CVE-2019-14819

A flaw was found during the upgrade of an existing OpenShift Container Platform 3.x cluster. Using CRI-O, the dockergc service account is assigned to the current namespace of the user performing the upgrade. This flaw can allow an unprivileged user to escalate their privileges to those allowed by...

CVE-2019-14819

Summary: CVE-2019-14819 affects OpenShift Container Platform during upgrade with CRI-O. The dockergc service account is incorrectly bound to the current user’s namespace, which can let an unprivileged user escalate privileges to the level allowed by the privileged Security Context Constraints. Im...

CVE-2019-14819

A flaw was found during the upgrade of an existing OpenShift Container Platform 3.x cluster. Using CRI-O, the dockergc service account is assigned to the current namespace of the user performing the upgrade. This flaw can allow an unprivileged user to escalate their privileges to those allowed by...

PT-2020-9605 · Red Hat · Openshift Container Platform

Name of the Vulnerable Software and Affected Versions: OpenShift Container Platform versions 3.x Description: A flaw was discovered in the upgrade process of OpenShift Container Platform, specifically when using CRI-O. The issue allows an unprivileged user to escalate their privileges to those...

CVE-2012-2312

An Elevated Privileges issue exists in JBoss AS 7 Community Release due to the improper implementation in the security context propagation, A threat gets reused from the thread pool that still retains the security context from the process last used, which lets a local user obtain elevated...

CVE-2012-2312

An Elevated Privileges issue exists in JBoss AS 7 Community Release due to the improper implementation in the security context propagation, A threat gets reused from the thread pool that still retains the security context from the process last used, which lets a local user obtain elevated...

Input validation

An Elevated Privileges issue exists in JBoss AS 7 Community Release due to the improper implementation in the security context propagation, A threat gets reused from the thread pool that still retains the security context from the process last used, which lets a local user obtain elevated...

CVE-2012-2312

CVE-2012-2312 affects JBoss AS 7 Community Release. The issue arises from improper security context propagation: a thread-pool-reused security context may retain the previous process’s context, enabling a local user to obtain elevated privileges. The connected documents corroborate the elevated-p...

CVE-2012-2312

An Elevated Privileges issue exists in JBoss AS 7 Community Release due to the improper implementation in the security context propagation, A threat gets reused from the thread pool that still retains the security context from the process last used, which lets a local user obtain elevated...

Adobe InDesign Remote Code Execution (CVE-2019-7107)

A remote code execution vulnerability exists in Adobe InDesign. The vulnerability is due to insufficient validation of hyperlinks in InDesign documents. Successful exploitation could result in arbitrary code execution under the security context of the application...

HPE Intelligent Management Center Remote Code Execution (CVE-2019-5385)

An Expression Language injection vulnerability exists in HPE Intelligent Management Center. The vulnerability is due to insufficient validation of the beanName request parameter in perfSelectTask endpoint.Successful exploitation results in the execution of arbitrary code under the security contex...

Microsoft Outlook for Android Spoofing Vulnerability

Microsoft Outlook for Android is an email application for the Android-based platform from Microsoft USA. A spoofing vulnerability exists in the way Microsoft Outlook for Android parses specially crafted emails. An attacker could exploit this vulnerability by sending a specially crafted email to a...

Microsoft Outlook for Android Bug Opens Door to XSS

Users of the Microsoft Outlook for Android app should update their apps to avoid a range of attacks. The bug CVE-2019-1460 would allow an attacker to perform cross-site scripting XSS attacks on the affected systems and run scripts in the security context of the current user, according to...

WECON LeviStudio Buffer Overflow (CVE-2019-6537)

A stack-based buffer overflow vulnerability exists in WECON LeviStudio DataLogTool. The vulnerability is due to improper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. Successful exploitation could allow the attacker to execute arbitrary...

Visual Studio Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists when Visual Studio fails to properly validate hardlinks while extracting archived files. An attacker who successfully exploited this vulnerability could overwrite arbitrary files in the security context of the local system. To exploit this...

EulerOS 2.0 SP5 : krb5 (EulerOS-SA-2019-2162)

According to the version of the krb5 packages installed, the EulerOS installation on the remote host is affected by the following vulnerability : - Double free vulnerability in MIT Kerberos 5 aka krb5 allows attackers to have unspecified impact via vectors involving automatic deletion of security...

Cisco Small Business SPA500 Series IP Phones Local Script Execution Vulnerability

A vulnerability in Cisco Small Business SPA500 Series IP Phones could allow a physically proximate attacker to execute arbitrary commands on the device. The vulnerability is due to the presence of development testing and verification scripts that remained on the device. An attacker could exploit...

Cisco Small Business SPA500 Series IP Phones CVE-2019-15959 Local Command Injection Vulnerability

Description Cisco Small Business SPA500 Series IP Phones are prone to a local command-injection vulnerability. Local attackers can exploit this issue to execute arbitrary commands on the device in an elevated security context. This issue is being tracked by Cisco Bug ID CSCvp40755. Cisco Small...

WECON PIStudio basedll TextContent Stack-based Buffer Overflow

A stack-based overflow exists in Wecon PIStudio. This vulnerability is due to input validation error when processing TextContent attributed in a HSC configuration file. A remote attacker could exploit these vulnerabilities by enticing a user to visit a malicious web page or open a crafted documen...

Microsoft SharePoint Spoofing Vulnerability

A spoofing vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected SharePoint server. The...