CVE-2024-47902

CVE-2024-47902 affects Siemens InterMesh 7177 Hybrid 2.0 Subscriber (all versions < 8.2.12) and InterMesh 7707 Fire Subscriber (all versions

CVE-2024-47901

A vulnerability has been identified in InterMesh 7177 Hybrid 2.0 Subscriber All versions V8.2.12, InterMesh 7707 Fire Subscriber All versions V7.2.12 only if the IP interface is enabled which is not the default configuration. The web server of affected devices does not sanitize the input paramete...

CVE-2023-6080

Lakeside Software’s SysTrack LsiAgent Installer version 10.7.8 for Windows contains a local privilege escalation vulnerability which allows attackers SYSTEM level access...

CVE-2023-6080

CVE-2023-6080 affects Lakeside Software’s SysTrack LsiAgent Installer for Windows v10.7.8. The issue is a local privilege escalation in the installer that can give an attacker SYSTEM-level access, stemming from flaws in the MSI repair process. Remediation: Lakeside recommends updating to v11.0 to...

RLSA-2024:6837 Important: pcp security update

Performance Co-Pilot PCP is a suite of tools, services, and libraries for acquisition, archiving, and analysis of system-level performance measurements. Its light-weight distributed architecture makes it particularly well-suited to centralized analysis of complex systems. Security Fixes: pcp:...

Cognex In-Sight OPC Server Deserialization of Untrusted Data (CVE-2021-32935)

The affected Cognex product, the In-Sight OPC Server versions v5.7.4 96 and prior, deserializes untrusted data, which could allow a remote attacker access to system level permission commands and local privilege escalation. This plugin only works with Tenable.ot. Please visit...

The vulnerability of the Ivanti EPM endpoint management software is related to an uncontrolled element in the search process. This allows a malicious individual to elevate their privileges to SYSTEM level.

The vulnerability of the Ivanti EPM endpoint management software is related to an uncontrolled element in the search process. Exploiting this vulnerability can allow a perpetrator to increase their privileges to SYSTEM level...

The vulnerability of the Citrix Workspace App for Windows lies in its insecure handling of privileges, allowing an attacker to elevate their privileges to the SYSTEM level.

The vulnerability of the Citrix Workspace App for Windows relates to insecure management of privileges. Exploiting this vulnerability could allow an attacker to elevate their privileges to the SYSTEM level...

Google to Remove App that Made Google Pixel Devices Vulnerable to Attacks

A large percentage of Google's own Pixel devices shipped globally since September 2017 included dormant software that could be used to stage nefarious attacks and deliver various kinds of malware. The issue manifests in the form of a pre-installed Android app called "Showcase.apk" that comes with...

CVE-2024-7062 Local Privilege Escalation in Nimble Commander <= v1.6.0, Build 4087

Nimble Commander suffers from a privilege escalation vulnerability due to the server info.filesmanager.Files.PrivilegedIOHelperV2 performing improper/insufficient validation of a client’s authorization before executing an operation. Consequently, it is possible to execute system-level commands as...

CVE-2024-7062

CVE-2024-7062 affects Nimble Commander. The vulnerability is located in the server component info.filesmanager.Files.PrivilegedIOHelperV2 and arises from improper/insufficient validation of a client’s authorization before executing an operation. As described in the connected documents, this can e...

CVE-2024-7062 Local Privilege Escalation in Nimble Commander <= v1.6.0, Build 4087

Nimble Commander suffers from a privilege escalation vulnerability due to the server info.filesmanager.Files.PrivilegedIOHelperV2 performing improper/insufficient validation of a client’s authorization before executing an operation. Consequently, it is possible to execute system-level commands as...

CVE-2024-40872

There is an elevation of privilege vulnerability in server and client components of Absolute Secure Access prior to version 13.07. Attackers with local access and valid desktop user credentials can elevate their privilege to system level by passing invalid address data to the vulnerable component...

CVE-2024-40872

CVE-2024-40872 describes an elevation-of-privilege flaw in Absolute Secure Access, affecting server and client components before version 13.07. Attackers with local access and valid desktop credentials can pass invalid address data to a vulnerable component to manipulate tokens and elevate a norm...

CVE-2024-40872 Elevation of privilege in Absolute Secure Access clients and servers

There is an elevation of privilege vulnerability in server and client components of Absolute Secure Access prior to version 13.07. Attackers with local access and valid desktop user credentials can elevate their privilege to system level by passing invalid address data to the vulnerable component...

CVE-2024-40872 Elevation of privilege in Absolute Secure Access clients and servers

There is an elevation of privilege vulnerability in server and client components of Absolute Secure Access prior to version 13.07. Attackers with local access and valid desktop user credentials can elevate their privilege to system level by passing invalid address data to the vulnerable component...

PT-2024-29123 · Unknown · Absolute Secure Access

Name of the Vulnerable Software and Affected Versions: Absolute Secure Access versions prior to 13.07 Description: The issue is related to an elevation of privilege vulnerability in server and client components. Attackers with local access and valid desktop user credentials can elevate their...

Command Injection

org.apache.streampark:streampark is vulnerable to Command Injection. The vulnerability is caused due to insufficient input parameter validation, allowing attackers to insert commands. Exploiting this requires system-level access via user login, thereby limiting its risk due to controlled user...

GHSA-5V69-92VW-FMJH Apache StreamPark: maven build params could trigger remote command execution

In streampark, the project module integrates Maven's compilation capabilities. The input parameter validation is not strict, allowing attackers to insert commands for remote command execution, The prerequisite for a successful attack is that the user needs to log in to the streampark system and...

CVE-2024-29737

In streampark, the project module integrates Maven's compilation capabilities. The input parameter validation is not strict, allowing attackers to insert commands for remote command execution, The prerequisite for a successful attack is that the user needs to log in to the streampark system and...