CVE-2024-7601 Logsign Unified SecOps Platform Directory data_export_delete_all Traversal Arbitrary File Deletion Vulnerability

Logsign Unified SecOps Platform Directory dataexportdeleteall Traversal Arbitrary File Deletion Vulnerability. This vulnerability allows remote attackers to delete arbitrary files on affected installations of Logsign Unified SecOps Platform. Authentication is required to exploit this vulnerabilit...

Improper Privilege Management

github.com/kanisterio/kanister is vulnerable to Improper Privilege Management. The vulnerability is due to the edit ClusterRole having overly permissive permissions, including create, patch, and update verbs for daemonset resources, create verb for serviceaccount/token resources. An attacker can...

PT-2024-29679 · Wi Fi Alliance +1 · Wfa Dut +2

Name of the Vulnerable Software and Affected Versions: Wi-Fi Alliance wfa dut in Wi-Fi Test Suite versions 9.0.0 and earlier Description: The issue allows OS command injection via 802.11x frames because the system library function is used. For example, on Arcadyan FMIMG51AX000J devices, this lead...

cups: Cupsd Listen arbitrary chmod 0140777

A flaw was found in the cupsd server. When starting the cupsd server with a Listen configuration item pointing to a symbolic link, the cupsd process can perform an arbitrary chmod of the provided argument, providing world-writable access to the target. Since cupsd is often running as root, this...

Exploit for Path Traversal in Synacor Zimbra_Collaboration_Suite

CVE-2022-27925 Description On May 10, 2022, Zimbra released...

PT-2024-30084 · Linksys · Linksys E1500

Name of the Vulnerable Software and Affected Versions: Linksys E1500 version 1.0.06.001 Description: A Command Injection vulnerability exists in the do upgrade post function of the httpd binary. As a result, an authenticated attacker can execute OS commands with root privileges. This could...

CVE-2024-42639

H3C GR1100-P v100R009 was discovered to use a hardcoded password in /etc/shadow, which allows attackers to log in as root...

CVE-2024-42638

H3C Magic B1ST v100R012 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root...

CVE-2024-42637

H3C R3010 v100R002L02 was discovered to contain a hardcoded password vulnerability in /etc/shadow, which allows attackers to log in as root...

CVE-2024-42634

A Command Injection vulnerability exists in formWriteFacMac of the httpd binary in Tenda AC9 v15.03.06.42. As a result, attacker can execute OS commands with root privileges...

SUSE CVE-2024-7589

A signal handler in sshd8 may call a logging function that is not async-signal-safe. The signal handler is invoked when a client does not authenticate within the LoginGraceTime seconds 120 by default. This signal handler executes in the context of the sshd8's privileged code, which is not sandbox...

H3C Magic B1ST 安全漏洞

The H3C Magic B1ST is a series of wireless routers from China's Xinhua San H3C. A security vulnerability exists in the H3C Magic B1ST v100R012 version, which stems from a hard-coded password vulnerability in /etc/shadow that allows an attacker to log in as root...

CVE-2024-42639

H3C GR1100-P v100R009 was discovered to use a hardcoded password in /etc/shadow, which allows attackers to log in as root...

PT-2024-30087 · H3C · H3C R3010

Name of the Vulnerable Software and Affected Versions: H3C R3010 version v100R002L02 Description: A hardcoded password vulnerability was discovered in /etc/shadow, allowing attackers to log in as root. This issue affects the H3C R3010 device, potentially allowing unauthorized access...

CVE-2022-27486

A improper neutralization of special elements used in an os command 'os command injection' in Fortinet FortiDDoS version 5.5.0 through 5.5.1, 5.4.2 through 5.4.0, 5.3.0 through 5.3.1, 5.2.0, 5.1.0, 5.0.0, 4.7.0, 4.6.0 and 4.5.0 and FortiDDoS-F version 6.3.0 through 6.3.1, 6.2.0 through 6.2.2, 6.1...

CVE-2022-27486

A improper neutralization of special elements used in an os command 'os command injection' in Fortinet FortiDDoS version 5.5.0 through 5.5.1, 5.4.2 through 5.4.0, 5.3.0 through 5.3.1, 5.2.0, 5.1.0, 5.0.0, 4.7.0, 4.6.0 and 4.5.0 and FortiDDoS-F version 6.3.0 through 6.3.1, 6.2.0 through 6.2.2, 6.1...

CVE-2022-27486

The issue CVE-2022-27486 affects Fortinet FortiDDoS and FortiDDoS-F CLI, where an improper neutralization of elements in an OS command enables an authenticated attacker to execute shell code as root via the execute command. Affected: FortiDDoS versions 4.5.0–5.5.1; FortiDDoS-F versions 6.1.0–6.3....

The vulnerability of the command-line interface (CLI) of the Junos OS Evolved routers from the PTX Series, ACX Series, and QFX Series allows for an increase in privileges to the root level.

The vulnerability of the command-line interface CLI of Junos OS Evolved routers from the PTX Series, ACX Series, and QFX Series exists due to the lack of measures taken to neutralize special elements used in operating system commands. Exploiting this vulnerability can allow attackers to elevate...

CVE-2024-7589

A signal handler in sshd8 may call a logging function that is not async-signal-safe. The signal handler is invoked when a client does not authenticate within the LoginGraceTime seconds 120 by default. This signal handler executes in the context of the sshd8's privileged code, which is not sandbox...

Industrial Remote Access Tool Ewon Cosy+ Vulnerable to Root Access Attacks

Security vulnerabilities have been disclosed in the industrial remote access solution Ewon Cosy+ that could be abused to gain root privileges to the devices and stage follow-on attacks. The elevated access could then be weaponized to decrypt encrypted firmware files and encrypted data such as...