CVE-2020-18875

Incorrect Access Control in DotCMS versions before 5.1 allows remote attackers to gain privileges by injecting client configurations via vtl velocity files...

The vulnerability in the J-Web web interface of the Junos operating system, which allows a hacker to elevate their privileges to the root level.

The vulnerability in the J-Web web interface of the Junos operating system exists due to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to elevate their privileges to the root level...

The vulnerability in the implementation of the /app/system/column/admin/index.class.php script of the Metinfo CMS system allows a perpetrator to increase their privileges.

The vulnerability of the /app/system/column/admin/index.class.php implementation in the Metinfo CMS system is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to enhance their privileges remotely...

Pulse Secure Pulse Connect Secure 路径遍历漏洞

Pulse Secure Pulse Connect Secure aka PCS, formerly known as Juniper Junos Pulse is an SSL VPN solution from Pulse Secure, Inc. in the United States. Pulse Connect Secure suffers from a path traversal vulnerability that originates from an input validation error when processing a directory travers...

CVE-2021-29736

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote user to gain elevated privileges on the system. IBM X-Force ID: 201300...

16-Year-Old Security Bug Affects Millions of HP, Samsung, Xerox Printers

Details have emerged about a high severity security vulnerability affecting a software driver used in HP, Xerox, and Samsung printers that has remained undetected since 2005. Tracked as CVE-2021-3438 CVSS score: 8.8, the issue concerns a buffer overflow in a print driver installer package named...

CVE-2021-35965

The Orca HCM digital learning platform uses a weak factory default administrator password, which is hard-coded in the source code of the webpage in plain text, thus remote attackers can obtain administrator’s privilege without logging in...

The vulnerability of the Cisco Business Process Automation software lies in improper configuration of authentication for management commands and access settings to action logs, allowing attackers to escalate their privileges.

The vulnerability of the Cisco Business Process Automation software relates to incorrect authentication settings for control commands and incorrect access settings to action logs. Exploiting this vulnerability could allow a malicious actor to enhance their privileges by sending specially crafted...

PT-2021-5683 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: The issue is related to a security feature bypass in the Local Security Authority LSA of Microsoft Windows operating systems, stemming from weaknesses in the authorization mechanism. This...

PT-2021-5657 · Microsoft · Office +1

Name of the Vulnerable Software and Affected Versions: Microsoft Office affected versions not specified Microsoft 365 Apps for Enterprise affected versions not specified Description: The issue is related to a security feature bypass in Microsoft Office, which can be exploited by a remote attacker...

PT-2021-6026 · Microsoft · Exchange Server

Name of the Vulnerable Software and Affected Versions: Microsoft Exchange Server affected versions not specified Description: The issue is related to insufficient access controls in Microsoft Exchange Server, which can be exploited by a remote attacker to elevate their privileges. Recommendations...

PT-2021-5688 · Microsoft · Windows Ad Fs +1

Name of the Vulnerable Software and Affected Versions: Windows AD FS affected versions not specified Description: The issue is related to errors in security settings, allowing a remote attacker to bypass security restrictions and elevate their privileges. This security-feature bypass vulnerabilit...

CVE-2021-32523

Improper authorization vulnerability in QSAN Storage Manager allows remote privileged users to bypass the access control and execute arbitrary commands. Suggest contacting with QSAN and refer to recommendations in QSAN Document...

PT-2021-3492 · Cisco · Cisco Business Process Automation

Name of the Vulnerable Software and Affected Versions: Cisco Business Process Automation affected versions not specified Description: The issue is related to improper authorization enforcement in the web-based management interface, allowing an authenticated, remote attacker to elevate privileges ...

Microsoft Edge browser’s vulnerability, related to insecure management of privileges, allows attackers to elevate their privileges.

The vulnerability of Microsoft Edge relates to the insecure management of privileges. Exploiting this vulnerability can allow a malicious actor to enhance their privileges remotely...

The vulnerability of the distributed database management system Apache Impala, related to errors in information encryption, allows attackers to increase their privileges.

The vulnerability of the distributed database management system Apache Impala is related to errors in information encryption. Exploiting this vulnerability can allow an attacker to enhance their privileges remotely...

PT-2021-3459 · Microsoft · Edge

Name of the Vulnerable Software and Affected Versions: Microsoft Edge Chromium-based affected versions not specified Description: The issue is related to security mechanism shortcomings in Microsoft Edge, allowing a remote attacker to potentially elevate their privileges. Recommendations: At the...

The vulnerability of the cron/cmd_subsys.php implementation of the software for monitoring IT infrastructure by Nagios Fusion allows a perpetrator to escalate their privileges.

The vulnerability of the cron/cmdsubsys.php implementation of the Nagios Fusion IT infrastructure monitoring software is related to insufficient cleaning of input data. Exploiting this vulnerability can allow a malicious actor to increase their privileges remotely...

Vulnerability fixed in Xerox printer drivers

Xerox has fixed a vulnerability in its printer driver for Windows. A remote malicious person could, by exploiting of this vulnerability obtain elevated privileges on the vulnerable system. Few substantive details about the vulnerability have been made publicly available. Xerox has released update...

PT-2021-3379 · Linux +3 · Xen-Netback +3

Name of the Vulnerable Software and Affected Versions: Linux xen-netback affected versions not specified Description: A use-after-free issue exists in Linux xen-netback due to insufficient input validation. This can be triggered by a malicious or buggy network PV frontend sending a malformed...