SUSE CVE-2020-8024

A Incorrect Default Permissions vulnerability in the packaging of hylafax+ of openSUSE Leap 15.2, openSUSE Leap 15.1, openSUSE Factory allows local attackers to escalate from user uucp to users calling hylafax binaries. This issue affects: openSUSE Leap 15.2 hylafax+ versions prior to...

SUSE CVE-2020-15396

In HylaFAX+ through 7.0.2 and HylaFAX Enterprise, the faxsetup utility calls chown on files in user-owned directories. By winning a race, a local attacker could use this to escalate his privileges to root...

SUSE CVE-2020-15397

HylaFAX+ through 7.0.2 and HylaFAX Enterprise have scripts that execute binaries from directories writable by unprivileged users e.g., locations under /var/spool/hylafax that are writable by the uucp account. This allows these users to execute code in the context of the user calling these binarie...

SUSE CVE-2021-3178

fs/nfsd/nfs3xdr.c in the Linux kernel through 5.10.8, when there is an NFS export of a subdirectory of a filesystem, allows remote attackers to traverse to other parts of the filesystem via READDIRPLUS. NOTE: some parties argue that such a subdirectory export is not intended to prevent this attac...

SUSE CVE-2021-32715

hyper is an HTTP library for rust. hyper's HTTP/1 server code had a flaw that incorrectly parses and accepts requests with a Content-Length header with a prefixed plus sign, when it should have been rejected as illegal. This combined with an upstream HTTP proxy that doesn't parse such...

SUSE CVE-2021-37322

GCC c++filt v2.26 was discovered to contain a use-after-free vulnerability via the component cplus-dem.c...

SUSE CVE-2021-38201

net/sunrpc/xdr.c in the Linux kernel before 5.13.4 allows remote attackers to cause a denial of service xdrsetpagebase slab-out-of-bounds access by performing many NFS 4.2 READPLUS operations...

SUSE CVE-2022-46149

Cap'n Proto is a data interchange format and remote procedure call RPC system. Cap'n Proro prior to versions 0.7.1, 0.8.1, 0.9.2, and 0.10.3, as well as versions of Cap'n Proto's Rust implementation prior to 0.13.7, 0.14.11, and 0.15.2 are vulnerable to out-of-bounds read due to logic error...

PT-2023-1649 · Abb · Symphony Plus -S+ Operations

Name of the Vulnerable Software and Affected Versions: ABB Symphony Plus S+ Operations versions 2.X through 2.1 SP2, 2.2 ABB Symphony Plus S+ Operations versions 3.X through 3.3 SP1, 3.3 SP2 Description: The issue is related to improper authentication in the ABB Symphony Plus S+ Operations...

HPESBHF04437 rev.1 - Certain HPE Synergy Servers using Certain Intel Processor, INTEL-SA-00738, 2023.1 IPU – Intel Xeon Processor Advisory, Local Escalation of Privilege Vulnerability

Potential Security Impact: Local: Escalation of Privilege SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Synergy 480 Gen10 Plus Compute Module - Prior to 1.7202-02-2023 CVSS Scores: | CVE | CVSS Vector | Base Score | | --- | --- | --- | | CVE-2022-33196 |...

HPESBHF04413 rev.1 - Certain HPE ProLiant Servers Using Certain Intel Processors, INTEL-SA-00700, 2023.1 IPU - Intel Atom and Intel Xeon Scalable Processors Advisory, Local Escalation of Privilege

Potential Security Impact: Local: Escalation of Privilege SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE ProLiant DL110 Gen10 Plus Telco server -Prior to 1.7202-02-2023 HPE ProLiant DL360 Gen10 Plus server -Prior to 1.7202-02-2023 HPE ProLiant DL380 Gen10 Plus server -Prior t...

HPESBHF04439 rev.1 - Certain HPE Apollo, XL Servers Using Certain Intel Processors, INTEL-SA-00700, 2023.1 IPU - Intel Atom and Intel Xeon Scalable Processors Advisory, Local Escalation of Privilege

Potential Security Impact: Local: Escalation of Privilege SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE Apollo 4200 Gen10 Plus System - Prior to 1.7202-02-2023 HPE Apollo 2000 Gen10 Plus System - Prior to 1.7202-02-2023 HPE ProLiant XL290n Gen10 Plus Server - Prior to...

HPESBHF04431 rev.1 - Certain HPE ProLiant DX Servers using Certain Intel Processor, INTEL-SA-00738, 2023.1 IPU – Intel Xeon Processor Advisory, Local Escalation of Privilege Vulnerability

Potential Security Impact: Local: Escalation of Privilege SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE ProLiant DX360 Gen10 Plus server - Prior to 1.7202-02-2023 HPE ProLiant DX380 Gen10 Plus server - Prior to 1.7202-02-2023 CVSS Scores: | CVE | CVSS Vector | Base Score | |...

HPESBHF04417 rev.1 - Certain HPE ProLiant Servers using Certain Intel Processor, INTEL-SA-00738, 2023.1 IPU – Intel Xeon Processor Advisory, Local Escalation of Privilege

Potential Security Impact: Local: Escalation of Privilege SUPPORTED SOFTWARE VERSIONS: ONLY impacted versions are listed. HPE ProLiant DL360 Gen10 Plus server -prior to 1.7202-02-2023 HPE ProLiant DL380 Gen10 Plus server -prior to 1.7202-02-2023 HPE ProLiant DL110 Gen10 Plus Telco server -prior t...

ManageEngine ADSelfService Plus Unauthenticated SAML Remote Code Execution Exploit

This Metasploit module exploits an unauthenticated remote code execution vulnerability that affects Zoho ManageEngine AdSelfService Plus versions 6210 and below. Due to a dependency to an outdated library Apache Santuario version 1.4.1, it is possible to execute arbitrary code by providing a...

CVE-2023-24347

D-Link N300 WI-FI Router DIR-605L v2.13B01 was discovered to contain a stack overflow via the webpage parameter at /goform/formSetWanDhcpplus...

ManageEngine ServiceDesk Plus MSP Unauthenticated RCE (CVE-2022-47966)

Binary data manageengineservicedeskmspcve-2022-47966.nbin...

ManageEngine ADSelfService Plus Unauthenticated SAML Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'ManageEngine ADSelfService Plus Unauthenticated SAML RCE', 'Description' = %q This exploits an unauthenticated remote code execution vulnerabilit...

Zoho ManageEngine ServiceDesk Plus 14003 Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'ManageEngine ServiceDesk Plus Unauthenticated SAML RCE', 'Description' = %q This exploits an unauthenticated remote code execution vulnerability...

Zoho ManageEngine ServiceDesk Plus 14003 Remote Code Execution Exploit

This Metasploit module exploits an unauthenticated remote code execution vulnerability that affects Zoho ManageEngine ServiceDesk Plus versions 14003 and below CVE-2022-47966. Due to a dependency to an outdated library Apache Santuario version 1.4.1, it is possible to execute arbitrary code by...