519 matches found
Race condition
It is possible to exploit a Time of Check & Time of Use TOCTOU vulnerability by winning a race condition when Kaseya Virtual System Administrator agent 9.3.0.11 and earlier tries to execute its binaries from working and/or temporary folders. Successful exploitation results in the execution of...
CVE-2017-12410
It is possible to exploit a Time of Check & Time of Use TOCTOU vulnerability by winning a race condition when Kaseya Virtual System Administrator agent 9.3.0.11 and earlier tries to execute its binaries from working and/or temporary folders. Successful exploitation results in the execution of...
CVE-2017-12410
Kaseya VSA Agent
CVE-2017-12410
It is possible to exploit a Time of Check & Time of Use TOCTOU vulnerability by winning a race condition when Kaseya Virtual System Administrator agent 9.3.0.11 and earlier tries to execute its binaries from working and/or temporary folders. Successful exploitation results in the execution of...
Privilege Escalation
github.com/tridentli/pitchfork is vulnerable to privilege escalation. The vulnerability exists due to an issue where permissions are mapped, allowing any authenticated user to set the System Administrator permissions on their account...
Design/Logic Flaw
Pitchfork version 1.4.6 RC1 contains an Improper Privilege Management vulnerability in Trident Pitchfork components that can result in A standard unprivileged user could gain system administrator permissions within the web portal.. This attack appear to be exploitable via The user must be able to...
CVE-2018-5266
Cobham Sea Tel 121 build 222701 devices allow remote attackers to obtain potentially sensitive information about valid usernames by reading the loginName lines at the js/userLogin.js URI. NOTE: default passwords for the standard usernames are listed in the product's documentation: Dealer with...
macOS 10.13 Authentication Bypass Remote Check (CVE-2017-13872)
The remote host is affected by an authentication bypass vulnerability. A local attacker or a remote attacker with credentials for a standard user account has the ability to blank out the root account password. This can allow an authenticated attacker to escalate privileges to root and execute...
Critical Apple Login Bug Puts macOS High Sierra Systems at Risk
A major bug in Apple’s macOS gives anyone with physical access to a computer running the latest version of the High Sierra operating system admin access simply by putting “root” in the user name field. The bug was publicized Tuesday by developer Lemi Orhan Ergin, founder of Software Craftsmanship...
MacOS 10.13 root Authentication Bypass (Security Update 2017-001)
The remote host is running a version of MacOS 10.13 or 10.13.1 that is missing a security update. It is, therefore, affected by a root authentication bypass vulnerability. A local attacker or a remote attacker with credentials for a standard user account has the ability to blank out the root...
FreeBSD -- OpenSSH Denial of Service vulnerability
Problem Description: There is no limit on the password length. Impact: A remote attacker may be able to cause an affected SSH server to use excessive amount of CPU by sending very long passwords, when PasswordAuthentication is enabled by the system administrator...
[SECURITY] Fedora 25 Update: sudo-1.8.20p2-1.fc25
Sudo superuser do allows a system administrator to give certain users or groups of users the ability to run some or all commands as root while logging all commands and arguments. Sudo operates on a per-command basis. It is not a replacement for the shell. Features include: the ability to restrict...
CVE-2017-1092
IBM Informix Open Admin Tool 11.5, 11.7, and 12.1 could allow an unauthorized user to execute arbitrary code as system admin on Windows servers. IBM X-Force ID: 120390...
Serv-U FTP/MFT Server Unauthorized Elevation of Privilege Vulnerability
Serv-U FTP/MFT Server are both widely used FTP server programs. An unauthorized elevation of privilege vulnerability exists in Serv-U FTP/MFT Server versions prior to 15.1.5, which can be exploited by an attacker to gain Serv-U administrative privileges and use the System Administrator account to...
XSS on Delete Webhook
It was possible for users with JIRA administrator rights to perform an XSS attack through convincing another user, potentially a user with system administrators rights, to delete a specific webhook...
Become a Linux Expert — Get this Online 5-Course Training Bundle
Linux is considered as one of the most favorite operating systems for hackers and security researchers. The open source operating system is often used for building technologies as it offers developers much room for modifications. Linux is used on many hardware platforms, servers, gaming platforms...
GLSA-201612-02 : DavFS2: Local privilege escalation
The remote host is affected by the vulnerability described in GLSA-201612-02 DavFS2: Local privilege escalation DavFS2 installs /usr/sbin/mount.davfs as setuid root. This utility uses system to call /sbin/modprobe. While the call to modprobe itself cannot be manipulated, a local authenticated use...
[SECURITY] Fedora 24 Update: sudo-1.8.18p1-1.fc24
Sudo superuser do allows a system administrator to give certain users or groups of users the ability to run some or all commands as root while logging all commands and arguments. Sudo operates on a per-command basis. It is not a replacement for the shell. Features include: the ability to restrict...
Empty REST API result return for User without Browse Users permission
h3. Summary User A who do not have permission to Browse Users but have Administrator and/or System Administrator will have REST API result return empty. As an example of the json data return: code:borderStyle=dashed code h3. Steps to Reproduce Create User A Gives User A permission to Administrato...
ABB DataManagerPro Elevation of Privilege Vulnerability
ABB DataManagerPro is data management and analysis software. ABB DataManagerPro has a security vulnerability in the file permission settings during installation that could allow an attacker to elevate its privileges to system administrator...