CVE-2023-43506

A vulnerability in the ClearPass OnGuard Linux agent could allow malicious users on a Linux instance to elevate their user privileges to those of a higher role. A successful exploit allows malicious users to execute arbitrary code with root level privileges on the Linux instance...

CVE-2023-26578

Arbitrary file upload to web root in the IDAttend’s IDWeb application 3.1.013 allows authenticated attackers to upload dangerous files to web root such as ASP or ASPX, gaining command execution on the affected server...

PT-2023-8356 · Apple · Apple Macos

Name of the Vulnerable Software and Affected Versions: macOS versions prior to 14.1 Description: The issue is related to errors in security settings of the Emoji component in the macOS operating system. An attacker may be able to execute arbitrary code as root from the Lock Screen. This is achiev...

Bosch ctrlX HMI Web Panel WR21 Security Vulnerability

Bosch ctrlX HMI Web Panel WR21 is an HMI panel from Bosch Germany. A security vulnerability exists in Bosch ctrlX HMI Web Panel WR21, which originated from a vulnerability that allows a low-privileged attacker to gain root privileges by modifying critical system properties and exposing the ADB...

Bosch ctrlX HMI Web Panel WR21 Access Control Error Vulnerability

Bosch ctrlX HMI Web Panel WR21 is an HMI panel from Bosch Germany. A security vulnerability exists in the Bosch ctrlX HMI Web Panel WR21 version that originates from a vulnerability that allows an unprivileged attacker with privileged access to the TPC-110W device subnet to gain root privileges a...

Apple macOS Security Breach

Apple macOS is a proprietary operating system developed by Apple Inc. for Mac computers. A security vulnerability exists in Apple macOS Sonoma version 14.1, which originates from the fact that an attacker may be able to execute arbitrary code from the lock screen as root...

PT-2023-28849 · Aruba Networks · Clearpass Onguard +1

Name of the Vulnerable Software and Affected Versions: Aruba Networks ClearPass Policy Manager affected versions not specified Description: A vulnerability in the ClearPass OnGuard Linux agent could allow malicious users on a Linux instance to elevate their user privileges to those of a higher...

Zscaler Client Connector Code Issue Vulnerability

Zscaler Client Connector is an application from zscaler. An application that is installed on a device to ensure that Internet traffic and access to an organization's internal applications are secure and in compliance with the organization's policies, even when not on the corporate network. A...

The vulnerability in the web interface of the Cisco IOS XE operating system allows a perpetrator to execute arbitrary commands on a device with root privileges.

The vulnerability of the Cisco IOS XE operating system’s web interface is related to errors in privilege management. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands on a device with root privileges remotely...

OESA-2023-1756 samba security update

Samba is a suite of programs for Linux and Unix to interoperate with Windows. Security Fixes: A path traversal vulnerability was identified in Samba when processing client pipe names connecting to Unix domain sockets within a private directory. Samba typically uses this mechanism to connect SMB...

CVE-2023-34045

VMware Fusion13.x prior to 13.5 contains a local privilege escalation vulnerability that occurs during installation for the first time the user needs to drag or copy the application to a folder from the '.dmg' volume or when installing an upgrade. A malicious actor with local non-administrative...

CVE-2023-34046

VMware Fusion13.x prior to 13.5 contains a TOCTOU Time-of-check Time-of-use vulnerability that occurs during installation for the first time the user needs to drag or copy the application to a folder from the '.dmg' volume or when installing an upgrade. A malicious actor with local...

CVE-2023-34046 VMware Fusion TOCTOU local privilege escalation vulnerability

VMware Fusion13.x prior to 13.5 contains a TOCTOU Time-of-check Time-of-use vulnerability that occurs during installation for the first time the user needs to drag or copy the application to a folder from the '.dmg' volume or when installing an upgrade. A malicious actor with local...

An issue was discovered in lib/kobject.c in the Linux kernel before 6.2.3. With root access an attacker can trigger a race condition that results in a fill_kobj_path out-of-bounds write.

...

Ubuntu 16.04 ESM : OpenSMTPD vulnerabilities (USN-4875-1)

The remote Ubuntu 16.04 ESM host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-4875-1 advisory. It was discovered that OpenSMTPD incorrectly verified the sender's or receiver's e-mail addresses under certain conditions. An attacker could possibly us...

Security Vulnerabilities in Some D-Link Products

The D-Link DSL-2730U is a router from China-based AUO D-Link. A security vulnerability exists in the D-Link DSL-2730U and DSL-2750U that stems from the UART/serial interface on the PCB providing logging output and root privilege termination without proper access control...

PT-2023-6407 · D Link · Dsl-2750U +1

Name of the Vulnerable Software and Affected Versions: D-Link Non-US DSL-2750U N300 ADSL2+ and Non-US DSL-2730U N150 ADSL2+ affected versions not specified Description: The issue is related to Incorrect Access Control in the D-Link routers. The UART/Serial interface on the PCB provides log output...

Nutanix AHV : Multiple Vulnerabilities (NXSA-AHV-20220304.10055)

The version of AHV installed on the remote host is prior to 20220304.10055. It is, therefore, affected by multiple vulnerabilities as referenced in the NXSA-AHV-20220304.10055 advisory. - BIND 9.11.0 - 9.11.36 9.12.0 - 9.16.26 9.17.0 - 9.18.0 BIND Supported Preview Editions: 9.11.4-S1 - 9.11.36-S...

CVE-2023-20198

Cisco is providing an update for the ongoing investigation into observed exploitation of the web UI feature in Cisco IOS XE Software. We are updating the list of fixed releases and adding the Software Checker. Our investigation has determined that the actors exploited two previously unknown issue...

Multiple Vulnerabilities in South River Technologies Titan MFT and Titan SFTP [FIXED]

As part of our continuing research project into managed file transfer risk, including JSCAPE MFT and Fortra Globalscape EFT Server, Rapid7 discovered several vulnerabilities in South River Technologies’ Titan MFT and Titan SFTP servers. Although these require unusual circumstances or non-default...