditions, an attacker can construct malicious authentication requests to bypass the authentication process, resulting in privilege escalation or unauthorized access...

Talend Data Catalog 授权问题漏洞

Talend Data Catalog is a combined data cataloging and metadata management tool from Talend USA. It is used to connect data from platforms, databases and analytics tools to generate a holistic view of the information supply chain in a language everyone can understand. A security vulnerability...

CVE-2021-35599

Vulnerability in the Zero Downtime DB Migration to Cloud component of Oracle Database Server. The supported version that is affected is 21c. Easily exploitable vulnerability allows high privileged attacker having Local Logon privilege with logon to the infrastructure where Zero Downtime DB...

Lenovo Bios 授权问题漏洞

Lenovo Bios is a boot method for computers from the Chinese company Lenovo Lenovo. It is used to boot the system during computer startup. Lenovo BIOS has an authorization issue vulnerability that stems from a lack of privilege control in the system shutdown SMI callback function, which allows an...

OPENSUSE-SU-2021:0920-1 Security update for dovecot23

This update for dovecot23 fixes the following issues: - CVE-2021-29157: Local attacker can login as any user and access their emails bsc1187418 - CVE-2021-33515: Attacker can potentially steal user credentials and mails bsc1187419...

CVE-2017-20002

CVE-2017-20002 affects the Debian shadow package prior to 1:4.5-1: it incorrectly marks pts/0 and pts/1 as physical terminals in /etc/securetty, enabling local privilege escalation even when users connect non-physically (e.g., SSH). The issue is resolved in the Debian LTS advisories by applying t...

shadow 安全漏洞

shadow is a suite of tools used to maintain Debian systems. A security vulnerability exists in the Debian shadow package before 4.5-1, which allows a local user to log in as a user without a password, allowing all local users to escalate privileges...

Microsoft Windows Graphics Component Information Disclosure Vulnerability (CNVD-2020-24070)

Microsoft Windows and Microsoft Windows Server are both products of Microsoft Corporation.Microsoft Windows is an operating system for personal devices.Microsoft Windows Server is a server operating system. Graphics Components is one of the graphics components. An information disclosure...

Linux: System Information in /etc/issue

The content of /etc/issue file is displayed to users after successful local login. Following escape chars display information about the system: - \m: machine architecture - \r: operating system release - \s: operating system name - \v: operating system version Copyright C 2020 Greenbone Networks...

Microsoft Windows and Microsoft Windows Server Privilege Mobilization Vulnerability (CNVD-2020-03545)

Microsoft Windows and Microsoft Windows Server are both products of Microsoft Corporation.Microsoft Windows is an operating system for personal devices.Microsoft Windows Server is a server operating system. An elevation of privilege vulnerability exists in Microsoft Windows and Windows Server,...