NordVPN Root Elevation of Privilege Vulnerability

NordVPN is a virtual private network tool that gives you a high-speed and stable connection to the world wide web and secure access to a wide range of streaming sites, censored content and social media. NordVPN 3.3.10 for macOS suffers from a root elevation of privilege vulnerability. An attacker...

CVE-2018-9105

NordVPN 3.3.10 for macOS suffers from a root privilege escalation vulnerability. The vulnerability stems from its privileged helper tool's implemented XPC service. This XPC service is responsible for receiving and processing new OpenVPN connection requests from the main application. Unfortunately...

CVE-2018-9105

CVE-2018-9105 affects NordVPN 3.3.10 for macOS. The root cause is an unprotected XPC service within the privileged helper tool that handles OpenVPN connection requests from the main app. A malicious or compromised non-privileged app can connect to this XPC service, inject a crafted message, and s...

CVE-2018-8739

VPN Unlimited 4.2.0 for macOS suffers from a root privilege escalation vulnerability in its privileged helper tool. The privileged helper tool implements an XPC interface, which allows arbitrary applications to execute system commands as root...

CVE-2018-8739

VPN Unlimited 4.2.0 for macOS suffers from a root privilege escalation vulnerability in its privileged helper tool. The privileged helper tool implements an XPC interface, which allows arbitrary applications to execute system commands as root...

Privilege escalation

VPN Unlimited 4.2.0 for macOS suffers from a root privilege escalation vulnerability in its privileged helper tool. The privileged helper tool implements an XPC interface, which allows arbitrary applications to execute system commands as root...

CVE-2018-0141

A vulnerability in Cisco Prime Collaboration Provisioning PCP Software 11.6 could allow an unauthenticated, local attacker to log in to the underlying Linux operating system. The vulnerability is due to a hard-coded account password on the system. An attacker could exploit this vulnerability by...

CVE-2018-7716

PrivateVPN 2.0.31 for macOS suffers from a root privilege escalation vulnerability with its com.privat.vpn.helper privileged helper tool. This privileged helper tool implements an XPC service that allows arbitrary installed applications to connect and send messages. The XPC service extracts the...

Privilege escalation

PrivateVPN 2.0.31 for macOS suffers from a root privilege escalation vulnerability with its com.privat.vpn.helper privileged helper tool. This privileged helper tool implements an XPC service that allows arbitrary installed applications to connect and send messages. The XPC service extracts the...

CVE-2018-7715

PrivateVPN 2.0.31 for macOS suffers from a root privilege escalation vulnerability with its com.privat.vpn.helper privileged helper tool. This privileged helper tool implements an XPC service that allows arbitrary installed applications to connect and send messages. The XPC service extracts the...

CVE-2018-7715

CVE-2018-7715 affects PrivateVPN 2.0.31 for macOS via the com.privat.vpn.helper XPC service. The XPC interface allows arbitrary installed apps to connect and send a message containing a path string intended to point to PrivateVPN’s internal openvpn binary. If no connection has been established ye...

CVE-2018-7493

CVE-2018-7493 affects CactusVPN for macOS (version 6.0 and earlier) via a privileged helper tool. The tool exposes an XPC interface that allows arbitrary applications to execute system commands as root, enabling root privilege escalation. Connected sources (CNVD/NVD entries) corroborate the root-...

CVE-2018-7281

CactusVPN 5.3.6 for macOS contains a root privilege escalation vulnerability through a setuid root binary called runme. The binary takes a single command line argument and passes this argument to a system call, thus allowing low privileged users to execute commands as root...

CVE-2018-7311

PrivateVPN 2.0.31 for macOS suffers from a root privilege escalation vulnerability. The software installs a privileged helper tool that runs as the root user. This privileged helper tool is installed as a LaunchDaemon and implements an XPC service. The XPC service is responsible for handling new...

CVE-2018-7281

CVE-2018-7281 affects CactusVPN 5.3.6 for macOS . A setuid root binary named runme takes a single command line argument and passes it to a system() call, enabling a low-privileged user to execute commands with root privileges . This is a root privilege escalation vulnerability. The provided docum...

CVE-2018-7281

CactusVPN 5.3.6 for macOS contains a root privilege escalation vulnerability through a setuid root binary called runme. The binary takes a single command line argument and passes this argument to a system call, thus allowing low privileged users to execute commands as root...

macOS Kernel - Use-After-Free Due to Lack of Locking in AppleEmbeddedOSSupportHostClient::registerNotificationPort

macOS Kernel - Use-After-Free Due to Lack of Locking in AppleEmbeddedOSSupportHostClient::registerNotificationPort / AppleEmbeddedOSSupportHost.kext is presumably involved in the communication with the OS running on the touch bar on new MBP models. Here's the userclient's registerNotificationPort...

The vulnerability of the Slurm resource manager, related to improper handling of the SPANK environment variable, allows a perpetrator to escalate their privileges.

The vulnerability of the Slurm resource manager is related to incorrect processing of the SPANK environment variable. Exploiting this vulnerability can allow an attacker to elevate their privileges to the root level when executing Prolog or Epilog scripts...

The vulnerability of the ingvalidpw utility in the Ingres database management system allows a perpetrator to execute arbitrary code with root privileges.

The vulnerability of the ingvalidpw utility in the Ingres database management system is related to the loading of common libraries from a directory belonging to the user ingres. Exploiting this vulnerability can allow an attacker to enhance their privileges and execute arbitrary code with root...

CVE-2017-14179

Apport before 2.13 does not properly handle crashes originating from a PID namespace allowing local users to create certain files as root which an attacker could leverage to perform a denial of service via resource exhaustion, possibly gain root privileges, or escape from containers...