1339 matches found
PT-2022-21160 · Node.Js · Node.Js
Name of the Vulnerable Software and Affected Versions: Node.js versions 18.x prior to 18.40.0 Description: A cryptographic issue exists in Node.js on Linux, where the default path for openssl.cnf might be accessible to a non-admin user under certain circumstances, instead of being located in...
Atlassian Jira < 8.20.1 Improper Authorization
According to its self-reported version number, the instance of Atlassian Jira hosted on the remote web server is prior to 8.20.1. It is, therefore, affected by a vulnerability allowing authenticated but non-admin remote attackers to edit email batch configurations via an Improper Authorization...
CVE-2020-21046
A local privilege escalation vulnerability was identified within the "luminatinetupdaterwineaglegetcom" service in EagleGet Downloader version 2.1.5.20 Stable. This issue allows authenticated non-administrative user to escalate their privilege and conduct code execution as a SYSTEM privilege...
CVE-2022-29094
Dell SupportAssist Client Consumer versions 3.10.4 and versions prior and Dell SupportAssist Client Commercial versions 3.1.1 and versions prior contain an arbitrary file deletion/overwrite vulnerability. Authenticated non-admin user could exploit the issue and delete or overwrite arbitrary files...
CVE-2022-29093
Dell SupportAssist Client Consumer versions 3.10.4 and versions prior and Dell SupportAssist Client Commercial versions 3.1.1 and versions prior contain an arbitrary file deletion vulnerability. Authenticated non-admin user could exploit the issue and delete arbitrary files on the system...
CVE-2022-29092
Dell SupportAssist Client Consumer versions 3.11.0 and versions prior and Dell SupportAssist Client Commercial versions 3.2.0 and versions prior contain a privilege escalation vulnerability. A non-admin user can exploit the vulnerability and gain admin access to the system...
Privilege escalation
Dell SupportAssist Client Consumer versions 3.11.0 and versions prior and Dell SupportAssist Client Commercial versions 3.2.0 and versions prior contain a privilege escalation vulnerability. A non-admin user can exploit the vulnerability and gain admin access to the system...
CVE-2022-29093
Dell SupportAssist Client Consumer versions 3.10.4 and versions prior and Dell SupportAssist Client Commercial versions 3.1.1 and versions prior contain an arbitrary file deletion vulnerability. Authenticated non-admin user could exploit the issue and delete arbitrary files on the system...
CVE-2022-29092
Dell SupportAssist Client Consumer versions 3.11.0 and versions prior and Dell SupportAssist Client Commercial versions 3.2.0 and versions prior contain a privilege escalation vulnerability. A non-admin user can exploit the vulnerability and gain admin access to the system...
CVE-2022-29092
Dell SupportAssist Client Consumer versions 3.11.0 and versions prior and Dell SupportAssist Client Commercial versions 3.2.0 and versions prior contain a privilege escalation vulnerability. A non-admin user can exploit the vulnerability and gain admin access to the system...
CVE-2022-29093
Dell SupportAssist Client Consumer versions 3.10.4 and versions prior and Dell SupportAssist Client Commercial versions 3.1.1 and versions prior contain an arbitrary file deletion vulnerability. Authenticated non-admin user could exploit the issue and delete arbitrary files on the system...
GHSA-RRHW-54R8-545Q Path Traversal in FileGator
Path Traversal in FileGator prior to 7.8.0 for non-admin users. Files created with ..\ as part of their name will be interpreted as a path. Users are thus able to add filesystem entries outside the scope of their user to their dashboard and subsequently are able to modify those files...
Path Traversal in FileGator
Path Traversal in FileGator prior to 7.8.0 for non-admin users. Files created with ..\ as part of their name will be interpreted as a path. Users are thus able to add filesystem entries outside the scope of their user to their dashboard and subsequently are able to modify those files...
CVE-2022-22977
VMware Tools for Windows12.0.0, 11.x.y and 10.x.y contains an XML External Entity XXE vulnerability. A malicious actor with non-administrative local user privileges in the Windows guest OS, where VMware Tools is installed, may exploit this issue leading to a denial-of-service condition or...
Trend Micro Password Manager vulnerable to privilege escalation
Overview Trend Micro Incorporated has released a security update for Trend Micro Password Manager. Trend Micro Incorporated reported the vulnerability to JPCERT/CC to notify users of the solutions through JVN. Impact A non-administrative user of the system where the affected product is installed...
Stored XSS
Description Stored XSS in ListAgenciaTransporte module in facturascripts is triggered when clicking the scrolling middle mouse button. Proof of Concept 1.Create a new non-admin account 2.Login and goto http://localhost/invoices/EditAgenciaTransporte 3.Add new user with website link to...
GHSA-M643-2PFV-XWM8 Exposure of Sensitive Information to an Unauthorized Actor in SonarSource SonarQube API
A vulnerability in the API of SonarSource SonarQube before 7.5 could allow an authenticated user to discover sensitive information such as valid user-account logins in the web application. The vulnerability occurs because of improperly configured access controls that cause the API to return the...
GHSA-JWVR-VV7P-GPWQ Privilege escalation for users with create/update permissions in Global Roles in Rancher
Impact This vulnerability affects customers who utilize non-admin users that are able to create or edit Global Roles. The most common use case for this scenario is the restricted-admin role. A flaw was discovered in Rancher versions from 2.5.0 up to and including 2.5.12 and from 2.6.0 up to and...
PT-2022-16916 · Minio +1 · Minio +1
Name of the Vulnerable Software and Affected Versions: MinIO versions prior to RELEASE.2022-04-12T06-55-35Z Description: A security issue was found in MinIO where a non-admin user can create service accounts for root or other admin users and then assume their access policies via the generated...