PT-2022-18304 · Jenkins · Jenkins Dbcharts Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins dbCharts Plugin versions 0.5.2 and earlier Description: The issue concerns the storage of JDBC connection passwords in the global configuration file on the Jenkins controller. These passwords are stored unencrypted and can be viewed b...

CVE-2022-24618

Heimdal.Wizard.exe installer in Heimdal Premium Security 2.5.395 and earlier has insecure permissions, which allows unprivileged local users to elevate privileges to SYSTEM via the "Browse For Folder" window accessible by triggering a "Repair" on the MSI package located in C:\Windows\Installer...

CVE-2022-24618

Heimdal.Wizard.exe installer in Heimdal Premium Security 2.5.395 and earlier has insecure permissions, which allows unprivileged local users to elevate privileges to SYSTEM via the "Browse For Folder" window accessible by triggering a "Repair" on the MSI package located in C:\Windows\Installer...

Directory Traversal

Rust is vulnerable to directory traversal. The vulnerability exists due to a race condition which allows an attacker to access the file system of the application...

Heimdal Premium Security 安全漏洞

Heimdal Premium Security is an antivirus security software from the Danish company Heimdal. A security vulnerability exists in Heimdal Premium Security 2.5.395 and earlier versions, which stems from an insecure privilege setting in the Heimdal.Wizard.exe installer. The vulnerability can be...

otris Update Manager 授权问题漏洞

otris Update Manager is used by otris for compliance digitization. A security vulnerability exists in otris Update Manager 1.2.1.0 that allows local users to gain access to SYSTEM via unauthenticated calls and allows remote attacks on HTTP traffic on TCP port 9000 using WsHTTPBinding...

CVE-2021-40376

otris Update Manager 1.2.1.0 allows local users to achieve SYSTEM access via unauthenticated calls to exposed interfaces over a .NET named pipe. A remote attack may be possible as well, by leveraging WsHTTPBinding for HTTP traffic on TCP port 9000...

CVE-2021-40376

CVE-2021-40376 affects otris Update Manager 1.2.1.0. The vulnerability allows local users to obtain SYSTEM privileges by sending unauthenticated calls to exposed interfaces via a .NET named pipe. A remote attack may be possible by abusing WsHTTPBinding for HTTP traffic on TCP port 9000. CVSS data...

CVE-2021-32008 Logged-in Administrator may get unrestricted file system access

This issue affects: Secomea GateManager Version 9.6.621421014 and all prior versions. Improper Limitation of a Pathname to restricted directory, allows logged in GateManager admin to delete system Files or Directories...

Denial Of Service (DoS)

com.liferay.layout.admin.web is vulnerable to denial of service. The vulnerability exists due to improper handle of user privileges in script.jsp file allows a remote attacker to restrict system access to the legitimate users...

CVE-2022-25623

The Symantec Management Agent is susceptible to a privilege escalation vulnerability. A low privilege local account can be elevated to the SYSTEM level through registry manipulations...

PT-2022-17416 · Symantec · Symantec Management Agent

Name of the Vulnerable Software and Affected Versions: Symantec Management Agent affected versions not specified Description: The Symantec Management Agent is susceptible to a privilege escalation issue. A low privilege local account can be elevated to the SYSTEM level through registry...

Execution with Unnecessary Privileges in arc-electron

Impact When the end-user click on the response header that contains a link the target will be opened in ARC new window. This window will have the default preload script loaded which allows the scripts embedded in the link target to execute any logic that ARC has access to from the renderer proces...

CVE-2022-25010

The component /rootfs in RageFile of Stepmania v5.1b2 and below allows attackers access to the entire file system...

CVE-2022-25010

The component /rootfs in RageFile of Stepmania v5.1b2 and below allows attackers access to the entire file system...

CVE-2022-25010

CVE-2022-25010 affects Stepmania v5.1b2 and earlier, where the /rootfs component in RageFile can be exploited to access the entire file system. Affected software: Stepmania; vulnerable component: RageFile’s /rootfs. Root cause described across sources as lack of privilege restrictions enabling el...

CVE-2020-14481

The DeskLock tool provided with FactoryTalk View SE uses a weak encryption algorithm that may allow a local, authenticated attacker to decipher user credentials, including the Windows user or Windows DeskLock passwords. If the compromised user has an administrative account, an attacker could gain...

Default credentials

The DeskLock tool provided with FactoryTalk View SE uses a weak encryption algorithm that may allow a local, authenticated attacker to decipher user credentials, including the Windows user or Windows DeskLock passwords. If the compromised user has an administrative account, an attacker could gain...

ICL ScadaFlex II SCADA Controllers SC-1/SC-2 1.03.07 Remote File CRUD

Summary Scadaflex II controllers are 100% web based for both configuration and user interface. No applications are required other than any standard web browser. They are easily supported by remote access over the Internet or a cellular link. Scadaflex II controllers support industry standard wire...

Red Hat CentOS Stream 安全漏洞

Red Hat CentOS Stream is a predevelopment, continuous delivery distribution from Red Hat, Inc. that is positioned midstream between Fedora Linux and RHEL. Red Hat CentOS Stream 8 suffers from a security vulnerability that could be exploited by a physical attacker to gain access to a locked system...