PT-2021-7631 · Microsoft · Edge For Android

Name of the Vulnerable Software and Affected Versions: Microsoft Edge for Android affected versions not specified Description: The issue is related to insecure privilege management in Microsoft Edge for Android. Exploitation of this issue may allow a remote attacker to elevate their privileges...

The vulnerability of microprogrammed software in industrial modems of the OnCell G3470A-LTE Series and WDR-3124A Series, as well as in microprogrammed software for Wi-Fi routers of the TAP-323 Series, WAC-1001 Series, and WAC-2004 Series, arises from the use of non-unique X.509 certificates and host SSH keys. This vulnerability allows attackers to escalate their privileges.

The vulnerabilities of microprogrammed software in industrial modems of the OnCell G3470A-LTE Series, WDR-3124A Series, microprogrammed software in Wi-Fi routers of the TAP-323 Series, WAC-1001 Series, and WAC-2004 Series are related to the use of non-unique X.509 certificates and host SSH keys...

The vulnerability of microprogrammed software in industrial modems of the OnCell G3470A-LTE Series and WDR-3124A Series, as well as in microprogrammed software for Wi-Fi routers of the TAP-323 Series, WAC-1001 Series, and WAC-2004 Series, arises from the lack of measures taken to neutralize special elements used in operating systems. This allows attackers to enhance their privileges.

The vulnerabilities of microprogrammed software in industrial modems of the OnCell G3470A-LTE Series, WDR-3124A Series, microprogrammed software in Wi-Fi routers of the TAP-323 Series, WAC-1001 Series, and WAC-2004 Series are related to the lack of measures taken to neutralize special elements us...

The vulnerability of microprogrammed software in industrial modems of the OnCell G3470A-LTE Series, WDR-3124A Series, microprogrammed software in Wi-Fi routers of the TAP-323 Series, WAC-1001 Series, and WAC-2004 Series lies in the use of rigidly encrypted account data, which allows attackers to escalate their privileges.

The vulnerability of microprogrammed software in industrial modems of the OnCell G3470A-LTE Series, WDR-3124A Series, microprogrammed software in Wi-Fi routers of the TAP-323 Series, WAC-1001 Series, and WAC-2004 Series is related to the use of rigidly encrypted login credentials. Exploiting this...

The vulnerability of the software for power monitoring systems such as Power Monitoring Expert, EcoStruxure Energy Expert, Power Manager, data collection systems, and industrial automation control systems like StruxureWare PowerSCADA Expert, related to access control deficiencies, allows attackers to exploit these vulnerabilities to gain increased privileges.

The vulnerabilities of the Power Monitoring Expert, EcoStruxure Energy Expert, Power Manager software, as well as systems for data collection and process control in industrial automation, such as StruxureWare PowerSCADA Expert, are related to lack of access control mechanisms. Exploiting these...

The vulnerability of the AuthFilter component in the Nacos software platform allows attackers to increase their privileges.

The vulnerability of the AuthFilter component in the Nacos software platform involves bypassing authentication through spoofing. Exploiting this vulnerability allows a malicious actor to enhance their privileges remotely...

CVE-2020-18875

Incorrect Access Control in DotCMS versions before 5.1 allows remote attackers to gain privileges by injecting client configurations via vtl velocity files...

The vulnerability in the J-Web web interface of the Junos operating system, which allows a hacker to elevate their privileges to the root level.

The vulnerability in the J-Web web interface of the Junos operating system exists due to insufficient validation of input data. Exploiting this vulnerability can allow a malicious actor, operating remotely, to elevate their privileges to the root level...

The vulnerability in the implementation of the /app/system/column/admin/index.class.php script of the Metinfo CMS system allows a perpetrator to increase their privileges.

The vulnerability of the /app/system/column/admin/index.class.php implementation in the Metinfo CMS system is related to deficiencies in access control. Exploiting this vulnerability could allow a malicious actor to enhance their privileges remotely...

Pulse Secure Pulse Connect Secure 路径遍历漏洞

Pulse Secure Pulse Connect Secure aka PCS, formerly known as Juniper Junos Pulse is an SSL VPN solution from Pulse Secure, Inc. in the United States. Pulse Connect Secure suffers from a path traversal vulnerability that originates from an input validation error when processing a directory travers...

CVE-2021-29736

IBM WebSphere Application Server 7.0, 8.0, 8.5, and 9.0 could allow a remote user to gain elevated privileges on the system. IBM X-Force ID: 201300...

16-Year-Old Security Bug Affects Millions of HP, Samsung, Xerox Printers

Details have emerged about a high severity security vulnerability affecting a software driver used in HP, Xerox, and Samsung printers that has remained undetected since 2005. Tracked as CVE-2021-3438 CVSS score: 8.8, the issue concerns a buffer overflow in a print driver installer package named...

CVE-2021-35965

The Orca HCM digital learning platform uses a weak factory default administrator password, which is hard-coded in the source code of the webpage in plain text, thus remote attackers can obtain administrator’s privilege without logging in...

PT-2021-6026 · Microsoft · Exchange Server

Name of the Vulnerable Software and Affected Versions: Microsoft Exchange Server affected versions not specified Description: The issue is related to insufficient access controls in Microsoft Exchange Server, which can be exploited by a remote attacker to elevate their privileges. Recommendations...

PT-2021-5657 · Microsoft · Office +1

Name of the Vulnerable Software and Affected Versions: Microsoft Office affected versions not specified Microsoft 365 Apps for Enterprise affected versions not specified Description: The issue is related to a security feature bypass in Microsoft Office, which can be exploited by a remote attacker...

PT-2021-5688 · Microsoft · Windows Ad Fs +1

Name of the Vulnerable Software and Affected Versions: Windows AD FS affected versions not specified Description: The issue is related to errors in security settings, allowing a remote attacker to bypass security restrictions and elevate their privileges. This security-feature bypass vulnerabilit...

PT-2021-5683 · Microsoft · Windows

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: The issue is related to a security feature bypass in the Local Security Authority LSA of Microsoft Windows operating systems, stemming from weaknesses in the authorization mechanism. This...

The vulnerability of the Cisco Business Process Automation software lies in improper configuration of authentication for management commands and access settings to action logs, allowing attackers to escalate their privileges.

The vulnerability of the Cisco Business Process Automation software relates to incorrect authentication settings for control commands and incorrect access settings to action logs. Exploiting this vulnerability could allow a malicious actor to enhance their privileges by sending specially crafted...

CVE-2021-32523

Improper authorization vulnerability in QSAN Storage Manager allows remote privileged users to bypass the access control and execute arbitrary commands. Suggest contacting with QSAN and refer to recommendations in QSAN Document...

PT-2021-3492 · Cisco · Cisco Business Process Automation

Name of the Vulnerable Software and Affected Versions: Cisco Business Process Automation affected versions not specified Description: The issue is related to improper authorization enforcement in the web-based management interface, allowing an authenticated, remote attacker to elevate privileges ...