CVE-2022-27217

Jenkins Vmware vRealize CodeStream Plugin 1.2 and earlier stores passwords unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system...

Design/Logic Flaw

Jenkins incapptic connect uploader Plugin 1.15 and earlier stores tokens unencrypted in job config.xml files on the Jenkins controller where they can be viewed by users with Extended Read permission, or access to the Jenkins controller file system...

CVE-2022-27218

CVE-2022-27218 affects Jenkins incapptic connect uploader Plugin 1.15 and earlier. The connected Red Hat/NVD/OSV/GHSA entries confirm that tokens are stored unencrypted in job config.xml files on the Jenkins controller and can be viewed by users with Extended Read permission or with access to the...

CVE-2022-27217

CVE-2022-27217 affects Jenkins Vmware vRealize CodeStream Plugin 1.2 and earlier. The vulnerability is an information disclosure where passwords are stored unencrypted in job config.xml on the Jenkins controller and can be viewed by users with Extended Read permission or with access to the contro...

PT-2022-18304 · Jenkins · Jenkins Dbcharts Plugin +1

Name of the Vulnerable Software and Affected Versions: Jenkins dbCharts Plugin versions 0.5.2 and earlier Description: The issue concerns the storage of JDBC connection passwords in the global configuration file on the Jenkins controller. These passwords are stored unencrypted and can be viewed b...

CVE-2022-24618

Heimdal.Wizard.exe installer in Heimdal Premium Security 2.5.395 and earlier has insecure permissions, which allows unprivileged local users to elevate privileges to SYSTEM via the "Browse For Folder" window accessible by triggering a "Repair" on the MSI package located in C:\Windows\Installer...

CVE-2022-24618

Heimdal.Wizard.exe installer in Heimdal Premium Security 2.5.395 and earlier has insecure permissions, which allows unprivileged local users to elevate privileges to SYSTEM via the "Browse For Folder" window accessible by triggering a "Repair" on the MSI package located in C:\Windows\Installer...

Directory Traversal

Rust is vulnerable to directory traversal. The vulnerability exists due to a race condition which allows an attacker to access the file system of the application...

Heimdal Premium Security 安全漏洞

Heimdal Premium Security is an antivirus security software from the Danish company Heimdal. A security vulnerability exists in Heimdal Premium Security 2.5.395 and earlier versions, which stems from an insecure privilege setting in the Heimdal.Wizard.exe installer. The vulnerability can be...

otris Update Manager 授权问题漏洞

otris Update Manager is used by otris for compliance digitization. A security vulnerability exists in otris Update Manager 1.2.1.0 that allows local users to gain access to SYSTEM via unauthenticated calls and allows remote attacks on HTTP traffic on TCP port 9000 using WsHTTPBinding...

CVE-2021-40376

otris Update Manager 1.2.1.0 allows local users to achieve SYSTEM access via unauthenticated calls to exposed interfaces over a .NET named pipe. A remote attack may be possible as well, by leveraging WsHTTPBinding for HTTP traffic on TCP port 9000...

CVE-2021-40376

CVE-2021-40376 affects otris Update Manager 1.2.1.0. The vulnerability allows local users to obtain SYSTEM privileges by sending unauthenticated calls to exposed interfaces via a .NET named pipe. A remote attack may be possible by abusing WsHTTPBinding for HTTP traffic on TCP port 9000. CVSS data...

CVE-2021-32008 Logged-in Administrator may get unrestricted file system access

This issue affects: Secomea GateManager Version 9.6.621421014 and all prior versions. Improper Limitation of a Pathname to restricted directory, allows logged in GateManager admin to delete system Files or Directories...

Denial Of Service (DoS)

com.liferay.layout.admin.web is vulnerable to denial of service. The vulnerability exists due to improper handle of user privileges in script.jsp file allows a remote attacker to restrict system access to the legitimate users...

CVE-2022-25623

The Symantec Management Agent is susceptible to a privilege escalation vulnerability. A low privilege local account can be elevated to the SYSTEM level through registry manipulations...

PT-2022-17416 · Symantec · Symantec Management Agent

Name of the Vulnerable Software and Affected Versions: Symantec Management Agent affected versions not specified Description: The Symantec Management Agent is susceptible to a privilege escalation issue. A low privilege local account can be elevated to the SYSTEM level through registry...

Execution with Unnecessary Privileges in arc-electron

Impact When the end-user click on the response header that contains a link the target will be opened in ARC new window. This window will have the default preload script loaded which allows the scripts embedded in the link target to execute any logic that ARC has access to from the renderer proces...

CVE-2022-25010

The component /rootfs in RageFile of Stepmania v5.1b2 and below allows attackers access to the entire file system...

CVE-2022-25010

The component /rootfs in RageFile of Stepmania v5.1b2 and below allows attackers access to the entire file system...

CVE-2022-25010

CVE-2022-25010 affects Stepmania v5.1b2 and earlier, where the /rootfs component in RageFile can be exploited to access the entire file system. Affected software: Stepmania; vulnerable component: RageFile’s /rootfs. Root cause described across sources as lack of privilege restrictions enabling el...