PT-2024-7402 · Cisco · Cisco Ios Xr

Name of the Vulnerable Software and Affected Versions: Cisco IOS XR Software affected versions not specified Description: A vulnerability in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker to obtain read/write file system access on the underlying operating system of ...

The vulnerability of the kernel driver of Windows operating systems allows attackers to elevate their privileges to the SYSTEM level.

The vulnerability of the kernel driver of Windows operating systems relates to the execution of operations beyond the buffer in memory. Exploiting this vulnerability can allow an attacker to elevate their privileges to the SYSTEM level...

CVE-2024-8441

An uncontrolled search path in the agent of Ivanti EPM before 2022 SU6, or the 2024 September update allows a local authenticated attacker with admin privileges to escalate their privileges to SYSTEM...

CVE-2024-45593

Nix is a package manager for Linux and other Unix systems. A bug in Nix 2.24 prior to 2.24.6 allows a substituter or malicious user to craft a NAR that, when unpacked by Nix, causes Nix to write to arbitrary file system locations to which the Nix process has access. This will be with root...

PT-2024-6214 · Ivanti · Ivanti Epm

Name of the Vulnerable Software and Affected Versions: Ivanti EPM versions prior to 2022 SU6 Ivanti EPM versions prior to the 2024 September update Description: The issue is related to an uncontrolled search path in the agent of Ivanti EPM. This can be exploited by a local authenticated attacker...

CVE-2024-40712

A path traversal vulnerability allows an attacker with a low-privileged account and local access to the system to perform local privilege escalation LPE...

flatpak: Access to files outside sandbox for apps using persistent= (--persist)

A sandbox escape vulnerability was found in Flatpak due to a symlink-following issue when mounting persistent directories. This flaw allows a local user or attacker to craft a symbolic link that can bypass the intended restrictions, enabling access to and modification of files outside the...

Remote Code Execution

mlflow is vulnerable to Remote Code Execution. The vulnerability is caused due to a defect where mflow allows to write/overwrite any file on the file system. A malicious user could use this issue to get command execution on the vulnerable machine and get access to data & models information...

PT-2024-38613 · Overwolf · Overwolf

Name of the Vulnerable Software and Affected Versions: Overwolf affected versions not specified Description: A local privilege escalation issue is caused by Overwolf loading and executing certain dynamic link library files from a user-writeable folder in SYSTEM context on launch. This allows an...

CVE-2024-36442

cgi-bin/fdmcgiwebv2.cgi on Swissphone DiCal-RED 4009 devices allows an authenticated attacker to gain access to arbitrary files on the device's file system...

PT-2024-23335 · G Data · G Data Total Security

Name of the Vulnerable Software and Affected Versions: G DATA Total Security affected versions not specified Description: This issue allows local attackers to escalate privileges on affected installations of G DATA Total Security. An attacker must first obtain the ability to execute low-privilege...

CVE-2024-36442

cgi-bin/fdmcgiwebv2.cgi on Swissphone DiCal-RED 4009 devices allows an authenticated attacker to gain access to arbitrary files on the device's file system...

PT-2024-27003 · Swissphone · Swissphone Dical-Red 4009

Name of the Vulnerable Software and Affected Versions: Swissphone DiCal-RED 4009 version not specified Description: The issue allows a remote attacker to gain read access to almost the whole file system via anonymous FTP. This could potentially expose sensitive data. There is no information...

CVE-2024-36442

Swissphone DiCal-RED 4009 devices are affected by CVE-2024-36442 due to a path traversal flaw in cgi-bin/fdmcgiwebv2.cgi. An authenticated attacker can access arbitrary files on the device filesystem. Public advisories (SySS SYSS-2024-039; PacketStorm) confirm a Path Traversal vulnerability (CWE-...

CVE-2020-11847

SSH authenticated user when access the PAM server can execute an OS command to gain the full system access using bash. This issue affects Privileged Access Manager before 3.7.0.1...

CVE-2020-11847

SSH authenticated user when access the PAM server can execute an OS command to gain the full system access using bash. This issue affects Privileged Access Manager before 3.7.0.1...

CVE-2020-11847 Vulnerability in sshrelay in privileged access manager provides full system access.

SSH authenticated user when access the PAM server can execute an OS command to gain the full system access using bash. This issue affects Privileged Access Manager before 3.7.0.1...

CVE-2020-11847 Vulnerability in sshrelay in privileged access manager provides full system access.

SSH authenticated user when access the PAM server can execute an OS command to gain the full system access using bash. This issue affects Privileged Access Manager before 3.7.0.1...

CVE-2020-11847

CVE-2020-11847 affects OpenText NetIQ Privileged Account Manager (PAM) prior to 3.7.0.1. An SSH-authenticated user can access the PAM server and run an OS command via bash to obtain full system access. The root cause is exposure of command execution during SSH access to the PAM server, as describ...

Voltronic Power ViewPower Remote Code Execution Vulnerability (CNVD-2025-21586)

Voltronic Power ViewPower is Voltronic Power's monitoring and management software for solar inverters. Voltronic Power ViewPower suffers from a remote code execution vulnerability that is caused by a lack of proper validation of user-supplied data, which could lead to deserialization of...