PT-2024-3250 · Oracle +1 · Virtualbox +1

Name of the Vulnerable Software and Affected Versions: Oracle VM VirtualBox versions prior to 7.0.16 Description: The issue is related to an out-of-bounds write vulnerability in the Core component of Oracle VM VirtualBox. This vulnerability can be easily exploited by a low-privileged attacker wit...

PT-2024-3270 · Oracle +1 · Virtualbox +1

Name of the Vulnerable Software and Affected Versions: Oracle VM VirtualBox versions prior to 7.0.16 Description: The issue is related to improper privilege management in the Oracle VM VirtualBox product, allowing a low-privileged attacker with logon access to the infrastructure to compromise...

SikkaSoft Platform Utility 安全漏洞

SikkaSoft Platform Utility is a cloud platform from SikkaSoft, Inc. A security vulnerability exists in SikkaSoft Platform Utility version 5 2023-09-14 that originates from allowing a low-privileged user to execute arbitrary code with LocalSystem privileges...

GHSA-G4V6-69P6-Q3P4 WiX Burn-based bundles are vulnerable to binary hijack when run as SYSTEM

Summary Burn uses an unprotected C:\Windows\Temp directory to copy binaries and run them from there. This directory is not entirely protected against low privilege users. Details When a bundle runs as SYSTEM user, Burn uses GetTempPathW which points to an insecure directory C:\Windows\Temp to dro...

OpenJDK: logging of digital signature private keys (8316976)

Difficult to exploit vulnerability allows low privileged attacker with logon to the infrastructure where Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition executes to compromise Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition. Successful attacks o...

PT-2024-18973 · Kiloview · Kiloview Ndi

Name of the Vulnerable Software and Affected Versions: Kiloview NDI versions prior to 2.02.0227 Description: An OS Command Injection issue allows a low-privileged user to execute arbitrary code remotely on the device with high privileges. This issue affects various Kiloview NDI models, including...

PT-2024-3243 · Oracle +1 · Virtualbox +1

Name of the Vulnerable Software and Affected Versions: Oracle VM VirtualBox versions prior to 7.0.16 Description: The issue is related to insufficient access control in the Core component of Oracle VM VirtualBox, allowing a low-privileged attacker with logon access to the infrastructure where...

PT-2024-18087 · WordPress · Photos/Files Contest Gallery Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Photos and Files Contest Gallery WordPress plugin versions prior to 21.3.1 Description: The issue concerns a lack of sanitization and escaping of certain parameters, potentially allowing Cross-Site Scripting attacks by users with a role as lo...

BIT-WORDPRESS-MULTISITE-2020-4046 Authenticated XSS through embed block in WordPress

In affected versions of WordPress, users with low privileges like contributors and authors can use the embed block in a certain way to inject unfiltered HTML in the block editor. When affected posts are viewed by a higher privileged user, this could lead to script execution in the editor/wp-admin...

BIT-MYSQL-CLIENT-2020-14550

Vulnerability in the MySQL Client product of Oracle MySQL component: C API. Supported versions that are affected are 5.6.48 and prior, 5.7.30 and prior and 8.0.20 and prior. Difficult to exploit vulnerability allows low privileged attacker with network access via multiple protocols to compromise...

mysql: Server: Optimizer unspecified vulnerability (CPU Jan 2024)

Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash complete DOS of MySQL Server...

mysql: Server: Security: Encryption unspecified vulnerability (CPU Jan 2024)

Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash complete DOS of MySQL Server...

mysql: Server: UDF unspecified vulnerability (CPU Jan 2024)

Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash complete DOS of MySQL Server...

CVE-2024-0155

Dell Digital Delivery, versions prior to 5.2.0.0, contain a Use After Free Vulnerability. A local low privileged attacker could potentially exploit this vulnerability, leading to application crash or execution of arbitrary code...

Yelp: Privilege Escalation - A Low Privilege User who does not have access to the user management module can remove the owner of the business account

The owner of the business account was removed by a low-privilege user who did not have access to the user management module...

CVE-2024-26016 Apache Superset: Improper authorization validation on dashboards and charts import

A low privilege authenticated user could import an existing dashboard or chart that they do not have access to and then modify its metadata, thereby gaining ownership of the object. However, it's important to note that access to the analytical data of these charts and dashboards would still be...

PT-2024-21277

Name of the Vulnerable Software and Affected Versions Apache Superset versions prior to 3.0.4 Apache Superset versions 3.1.0 through 3.1.0 Description A low privilege authenticated user could import an existing dashboard or chart that they do not have access to and then modify its metadata, there...

PT-2024-18184 · Progress · Sitefinity

Name of the Vulnerable Software and Affected Versions: Sitefinity affected versions not specified Description: The issue concerns a potential Cross-Site Scripting XSS in the page editing area, which may allow low-privileged users with access to the Sitefinity backend to obtain sensitive informati...

CVE-2024-26302

A vulnerability in the web-based management interface of ClearPass Policy Manager could allow a remote attacker authenticated with low privileges to access sensitive information. A successful exploit allows an attacker to retrieve information which could be used to potentially gain further access...

CVE-2024-26301

A vulnerability in the web-based management interface of ClearPass Policy Manager could allow a remote attacker authenticated with low privileges to access sensitive information. A successful exploit allows an attacker to retrieve information which could be used to potentially gain further access...