Path traversal

MitraStar GPT-2541GNAC-N1 HGU 100VNZ0b33 devices allow remote authenticated users to obtain root access by executing command "deviceinfo show file &&/bin/bash" because of incorrect sanitization of parameter "path"...

CVE-2021-42165

MitraStar GPT-2541GNAC-N1 HGU 100VNZ0b33 devices allow remote authenticated users to obtain root access by executing command "deviceinfo show file &&/bin/bash" because of incorrect sanitization of parameter "path"...

CVE-2022-20743

A vulnerability in the web management interface of Cisco Firepower Management Center FMC Software could allow an authenticated, remote attacker to bypass security protections and upload malicious files to the affected system. This vulnerability is due to improper validation of files uploaded to t...

Mitrastar GPT-2541GNAC-N1 操作系统命令注入漏洞

The Mitrastar GPT-2541GNAC-N1 is a router. An operating system command injection vulnerability exists in the firmware version of the Mitrastar GPT-2541GNAC-N1 HGU 100VNZ0b33, which is caused by incorrectly clearing the parameter "path". The vulnerability can be exploited by a remote authenticatio...

Vulnerability fixed in Progress OpenEdge

Progress has fixed a vulnerability in OpenEdge. A malicious party could, by exploiting this vulnerability, gain gain root privileges on the vulnerable system. For successful misuse requires authentication on the underlying operating system required. Progress has released updates to fix the...

CVE-2022-29934

USU Oracle Optimization before 5.17.5 lacks Polkit authentication, which allows smartcollector users to achieve root access via pkexec. NOTE: this is not an Oracle Corporation product...

CVE-2022-29937

USU Oracle Optimization before 5.17.5 allows authenticated DataCollection users to achieve agent root access because some common OS commands are blocked but for example an OS command for base64 decoding is not blocked. NOTE: this is not an Oracle Corporation product...

CVE-2022-29934

USU Oracle Optimization before 5.17.5 lacks Polkit authentication, which allows smartcollector users to achieve root access via pkexec. NOTE: this is not an Oracle Corporation product...

CVE-2022-29934

USU Oracle Optimization before 5.17.5 lacks Polkit authentication, which allows smartcollector users to achieve root access via pkexec. NOTE: this is not an Oracle Corporation product...

CVE-2022-29937

USU Oracle Optimization before 5.17.5 allows authenticated DataCollection users to achieve agent root access because some common OS commands are blocked but for example an OS command for base64 decoding is not blocked. NOTE: this is not an Oracle Corporation product...

CVE-2022-29937

USU Oracle Optimization before 5.17.5 allows authenticated DataCollection users to achieve agent root access because some common OS commands are blocked but for example an OS command for base64 decoding is not blocked. NOTE: this is not an Oracle Corporation product...

Command injection

USU Oracle Optimization before 5.17.5 allows authenticated DataCollection users to achieve agent root access because some common OS commands are blocked but for example an OS command for base64 decoding is not blocked. NOTE: this is not an Oracle Corporation product...

Design/Logic Flaw

USU Oracle Optimization before 5.17.5 lacks Polkit authentication, which allows smartcollector users to achieve root access via pkexec. NOTE: this is not an Oracle Corporation product...

CVE-2022-29934

USU Oracle Optimization before 5.17.5 lacks Polkit authentication, which allows smartcollector users to achieve root access via pkexec. NOTE: this is not an Oracle Corporation product...

CVE-2022-29934

Summary (CVE-2022-29934) : USU Oracle Optimization (pre-5.17.5) lacks Polkit authentication, enabling smartcollector users to gain root access via pkexec. This affects versions prior to 5.17.5 and is not an Oracle Corporation product. Impact (as documented) : local privilege escalation to root wi...

CVE-2022-29937

CVE-2022-29937 affects USU Oracle Optimization before 5.17.5. Affected component: the Oracle Optimization agent. Root cause: authenticated DataCollection users can exploit command injection because some OS commands are blocked while commands like base64 decoding are not blocked, enabling shell ac...

CVE-2022-29937

USU Oracle Optimization before 5.17.5 allows authenticated DataCollection users to achieve agent root access because some common OS commands are blocked but for example an OS command for base64 decoding is not blocked. NOTE: this is not an Oracle Corporation product...

USU Oracle Optimization 操作系统命令注入漏洞

USU Oracle Optimization is used to improve the performance of Oracle queries. command injection vulnerability exists in versions of USU Oracle Optimization prior to 5.17.5. The vulnerability stems from the fact that some common OS commands are blocked, but OS commands for base64 decoding are not...

USU Oracle Optimization 访问控制错误漏洞

USU Oracle Optimization is used to improve the performance of Oracle queries.USU Oracle Optimization versions prior to 5.17.5 have an authorization issue vulnerability that stems from a lack of Polkit authentication, which can be exploited by an attacker to achieve root user access via pkexec...

PT-2022-19918 · Usu · Usu Oracle Optimization

Name of the Vulnerable Software and Affected Versions: USU Oracle Optimization versions prior to 5.17.5 Description: The issue is related to a lack of Polkit authentication in USU Oracle Optimization, which allows smartcollector users to achieve root access via pkexec. This is not an Oracle...