Squid Access Privilege Vulnerability

Squid is a suite of proxy server and web caching server software. The software provides features such as caching the World Wide Web, filtering traffic, and proxying the Internet. A security vulnerability exists in Squid 4.7 and earlier versions. An attacker can exploit this vulnerability to eleva...

Cisco UCS Director and Cisco UCS Director Express for Big Data Path Traversal Vulnerability (CNVD-2020-25349)

Cisco UCS Director and Cisco UCS Director Express for Big Data are both products from Cisco, Inc. Cisco UCS Director is a heterogeneous platform for private cloud Infrastructure as a Service IaaS. Cisco UCS Director is a heterogeneous platform for private cloud infrastructure-as-a-service IaaS. A...

TP-Link Archer A7/C7 - Unauthenticated LAN Remote Code Execution (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'openssl' class MetasploitModule 'TP-Link Archer A7/C7 Unauthenticated LAN Remote Code Execution', 'Description' = %q This module exploits a command injection...

UBUNTU-CVE-2019-12522

An issue was discovered in Squid through 4.7. When Squid is run as root, it spawns its child processes as a lesser user, by default the user nobody. This is done via the leavesuid call. leavesuid leaves the Saved UID as 0. This makes it trivial for an attacker who has compromised the child proces...

TP-Link Archer A7/C7 Unauthenticated LAN Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'openssl' class MetasploitModule 'TP-Link Archer A7/C7 Unauthenticated LAN Remote Code Execution', 'Description' = %q This module exploits a command injection...

Grandstream GXP1600 Backlink Vulnerability

The Grandstream GXP1600 is an IP phone product from Grandstream. A backlink vulnerability exists in the Grandstream GXP1600 series using firmware version 1.0.4.152 and earlier. The vulnerability can be exploited to execute arbitrary scripts and gain root privileges by uploading a specially crafte...

Grandstream GXP1600 Code Injection Vulnerability

The Grandstream GXP1600 is an IP phone product from Grandstream. A code injection vulnerability exists in the Grandstream GXP1600 series using firmware version 1.0.4.152 and earlier. The vulnerability can be exploited to add arbitrary OpenVPN configuration settings to a configuration file with th...

SAP Host Agent Elevation of Privilege Vulnerability

SAP Host Agent privileges is a host agent of SAP Germany. An elevation of privilege vulnerability exists in SAP Host Agent, which can be exploited by an attacker to gain root privileges to the underlying operating system using the operating framework, resulting in an elevation of privilege...

PT-2020-2413 · Cisco · Cisco Ip Phones

Name of the Vulnerable Software and Affected Versions: Cisco IP Phones versions prior to the fixed version Description: A vulnerability in the web server for Cisco IP Phones could allow an unauthenticated, remote attacker to execute code with root privileges or cause a reload of an affected IP...

CVE-2019-14326

An issue was discovered in AndyOS Andy versions up to 46.11.113. By default, it starts telnet and ssh ports 22 and 23 with root privileges in the emulated Android system. This can be exploited by remote attackers to gain full access to the device, or by malicious apps installed inside the emulato...

Privilege escalation

An issue was discovered in AndyOS Andy versions up to 46.11.113. By default, it starts telnet and ssh ports 22 and 23 with root privileges in the emulated Android system. This can be exploited by remote attackers to gain full access to the device, or by malicious apps installed inside the emulato...

CVE-2020-10384

An issue was discovered in the MB CONNECT LINE mymbCONNECT24 and mbCONNECT24 software in all versions through 2.6.1. There is a local privilege escalation from the www-data account to the root account...

CVE-2019-18822

A privilege escalation vulnerability in ZOOM Call Recording 6.3.1 allows its user account i.e., the account under which the program runs - by default, the callrec account to elevate privileges to root by abusing the [email protected]. The [email protected] starts the /opt/callrec/bin/rs binar...

CVE-2020-7958

An issue was discovered on OnePlus 7 Pro devices before 10.0.3.GM21BA. The firmware was found to contain functionality that allows a privileged user root in the Rich Execution Environment REE to obtain bitmap images from the fingerprint sensor because of Leftover Debug Code. The issue is that the...

CVE-2020-7958

An issue was discovered on OnePlus 7 Pro devices before 10.0.3.GM21BA. The firmware was found to contain functionality that allows a privileged user root in the Rich Execution Environment REE to obtain bitmap images from the fingerprint sensor because of Leftover Debug Code. The issue is that the...

CVE-2020-7958

An issue was discovered on OnePlus 7 Pro devices before 10.0.3.GM21BA. The firmware was found to contain functionality that allows a privileged user root in the Rich Execution Environment REE to obtain bitmap images from the fingerprint sensor because of Leftover Debug Code. The issue is that the...

Denial Of Service (DoS)

krb5-appl is vulnerable to a buffer overflow flaw. Due to a flaw in libtelnet/encrypt.c, a remote attacker can access the telnet port of a target machine, subsequently executing arbitrary code as root...

Unspecified Vulnerability in Samsung Mobile Devices (CNVD-2020-31593)

Android is a Linux-based open source operating system jointly developed by Google Inc. and the Open Handheld Alliance OHA for short. Samsung mobile devices have a security vulnerability that can be exploited by attackers to bypass Secure Boot and gain root user access...

Juniper Networks Junos OS License Issue Vulnerability (CNVD-2020-22961)

Juniper Networks Junos OS is a Juniper Networks network operating system for the company's hardware devices. The OS provides a secure programming interface and the Junos SDK. An authorization issue vulnerability exists in Juniper Networks Junos OS that arises from incorrect authentication. An...

Xiaomi Xiao AI Speaker Pro LX06 Input Validation Error Vulnerability

Xiaomi Xiao AI Speaker Pro LX06 is a smart speaker from Chinese company Xiaomi Technology Xiaomi. An input validation error vulnerability exists in the Xiaomi Xiao AI Speaker Pro LX06 version 1.58.10. The vulnerability can be exploited by activating failsafe mode and using the miconsole command t...