CVE-2019-3721

CVE-2019-3721 affects Dell EMC OpenManage System Administrator (OMSA) prior to version 9.3.0. The issue is an improper range header processing vulnerability in OMSA’s handling of HTTP Range requests; crafted requests with overlapping ranges can cause the application to compress each requested byt...

PT-2019-16665 · Dell Emc · Dell Emc Openmanage System Administrator

Name of the Vulnerable Software and Affected Versions: Dell EMC Open Manage System Administrator OMSA versions prior to 9.3.0 Description: The issue is related to a Directory Traversal Vulnerability due to insufficient sanitization of input parameters. A remote authenticated malicious user with...

CVE-2018-20233

The Upload add-on resource in Atlassian Universal Plugin Manager before version 2.22.14 allows remote attackers who have system administrator privileges to read files, make network requests and perform a denial of service attack via an XML External Entity vulnerability in the parsing of atlassian...

CVE-2019-6109

An issue was discovered in OpenSSH 7.9. Due to missing character encoding in the progress display, a malicious server or Man-in-The-Middle attacker can employ crafted object names to manipulate the client output, e.g., by using ANSI control codes to hide additional files being transferred. This...

CVE-2019-6110

In OpenSSH 7.9, due to accepting and displaying arbitrary stderr output from the server, a malicious server or Man-in-The-Middle attacker can manipulate the client output, for example to use ANSI control codes to hide additional files being transferred. Mitigation This issue only affects the user...

CVE-2018-20685

In OpenSSH 7.9, scp.c in the scp client allows remote SSH servers to bypass intended access restrictions via the filename of . or an empty filename. The impact is modifying the permissions of the target directory on the client side. Mitigation This issue only affects the users of scp binary which...

DEBIAN-CVE-2018-18955

In the Linux kernel 4.15.x through 4.19.x before 4.19.2, mapwrite in kernel/usernamespace.c allows privilege escalation because it mishandles nested user namespaces with more than 5 UID or GID ranges. A user who has CAPSYSADMIN in an affected user namespace can bypass access controls on resources...

CVE-2018-14828

Advantech WebAccess 8.3.1 and earlier has an improper privilege management vulnerability, which may allow an attacker to access those files and perform actions at a system administrator level...

CVE-2018-14828

Advantech WebAccess 8.3.1 and earlier has an improper privilege management vulnerability, which may allow an attacker to access those files and perform actions at a system administrator level...

The bundled Atlassian Universal Plugin Manager plugin had a XXE issue - CVE-2018-20233

The version of the bundled Atlassian Universal Plugin Manager plugin had a XML External Entity vulnerability that allowed remote attackers with system administrator privileges to read files, make network requests and perform a denial of service attack via an XML External Entity vulnerability in t...

The bundled Atlassian Universal Plugin Manager plugin had a XXE issue - CVE-2018-20233

The version of the bundled Atlassian Universal Plugin Manager plugin had a XML External Entity vulnerability that allowed remote attackers with system administrator privileges to read files, make network requests and perform a denial of service attack via an XML External Entity vulnerability in t...

CVE-2016-9498 ManageEngine Applications Manager 12 and 13, allows unserialization of unsafe Java objects

ManageEngine Applications Manager 12 and 13 before build 13200, allows unserialization of unsafe Java objects. The vulnerability can be exploited by remote user without authentication and it allows to execute remote code compromising the application as well as the operating system. As Application...

Security Bulletin: IBM Maximo Asset Management contains a vulnerability which could allow an authenticated system administrator to obtain sensitive information incorrectly exposed in log files (CVE-2015-7487)

Summary IBM Maximo Asset Management contains a vulnerability which could allow an authenticated system administrator to obtain sensitive information incorrectly exposed in log files. Vulnerability Details CVEID: CVE-2015-7487 DESCRIPTION: IBM Maximo Asset Management contains a vulnerability which...

The vulnerability of the executable file DTISQLInstaller.exe of the software package for interacting with QuicDoc and Office Therapy clients allows a perpetrator to gain access to the software.

The vulnerability of the DTISQLInstaller.exe executable file of the software package for interacting with QuicDoc and Office Therapy clients is related to the use of pre-installed user accounts. Exploiting this vulnerability can allow an attacker, operating remotely, to gain access to the softwar...

Kaseya Virtual System Administrator agent local elevation of privilege vulnerability

Kaseya Virtual System Administrator is a suite of IT system management platforms from Kaseya, Switzerland, for simplifying and automating IT services, of which the Kaseya Virtual System Administrator agent is an agent program. A security vulnerability exists in Kaseya Virtual System Administrator...

CVE-2017-12410

It is possible to exploit a Time of Check & Time of Use TOCTOU vulnerability by winning a race condition when Kaseya Virtual System Administrator agent 9.3.0.11 and earlier tries to execute its binaries from working and/or temporary folders. Successful exploitation results in the execution of...

Race condition

It is possible to exploit a Time of Check & Time of Use TOCTOU vulnerability by winning a race condition when Kaseya Virtual System Administrator agent 9.3.0.11 and earlier tries to execute its binaries from working and/or temporary folders. Successful exploitation results in the execution of...

CVE-2017-12410

It is possible to exploit a Time of Check & Time of Use TOCTOU vulnerability by winning a race condition when Kaseya Virtual System Administrator agent 9.3.0.11 and earlier tries to execute its binaries from working and/or temporary folders. Successful exploitation results in the execution of...

CVE-2017-12410

Kaseya VSA Agent

Privilege Escalation

github.com/tridentli/pitchfork is vulnerable to privilege escalation. The vulnerability exists due to an issue where permissions are mapped, allowing any authenticated user to set the System Administrator permissions on their account...