1305 matches found
CVE-2024-8807
CVE-2024-8807 : Cohesive Networks VNS3 has a command injection vulnerability in its web service (listening on port 8000 by default). The flaw stems from insufficient validation of a user-supplied string before it is used to execute a system call, allowing an attacker to run code with root privile...
The vulnerability of the corporate version of the GitHub Enterprise Server, related to the incorrect handling of symbolic links before accessing files, allows a violator to elevate their privileges to the root level.
The vulnerability of the corporate version of the GitHub Enterprise Server is related to the incorrect definition of symbolic links before accessing a file. Exploiting this vulnerability could allow an attacker to elevate their privileges to the root level...
xorg-x11-server: tigervnc: heap-based buffer overflow privilege escalation vulnerability
A flaw was found in the X.org server. Due to improperly tracked allocation size in XkbSetCompatMap, a local attacker may be able to trigger a buffer overflow condition via a specially crafted payload, leading to denial of service or local privilege escalation in distributions where the X.org serv...
CVE-2024-51721 Vulnerabilities in SecuSUITE Server Components Impact SecuSUITE
A code injection vulnerability in the SecuSUITE Server Web Administration Portal of SecuSUITE versions 5.0.420 and earlier could allow an attacker to potentially inject script commands or other executable content into the server that would run with root privilege...
CVE-2024-51721
CVE-2024-51721 : A code injection vulnerability affects the SecuSUITE Server Web Administration Portal in SecuSUITE versions up to 5.0.420. The issue allows an attacker to inject script commands or other executable content that would run with root privileges. Affected component is the Web Adminis...
CVE-2024-49406
Improper validation of integrity check value in Blockchain Keystore prior to version 1.3.16 allows local attackers to modify transaction. Root privilege is required for triggering this vulnerability...
CVE-2024-49406
CVE-2024-49406 affects Samsung’s Blockchain Keystore prior to 1.3.16. The issue is improper validation of the integrity check value, enabling a local attacker with root privileges to modify transactions. Products/versions: Blockchain Keystore before 1.3.16. Root privileges are required; attack ve...
CVE-2024-48336
CVE-2024-48336 affects Magisk App; the install() function in ProviderInstaller.java fails to verify the GMS app before loading it, permitting a local untrusted app to silently execute code in Magisk and escalate to root. Affected: Magisk App builds before Canary 27007. Root cause: loading code fr...
Mageia: Security Advisory (MGASA-2024-0335)
The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
MGASA-2024-0335 Updated oath-toolkit packages fix security vulnerability
pamoath.so in oath-toolkit 2.6.7 through 2.6.11 before 2.6.12 allows root privilege escalation because, in the context of PAM code running as root, it mishandles usersfile access, such as by calling fchown in the presence of a symlink. CVE-2024-47191...
Cisco Adaptive Security Appliance and Firepower Threat Defense Software FXOS CLI Root Privilege Escalation Vulnerability
A vulnerability in the Cisco FXOS CLI feature on specific hardware platforms for Cisco Adaptive Security Appliance ASA Software and Cisco Firepower Threat Defense FTD Software could allow an authenticated, local attacker to elevate their administrative privileges to root. The attacker would need...
The vulnerability of the Kubernetes Image Builder software lies in its use of hard-coded credentials, which allows an attacker to gain access to the virtual machine.
The vulnerability of the Kubernetes Image Builder software relates to the use of strictly encrypted credentials. Exploiting this vulnerability could allow a malicious actor to gain access to the virtual machine via SSH connection and elevate their privileges to root level...
DEBIAN-CVE-2024-47191
pamoath.so in oath-toolkit 2.6.7 through 2.6.11 before 2.6.12 allows root privilege escalation because, in the context of PAM code running as root, it mishandles usersfile access, such as by calling fchown in the presence of a symlink...
CVE-2024-47191
pamoath.so in oath-toolkit 2.6.7 through 2.6.11 before 2.6.12 allows root privilege escalation because, in the context of PAM code running as root, it mishandles usersfile access, such as by calling fchown in the presence of a symlink...
AZL-50124 CVE-2024-47191 affecting package oath-toolkit for versions less than 2.6.9-2
pamoath.so in oath-toolkit 2.6.7 through 2.6.11 before 2.6.12 allows root privilege escalation because, in the context of PAM code running as root, it mishandles usersfile access, such as by calling fchown in the presence of a symlink...
Distro Linux Workbooth 访问控制错误漏洞
Distro Linux Workbooth is an open source application for Distro Linux. An access control error vulnerability exists in Distro Linux Workbooth version v2.5, which originates from allowing privileges to be elevated to the root user via manipulation of network configuration scripts...
UBUNTU-CVE-2024-47191
pamoath.so in oath-toolkit 2.6.7 through 2.6.11 before 2.6.12 allows root privilege escalation because, in the context of PAM code running as root, it mishandles usersfile access, such as by calling fchown in the presence of a symlink...
[ASA-202410-1] oath-toolkit: privilege escalation
Arch Linux Security Advisory ASA-202410-1 ========================================= Severity: High Date : 2024-10-04 CVE-ID : CVE-2024-47191 Package : oath-toolkit Type : privilege escalation Remote : No Link : https://security.archlinux.org/AVG-2857 Summary ======= The package oath-toolkit befor...
pcp: pmpost symlink attack allows escalating pcp to root user
A vulnerability was found in Performance Co-Pilot PCP. This flaw can only be exploited if an attacker has access to a compromised PCP system account. The issue is related to the pmpost tool, which is used to log messages in the system. Under certain conditions, it runs with high-level privileges...