CVE-2020-16134

An issue was discovered on Swisscom Internet Box 2, Internet Box Standard, Internet Box Plus prior to 10.04.38, Internet Box 3 prior to 11.01.20, and Internet Box light prior to 08.06.06. Given the user-configurable credentials for the local Web interface or physical access to a device's plus or...

The vulnerability in the web interface for managing microprogrammed software routers of Cisco Small Business RV320, Cisco Small Business RV325, Cisco Small Business RV016, Cisco Small Business RV042, and Cisco Small Business RV082 allows a perpetrator to execute arbitrary commands.

The vulnerability of the web-based management interfaces for Cisco Small Business RV320, Cisco Small Business RV325, Cisco Small Business RV016, Cisco Small Business RV042, and Cisco Small Business RV082 is related to the lack of measures for input data cleansing. Exploiting this vulnerability...

MediaTek Bug Actively Exploited, Affects Millions of Android Devices

Google has addressed a high-severity flaw in MediaTek’s Command Queue driver that developers said affects millions of devices – and which has an exploit already circulating in the wild. Also in its March 2020 Android Security bulletin, issued this week, Google disclosed and patched a critical...

The vulnerability of the ThinPro Linux operating system’s VPN implementation allows a hacker to execute arbitrary commands in the superuser mode.

The vulnerability of the ThinPro Linux operating system’s VPN implementation exists due to insufficient validation of input data. Exploiting this vulnerability could allow an attacker to execute arbitrary commands in superuser mode...

Palo Alto Networks PAN-OS Memory Corruption Vulnerability

Palo Alto Networks PAN-OS is an operating system developed by Palo Alto Networks for its firewall appliances. A security vulnerability exists in Palo Alto Networks PAN-OS that originates from the program failing to perform proper authentication checks. The vulnerability can be exploited by an...

CVE-2019-11526

An issue was discovered in Softing uaGate SI 1.60.01. A maintenance script, that is executable via sudo, is vulnerable to file path injection. This enables the Attacker to write files with superuser privileges in specific locations...

The vulnerability of the remote execution service for the “Scanner-VS” security scanner allows access to the security scanner with superuser privileges.

The vulnerability of the remote execution service of the “Scanner-VS” security scanner is related to the presence of a pre-installed administrative account, whose information is not available in the documentation. Exploiting this vulnerability could allow a malicious actor, operating remotely, to...

PT-2019-11636 · Postgresql Global Development Group · Postgresql

Name of the Vulnerable Software and Affected Versions: Postgresql versions prior to 11.5 Postgresql versions prior to 10.10 Postgresql versions prior to 9.6.15 Postgresql versions prior to 9.5.19 Postgresql versions prior to 9.4.24 Description: The issue allows a superuser to write a password to ...

IBM Sterling Connect:Direct Elevation of Privilege Vulnerability

IBM Sterling Connect:Direct is a file-based peer-to-peer file transfer solution from IBM in the United States. An elevation of privilege vulnerability exists in IBM Sterling Connect:Direct for UNIX versions 6.0.0, 4.3.0, and 4.2.0 for UNIX-based platforms, which can be exploited by an attacker to...

CVE-2019-9193

In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and users in the 'pgexecuteserverprogram' group to execute arbitrary code in the context of the database's operating system user. This functionality is enabled by default and can be abused to run arbitrary...

UBUNTU-CVE-2018-16850

postgresql before versions 11.1, 10.6 is vulnerable to a to SQL injection in pgupgrade and pgdump via CREATE TRIGGER ... REFERENCING. Using a purpose-crafted trigger definition, an attacker can cause arbitrary SQL statements to run, with superuser privileges...

The installation wizard in DotNetNuke (DNN) allows privilege escalation

The installation wizard in DotNetNuke DNN before 7.4.1 allows remote attackers to reinstall the application and gain SuperUser access via a direct request to Install/InstallWizard.aspx...

GHSA-X8F7-H444-97W4 The installation wizard in DotNetNuke (DNN) allows privilege escalation

The installation wizard in DotNetNuke DNN before 7.4.1 allows remote attackers to reinstall the application and gain SuperUser access via a direct request to Install/InstallWizard.aspx...

postgresql: Uncontrolled search path element in pg_dump and other client applications

A flaw was found in the way Postgresql allowed a user to modify the behavior of a query for other users. An attacker with a user account could use this flaw to execute code with the permissions of superuser in the database...

Design/Logic Flaw

In Philips PageWriter TC10, TC20, TC30, TC50, TC70 Cardiographs, all versions prior to May 2018, an attacker with both the superuser password and physical access can enter the superuser password that can be used to access and modify all settings on the device, as well as allow the user to reset...

CVE-2018-5342

An issue was discovered in Zoho ManageEngine Desktop Central 10.0.124 and 10.0.184: network services Desktop Central and PostgreSQL running with a superuser account...

ALPINE-CVE-2018-1058

A flaw was found in the way Postgresql allowed a user to modify the behavior of a query for other users. An attacker with a user account could use this flaw to execute code with the permissions of superuser in the database. Versions 9.3 through 10 are affected...

Enlarge your botnet with: top D-Link routers (DIR8xx D-Link routers cruisin' for a bruisin')

In this article, we are going to discuss vulnerabilities detected in the top D-Link routers: DIR890L DIR885L DIR895L and other DIR8xx D-Link routers cruising for a bruising. The devices use the same code, thus giving a magnificent and quite tempting opportunity to attackers to add them to a botne...

The vulnerability of the Cisco Elastic Services Controllers network management interface, related to errors in managing registration data, allows a perpetrator to gain access to the system with superuser privileges.

The vulnerability of the Cisco Elastic Services Controllers network management interface is related to errors in managing registration data. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain access to the system with superuser privileges...

CVE-2017-7220

OpenText Documentum Content Server allows superuser access via sysobjsave or save of a crafted object, followed by an unauthorized "UPDATE dmdbo.dmusers SET userprivileges=16" command, aka an "RPC save-commands" attack. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-453...