CVE-2017-5142: Improper Privilege Management

An issue was discovered in Honeywell XL Web II controller XL1000C500 XLWebExe-2-01-00 and prior, and XLWeb 500 XLWebExe-1-02-08 and prior. A user with low privileges is able to open and change the parameters by accessing a specific URL because of Improper Privilege Management...

PT-2017-16338

Name of the Vulnerable Software and Affected Versions Honeywell XL Web II controller XL1000C500 versions XLWebExe-2-01-00 and prior Honeywell XLWeb 500 versions XLWebExe-1-02-08 and prior Description The issue is related to improper privilege management, allowing a user with low privileges to...

CVE-2017-5572: Improper Privilege Management

An issue was discovered in Linux Foundation xapi in Citrix XenServer through 7.0. An authenticated read-only administrator can corrupt the host database...

CVE-2017-3257: Improper Privilege Management

Vulnerability in the MySQL Server component of Oracle MySQL subcomponent: Server: InnoDB. Supported versions that are affected are 5.6.34 and earlier5.7.16 and earlier. Easily exploitable vulnerability allows low privileged attacker with network access via multiple protocols to compromise MySQL...

PT-2016-3430 · Siemens · Siplus Net Cp 1543-1 +1

Name of the Vulnerable Software and Affected Versions: Siemens SIMATIC CP 1543-1 versions prior to V2.0.28 SIPLUS NET CP 1543-1 versions prior to V2.0.28 Description: A vulnerability has been identified in the software, related to improper privilege management and insufficient input validation...

ManageEngine ServiceDesk Plus 9.2 Build 9207 Information Disclosure

Title: ManageEngine ServiceDesk Plus Low Privileged User View All Tickets Date: 18 October 2016 Author: p0z Vendor: ManageEngine Vendor Homepage: https://www.manageengine.com/ Product: ServiceDesk Plus Version: 9.2 Build 9207 Other versions could also be affected Fixed Version: 9.2 Build 9228...

ManageEngine ServiceDesk Plus 9.2 Build 9207 Information Disclosure Vulnerability

Exploit for jsp platform in category web applications Title: ManageEngine ServiceDesk Plus Low Privileged User View All Tickets Date: 18 October 2016 Author: p0z Vendor: ManageEngine Vendor Homepage: https://www.manageengine.com/ Product: ServiceDesk Plus Version: 9.2 Build 9207 Other versions...

CVE-2016-2067: Improper Privilege Management

drivers/gpu/msm/kgsl.c in the MSM graphics driver aka GPU driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center QuIC Android contributions for MSM devices and other products, mishandles the KGSLMEMFLAGSGPUREADONLY flag, which allows attackers to gain privileges by leveraging...

Environmental Systems Corporation Data Controllers Vulnerabilities (Update B)

OVERVIEW This updated advisory is a follow-up to the updated advisory titled ICSA-16-147-01A Environmental Systems Corporation Data Controllers Vulnerabilities that was published June 2, 2016, on the NCCIC/ICS-CERT web site. Independent researcher Maxim Rupp has identified data controller...

CVE-2016-2059: Improper Privilege Management

The msmipcrouterbindcontrolport function in net/ipcrouter/ipcroutercore.c in the IPC router kernel module for the Linux kernel 3.x, as used in Qualcomm Innovation Center QuIC Android contributions for MSM devices and other products, does not verify that a port is a client port, which allows...

CVE-2016-1575: Improper Privilege Management

The overlayfs implementation in the Linux kernel through 4.5.2 does not properly maintain POSIX ACL xattr data, which allows local users to gain privileges by leveraging a group-writable setgid directory...

GE Proficy HMI SCADA CIMPLICITY Privilege Management Vulnerability

OVERVIEW Zhou Yu of Acorn Network Security identified an improper privilege management vulnerability and recently released exploit code for the GE Proficy HMI/SCADA CIMPLICITY application without coordination with ICS-CERT, the vendor, or any other coordinating entity known to ICS-CERT. GE produc...

Environmental Systems Corporation Data Controllers Vulnerabilities

OVERVIEW This updated advisory is a follow-up to the updated advisory titled ICSA-16-147-01A Environmental Systems Corporation Data Controllers Vulnerabilities that was published June 2, 2016, on the NCCIC/ICS-CERT web site. Independent researcher Maxim Rupp has identified data controller...

PT-2016-3307

Name of the Vulnerable Software and Affected Versions IBM Installation Manager versions prior to 1.7.4.4 IBM Installation Manager versions 1.8.x prior to 1.8.4 Packaging Utility versions prior to 1.7.4.4 Packaging Utility versions 1.8.x prior to 1.8.4 Description The issue is related to errors in...

Moderate: Red Hat Security Advisory: sudo security, bug fix, and enhancement update

Updated sudo packages that fix one security issue, three bugs, and add one enhancement are now available for Red Hat Enterprise Linux 6. Red Hat Product Security has rated this update as having Moderate security impact. A Common Vulnerability Scoring System CVSS base score, which gives a detailed...

CVE-2015-5106: Improper Privilege Management

Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allow attackers to bypass intended access restrictions and perform a transition...

CVE-2015-5090: Improper Privilege Management

Adobe Reader and Acrobat 10.x before 10.1.15 and 11.x before 11.0.12, Acrobat and Acrobat Reader DC Classic before 2015.006.30060, and Acrobat and Acrobat Reader DC Continuous before 2015.008.20082 on Windows and OS X allow attackers to bypass intended access restrictions and perform a transition...

PT-2015-3402

Name of the Vulnerable Software and Affected Versions OpenSSH versions prior to 6.9 Description The issue is related to the x11 open helper function in channels.c in ssh, which lacks a check of the refusal deadline for X connections when ForwardX11Trusted mode is not used. This makes it easier fo...

PT-2015-3389

Name of the Vulnerable Software and Affected Versions Secret Net and Secret Net Studio affected versions not specified Description The issue is related to errors in privilege management in the kernel driver sncc0.sys of the Secret Net and Secret Net Studio information protection systems...

CVE-2014-9644: Improper Privilege Management

The Crypto API in the Linux kernel before 3.18.5 allows local users to load arbitrary kernel modules via a bind system call for an AFALG socket with a parenthesized module template expression in the salgname field, as demonstrated by the vfataes expression, a different vulnerability than...