PT-2022-34958 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v6.0.6 Description: The issue concerns a fix for writes in a read-only memory region in the cpufreq qcom driver. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux...

kernel: missing DM_TARGET_IMMUTABLE feature flag in verity_target in drivers/md/dm-verity-target.c

A flaw was found in the Linux kernel, where it is possible to modify read-only files due to a missing permission check. This flaw can lead to local privilege escalation...

PT-2022-6531 · Google +4 · Android Kernel +4

Name of the Vulnerable Software and Affected Versions: Android kernel Description: The issue is related to a missing permission check in the verity target of dm-verity-target.c, which could allow modification of read-only files. This could lead to local escalation of privilege with System executi...

CVE-2022-38380

An improper access control CWE-284 vulnerability in FortiOS version 7.2.0 and versions 7.0.0 through 7.0.7 may allow a remote authenticated read-only user to modify the interface settings via the API...

PT-2022-6667 · Cisco · Cisco Secure Workload

Name of the Vulnerable Software and Affected Versions: Cisco Secure Workload affected versions not specified Description: A vulnerability in the OpenAPI of Cisco Secure Workload could allow an authenticated, remote attacker with the privileges of a read-only user to execute operations that should...

Hardening of TypedArrays with non-canonical numeric property names in SES

Impact What kind of vulnerability is it? Who is impacted? In Hardened JavaScript, programs can harden objects to safely share objects with co-tenant programs without risk of these other programs tampering with their API surface. Hardening does not guarantee that objects are pure or immutable, so ...

GHSA-WHPX-Q3RQ-W8JC Hardening of TypedArrays with non-canonical numeric property names in SES

Impact What kind of vulnerability is it? Who is impacted? In Hardened JavaScript, programs can harden objects to safely share objects with co-tenant programs without risk of these other programs tampering with their API surface. Hardening does not guarantee that objects are pure or immutable, so ...

CVE-2022-38743

Rockwell Automation FactoryTalk VantagePoint versions 8.0, 8.10, 8.20, 8.30, 8.31 are vulnerable to an improper access control vulnerability. The FactoryTalk VantagePoint SQL Server account could allow a malicious user with read-only privileges to execute SQL statements in the back-end database. ...

Improper access control

Rockwell Automation FactoryTalk VantagePoint versions 8.0, 8.10, 8.20, 8.30, 8.31 are vulnerable to an improper access control vulnerability. The FactoryTalk VantagePoint SQL Server account could allow a malicious user with read-only privileges to execute SQL statements in the back-end database. ...

Linux Kernel Competition Condition Issue Vulnerability (CNVD-2022-74088)

Linux Kernel is the kernel used by the Linux Foundation's open source operating system, Linux. Linux Kernel is vulnerable to a contention condition issue. The vulnerability stems from a copy-on-write COW corruption in the memory subsystem's handling of private read-only shared memory maps. A loca...

Exploit for Improper Authentication in Fortinet Fortiproxy

CVE-2022-40684 CVE-2022-40684 - Auth bypass extract admin u...

CVE-2022-20810

A vulnerability in the Simple Network Management Protocol SNMP of Cisco IOS XE Wireless Controller Software for the Catalyst 9000 Family could allow an authenticated, remote attacker to access sensitive information. This vulnerability is due to insufficient restrictions that allow a sensitive...

PT-2022-6085 · Cisco · Cisco Ios Xe Wireless Controller +1

Name of the Vulnerable Software and Affected Versions: Cisco IOS XE Wireless Controller Software for the Catalyst 9000 Family affected versions not specified Description: A vulnerability in the Simple Network Management Protocol SNMP could allow an authenticated, remote attacker to access sensiti...

PT-2022-25554 · Zammad · Zammad

Name of the Vulnerable Software and Affected Versions: Zammad versions 5.2.1 Description: The issue concerns a fine-grained permission model in Zammad that allows configuration of read-only access to tickets. However, agents were still able to perform certain operations on these tickets, such as...

Zammad 安全漏洞

Zammad is a suite of ticket management software from the German company Zammad. A security vulnerability exists in Zammad version 5.2.1, which stems from a fine-grained permission model that allows configuring read-only access to work orders, however, agents are still able to incorrectly perform...

Security Bulletin: IBM Workload Deployer - Security vulnerability found in the command-line interface (CVE-2013-5455)

Abstract A security vulnerability found in the command-line interface allows users with read-only rights to delete, start, and stop any virtual system. Content Authenticated users of IBM Workload Deployer 3.1.0.0 and later with lesser privilege roles can use the command-line interface to perform...

CVE-2021-39190 SCCM plugin for GLPI vulnerable to Exposure of Sensitive Information to an Unauthorized Actor

The SCCM plugin for GLPI is a plugin to synchronize computers from SCCM version 1802 to GLPI. In versions prior to 2.3.0, the Configuration page is publicly accessible in read-only mode. This issue is patched in version 2.3.0. No known workarounds exist...

PT-2022-10890 · Glpi · Sccm Plugin For Glpi

Name of the Vulnerable Software and Affected Versions: SCCM plugin for GLPI versions prior to 2.3.0 Description: The SCCM plugin for GLPI has an issue where the Configuration page is publicly accessible in read-only mode in versions prior to 2.3.0. This issue is patched in version 2.3.0...

GLPI 信息泄露漏洞

GLPI is an open source IT and asset management software for individual developers. The software provides a full-featured IT resource management interface that you can use to build databases to fully manage IT computers, monitors, servers, printers, network devices, phones, and even toner cartridg...

Elrond-go has improper initialization

Impact Read only calls between contracts can generate smart contracts results. For example, if contract A calls in read only mode contract B and the called function will make changes upon the contract's B state, the state will be altered for contract B as if the call was not made in the read-only...