CVE-2023-38641

A vulnerability has been identified in SICAM TOOLBOX II All versions V07.10. The affected application's database service is executed as NT AUTHORITY\SYSTEM. This could allow a local attacker to execute operating system commands with elevated privileges...

PT-2023-26992 · Unknown · Cryptomator

Name of the Vulnerable Software and Affected Versions: Cryptomator version 1.9.2 Description: Cryptomator encrypts data being stored on cloud infrastructure. The issue allows local privilege escalation for low privileged users via the repair function. This occurs because the repair function of th...

CVE-2023-33282

Marval MSM through 14.19.0.12476 and 15.0 has a System account with default credentials. A remote attacker is able to login and create a valid session. This makes it possible to make backend calls to endpoints in the application...

CVE-2023-33282

Marval MSM through 14.19.0.12476 and 15.0 has a System account with default credentials. A remote attacker is able to login and create a valid session. This makes it possible to make backend calls to endpoints in the application...

Marval MSM 安全漏洞

Marval MSM is an innovative IT service management software from Marval UK. A security vulnerability exists in Marval MSM that stems from the presence of a system account with default credentials that allows an attacker to log in and create a valid session. Affected products and versions: Marval M...

CVE-2023-33282

Marval MSM through 14.19.0.12476 and 15.0 has a System account with default credentials. A remote attacker is able to login and create a valid session. This makes it possible to make backend calls to endpoints in the application...

PT-2023-24267 · Marval · Marval Msm

Name of the Vulnerable Software and Affected Versions: Marval MSM versions 14.19.0.12476 and earlier, version 15.0 Description: The issue concerns a system account with default credentials, allowing a remote attacker to log in and create a valid session. This enables the attacker to make backend...

ThinManager Path Traversal (CVE-2023-27855) Arbitrary File Upload

This module exploits a path traversal vulnerability CVE-2023-27855 in ThinManager use auxiliary/admin/networking/thinmanager/traversalupload msf undefinedtraversalupload show actions ...actions... msf undefinedtraversalupload set ACTION msf undefinedtraversalupload show options ...show and set...

After Enabling MFA, Veeam Backup Server Is Listed as Inaccessible in Veeam Service Provider Console

Challenge After enabling multi-factor authentication MFA in Veeam Backup & Replication or Veeam Cloud Connect, that server may become listed as "inaccessible" within Veeam Service Provider Console yet the Veeam Management Agent for VSPC continues to display a "healthy" status. Cause When MFA is...

DataHub 安全漏洞

DataHub is datahub-project open source metadata platform for a modern data stack. DataHub suffers from a security vulnerability that stems from the presence of an authentication bypass, which is exploited by an attacker to create a system account, leading to a compromise of the entire system...

CVE-2023-25559 System account impersonation in DataHub

DataHub is an open-source metadata platform. When not using authentication for the metadata service, which is the default configuration, the Metadata service GMS will use the X-DataHub-Actor HTTP header to infer the user the frontend is sending the request on behalf of. When the backends retrieve...

CVE-2023-25559 System account impersonation in DataHub

DataHub is an open-source metadata platform. When not using authentication for the metadata service, which is the default configuration, the Metadata service GMS will use the X-DataHub-Actor HTTP header to infer the user the frontend is sending the request on behalf of. When the backends retrieve...

CVE-2023-25560

DataHub is an open-source metadata platform. The AuthServiceClient which is responsible for creation of new accounts, verifying credentials, resetting them or requesting access tokens, crafts multiple JSON strings using format strings with user-controlled data. This means that an attacker may be...

The vulnerability of the RealVNC remote access software lies in the ability to execute files located at %TEMP%, as they are owned by the SYSTEM account. This allows attackers to gain higher privileges.

The vulnerability of the RealVNC remote access software is related to the possibility of executing files located at %TEMP% as SYSTEM. Exploiting this vulnerability can allow an attacker to increase their privileges...

Moodle Improper Encoding or Escaping of Output

Insufficient escaping of the LaTeX preamble made it possible for site administrators to read files available to the HTTP server system account...

Security Bulletin: Privilege escalation vulnerability in IBM DB2's Audit Facility (CVE-2013-3475).

Abstract Vulnerability in IBM DB2's Audit Facility could allow an escalation of privilege attack. Content VULNERABILITY DETAILS CVE ID: CVE-2013-3475 Description: The IBM DB2 products listed below contain a security vulnerability in the DB2 Audit Facility which allows an attacker to gain DB2...

CVE-2022-35413

WAPPLES through 6.0 has a hardcoded systemi account. A threat actor could use this account to access the system configuration and confidential information such as SSL keys via an HTTPS request to the /webapi/ URI on port 443 or 5001...

PT-2022-22814 · Wapples · Wapples

Name of the Vulnerable Software and Affected Versions: WAPPLES versions through 6.0 Description: A threat actor could use a hardcoded systemi account to access the system configuration and confidential information, such as SSL keys, via an HTTPS request to the "/webapi/" URI on port 443 or 5001...

CVE-2022-36415

A DLL hijacking vulnerability exists in the uninstaller in Scooter Beyond Compare 1.8a through 4.4.2 before 4.4.3 when installed via the EXE installer. The uninstaller attempts to load DLLs out of a Windows Temp folder. If a standard user places malicious DLLs in the C:\Windows\Temp\ folder, and...

MGASA-2022-0225 Updated nats-server packages fix security vulnerability

NATS nats-server before 2.7.2 has Incorrect Access Control. Any authenticated user can obtain the privileges of the System account by misusing the "dynamically provisioned sandbox accounts" feature. CVE-2022-24450...