CVE-2022-1287

A vulnerability classified as critical was found in School Club Application System 1.0. This vulnerability affects a request to the file /scas/classes/Users.php?f=saveuser. The manipulation with a POST request leads to privilege escalation. The attack can be initiated remotely and does not requir...

PT-2022-7301 · Async +2 · Async +2

Name of the Vulnerable Software and Affected Versions: Async versions 2.x through 2.6.3 Async versions 3.x through 3.2.1 Description: The issue is related to the mapValues function in the Async library, which is used for working with asynchronous JavaScript. It involves the incorrect control of...

The vulnerability of the application deployment automation tool in Kubernetes ArgoCD, related to access control deficiencies, allows a perpetrator to increase their privileges.

The vulnerability of the application deployment automation tool in Kubernetes ArgoCD is related to lack of access control. Exploiting this vulnerability can allow a malicious actor to enhance their privileges remotely...

Vulnerability of the Cluster component: The general system for managing MySQL Cluster databases, which allows attackers to increase their privileges.

Vulnerability of the MySQL Cluster component: General database management system vulnerabilities in MySQL Cluster exist due to insufficient validation of input data. Exploiting this vulnerability can allow attackers to increase their privileges remotely...

Google Android Elevation of Privilege Vulnerability (CNVD-2022-42141)

Google Android is a Linux-based open-source operating system from the US company Google. Google Android has an elevation of privilege vulnerability that can be exploited by attackers to remotely elevate privileges...

The vulnerability in the application programming interface for data exchange via Web Share browsers like Google Chrome and Microsoft Edge allows a perpetrator to escalate their privileges.

The vulnerability of the application programming interface for data exchange via Web Share browsers like Google Chrome and Microsoft Edge is related to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to enhance their privileges remotely...

CVE-2021-39708

In gattprocessnotification of gattcl.cc, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions:...

The vulnerability of Microsoft SharePoint Server and SharePoint Enterprise Server lies in the insecure management of privileges, allowing attackers to escalate their privileges.

The vulnerability of Microsoft SharePoint Server and SharePoint Enterprise Server lies in the insecure management of privileges. Exploiting this vulnerability can allow a malicious actor to enhance their privileges remotely...

The vulnerability of the Windows Remote Access service in Windows operating systems allows attackers to exploit their privileges.

The vulnerability of the Windows Remote Access service in Windows operating systems is related to insecure management of privileges. Exploiting this vulnerability can allow a malicious actor to enhance their privileges remotely...

The vulnerability of the software platform for developing and managing online stores Magento Commerce arises from insufficient validation of input data. This allows attackers to escalate their privileges.

The vulnerability of the Magento Commerce software platform for developing and managing online stores exists due to insufficient verification of input data. Exploiting this vulnerability can allow a malicious actor to enhance their privileges remotely...

PT-2022-1885 · Microsoft · Azure Site Recovery

Name of the Vulnerable Software and Affected Versions: Azure Site Recovery affected versions not specified Description: The issue is related to insufficient protection of registration data, which can be exploited by a remote attacker to elevate their privileges. Recommendations: At the moment,...

PT-2022-1886 · Microsoft · Azure Site Recovery

Name of the Vulnerable Software and Affected Versions: Azure Site Recovery affected versions not specified Description: The issue is related to insufficient protection of registration data, which can be exploited by a remote attacker to elevate their privileges. Recommendations: At the moment,...

The vulnerability of the web interface of the server application for managing food industry businesses AK-EM 800 lies in the use of rigidly encrypted user accounts (users “admin”, “administrator”, “user”, and “guest”). This allows a perpetrator to increase their privileges.

The vulnerability of the web interface of the industrial management application AK-EM 800 relates to the use of rigidly encrypted user credentials users “admin”, “administrator”, “user”, and “guest”, with the default password being “danfoss”. Exploiting this vulnerability could allow an attacker ...

The vulnerability of microprogramming software in TP-Link TL-WA850RE V6 wireless signal amplifiers is related to the use of insufficiently random values, which allows intruders to enhance their privileges.

The vulnerability of the microprogramming software in TP-Link’s wireless signal amplifier TP-Link TL-WA850RE V6 is related to the use of insufficiently random values. Exploiting this vulnerability can allow a remote attacker to enhance their privileges...

EulerOS 2.0 SP3 : mailman (EulerOS-SA-2022-1177)

According to the versions of the mailman package installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - Cross-site request forgery CSRF vulnerability in the user options page in GNU Mailman 2.1.x before 2.1.23 allows remote attackers to hijack the...

Vmware Cloud Foundation 输入验证错误漏洞

Vmware VMware Cloud Foundation is an all-in-one hybrid cloud platform from Vmware. The platform includes features such as operations automation, infrastructure auto-configuration, and integrated lifecycle management. An input validation error vulnerability exists in Vmware Cloud Foundation, which...

Dropping Files on a Domain Controller Using CVE-2021-43893

On December 14, 2021, during the Log4Shell chaos, Microsoft published CVE-2021-43893, a remote privilege escalation vulnerability affecting the Windows Encrypted File System EFS. The vulnerability was credited to James Forshaw of Google Project Zero, but perhaps owing to the Log4Shell atmosphere,...

CVE-2021-39675

In GKIgetbuf of gkibuffer.cc, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID:...

Heap overflow

In GKIgetbuf of gkibuffer.cc, there is a possible out of bounds write due to a heap buffer overflow. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-12Android ID:...

CVE-2021-39675

CVE-2021-39675 affects Android 12, involving a heap buffer overflow in GKI_getbuf (gki_buffer.cc). The root cause is an out-of-bounds write in a heap buffer, which could enable remote escalation of privilege with no user interaction. The impact is elevated privileges with high confidentiality/int...