The vulnerability of the fly-admin-ald-se component in the FLY operating system environment of Astra Linux, related to improper access control, allows a intruder to trigger a service failure.

The vulnerability of the fly-admin-ald-se component in the FLY operating system environment of Astra Linux is related to incorrect configuration of security contexts when adding/removing users who are part of the administrator group. Exploiting this vulnerability allows a malicious actor to cause...

openshift-ansible: dockergc service account incorrectly associated with namespace during upgrade

A flaw was found during the upgrade of an existing OpenShift Container Platform 3.x cluster. Using CRI-O, the dockergc service account is assigned to the current namespace of the user performing the upgrade. This flaw can allow an unprivileged user to escalate their privileges to those allowed by...

HPE Intelligent Management Center Information Disclosure

!/opt/local/bin/python2.7 Exploit Title: HPE Intelligent Management Center dbman Command 10001 Information Disclosure Date: 22-09-2019 Exploit Author: Rishabh Sharma Linkedin: rishabh2241991 Vendor Homepage: www.hpe.com Software Link:...

HPE Intelligent Management Center < 7.3 E0506P09 - Information Disclosure Exploit

!/opt/local/bin/python2.7 Exploit Title: HPE Intelligent Management Center dbman Command 10001 Information Disclosure Date: 22-09-2019 Exploit Author: Rishabh Sharma Linkedin: rishabh2241991 Vendor Homepage: www.hpe.com Software Link:...

HPE Intelligent Management Center < 7.3 E0506P09 - Information Disclosure

!/opt/local/bin/python2.7 Exploit Title: HPE Intelligent Management Center dbman Command 10001 Information Disclosure Date: 22-09-2019 Exploit Author: Rishabh Sharma Linkedin: rishabh2241991 Vendor Homepage: www.hpe.com Software Link:...

Privilege Escalation

ASP.NET Core is vulnerable to privilege escalation. When an ASP.NET Core web application is created using vulnerable project templates, the application fails to properly sanitize web requests. An attacker is able to exploit the vulnerability by sending an email to the user containing a malicious...

.NET Core Multiple Vulnerabilities (Sep 2019)

ASP.NET Core is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:microsoft:asp.netcore" ;...

Active Directory Federation Services XSS Vulnerability

A cross-site-scripting XSS vulnerability exists when Active Directory Federation Services ADFS does not properly sanitize certain error messages. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected ADFS server. The attacker who...

Microsoft Windows ALPC CVE-2019-1269 Local Privilege Escalation Vulnerability

Description Microsoft Windows is prone to a local privilege-escalation vulnerability. A local attacker can leverage this issue to execute arbitrary code in the security context of the local system. Technologies Affected Microsoft Windows 10 Version 1607 for 32-bit Systems Microsoft Windows 10...

CVE-2019-14819

A flaw was found during the upgrade of an existing OpenShift Container Platform 3.x cluster. Using CRI-O, the dockergc service account is assigned to the current namespace of the user performing the upgrade. This flaw can allow an unprivileged user to escalate their privileges to those allowed by...

Security Bulletin: IBM API Connect's Developer Portal is impacted by a path traversal vulnerability.

Summary IBM API Connect has addressed the following vulnerability. Vulnerability Details CVEID: Not Applicable DESCRIPTION: Advanced Forum module for Drupal is vulnerable to cross-site scripting, caused by improper validation of user-supplied input. A remote attacker could exploit this...

Microsoft Office SharePoint XSS Vulnerability

A cross-site-scripting XSS vulnerability exists when Microsoft SharePoint Server does not properly sanitize a specially crafted web request to an affected SharePoint server. An authenticated attacker could exploit the vulnerability by sending a specially crafted request to an affected SharePoint...

Windows ALPC Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call ALPC. An attacker who successfully exploited this vulnerability could run arbitrary code in the security context of the local system. An attacker could then install programs; view...

Microsoft Windows ALPC CVE-2019-1162 Local Privilege Escalation Vulnerability

Description Microsoft Windows is prone to a local privilege-escalation vulnerability. A local attacker can leverage this issue to execute arbitrary code in the security context of the local system. Technologies Affected Microsoft Windows 10 Version 1607 for 32-bit Systems Microsoft Windows 10...

CVE-2019-4415

IBM Cloud Private 3.1.1 and 3.1.2 could allow a local user to obtain elevated privileges due to improper security context constraints. IBM X-Force ID: 162706...

CVE-2019-4415

IBM Cloud Private 3.1.1 and 3.1.2 could allow a local user to obtain elevated privileges due to improper security context constraints. IBM X-Force ID: 162706...

Input validation

IBM Cloud Private 3.1.1 and 3.1.2 could allow a local user to obtain elevated privileges due to improper security context constraints. IBM X-Force ID: 162706...

PT-2019-17071 · Ibm · Ibm Cloud Private

Name of the Vulnerable Software and Affected Versions: IBM Cloud Private versions 3.1.1 through 3.1.2 Description: The issue allows a local user to obtain elevated privileges due to improper security context constraints. Recommendations: For IBM Cloud Private versions 3.1.1 and 3.1.2, at the...

Input validation

A vulnerability in Cisco Small Business SPA500 Series IP Phones could allow a physically proximate attacker to execute arbitrary commands on the device. The vulnerability is due to improper input validation in the device configuration interface. An attacker could exploit this vulnerability by...

CVE-2019-1923

CVE-2019-1923 affects Cisco Small Business SPA500 Series IP Phones. The issue stems from improper input validation in the device configuration interface, enabling a physically proximate attacker to insert a USB device via the unit’s physical interface and execute arbitrary commands with elevated ...