Siemens Totally Integrated Automation Portal vulnerable to privilege escalation due to Node.js paths

Overview Siemens Totally Integrated Administrator TIA fails to properly set the module search path to be used by a privileged Node.js component, which can allow an unprivileged Windows user to run arbitrary code with SYSTEM privileges. The PCS neo administration console is reported to be affected...

NetMotion Mobility 代码问题漏洞

NetMotion Mobility is client/server software that securely extends enterprise networks to mobile environments. A remote code execution vulnerability exists in NetMotion Mobility. The vulnerability stems from Java deserialization in RpcServlet. A remote, unauthenticated attacker could exploit the...

NetMotion Mobility 代码问题漏洞

NetMotion Mobility is client/server software that securely extends enterprise networks to mobile environments. A remote code execution vulnerability exists in NetMotion Mobility. The vulnerability stems from Java deserialization in MvcUtil valueStringToObject. A remote, unauthenticated attacker...

NetMotion Mobility 代码问题漏洞

NetMotion Mobility is client/server software that securely extends enterprise networks to mobile environments. A remote code execution vulnerability exists in NetMotion Mobility. The vulnerability stems from Java deserialization in the webrepdb StatusServlet. A remote, unauthenticated attacker...

VulnCheck KEV: CVE-2021-3122

CMCAgent in NCR Command Center Agent 16.3 on Aloha POS/BOH servers permits the submission of a runCommand parameter within an XML document sent to port 8089 that enables the remote, unauthenticated execution of an arbitrary command as SYSTEM, as exploited in the wild in 2020 and/or 2021. NOTE: th...

CVE-2021-0344

In mtkpower, there is a possible memory corruption due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Product: Android; Versions: Android-10, Android-11; Patch ID: ALPS05437558...

CVE-2021-0348

In vpu, there is a possible out of bounds write due to a missing bounds check. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Product: Android; Versions: Android-9, Android-10, Android-11; Patch ID:...

CVE-2021-0347

In ccu, there is a possible out of bounds read due to a missing bounds check. This could lead to local information disclosure with System execution privileges needed. User interaction is needed for exploitation. Product: Android; Versions: Android-8.1, Android-9, Android-10, Android-11; Patch ID:...

Vulnerability found in Adobe ColdFusion

A vulnerability has been found in Adobe ColdFusion. Due to an error in the permissions structure, a local malicious agent can place a specially prepared DLL file to execute arbitrary code under SYSTEM privileges. For more information, see the page below: https://www.kb.cert.org/vuls/id/125331 At...

CVE-2021-0362

In aee, there is a possible memory corruption due to a stack buffer overflow. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Product: Android; Versions: Android-11; Patch ID: ALPS05457070...

CVE-2021-0352

In RT regmap driver, there is a possible memory corruption due to type confusion. This could lead to local denial of service with System execution privileges needed. User interaction is not needed for exploitation. Product: Android; Versions: Android-10, Android-11; Patch ID: ALPS05453809...

CVE-2021-0365

In display driver, there is a possible memory corruption due to a use after free. This could lead to local escalation of privilege with System execution privileges needed. User interaction is not needed for exploitation. Product: Android; Versions: Android-10, Android-11; Patch ID: ALPS05454782...

Command execution vulnerability exists in SEACMS (CNVD-2021-15533)

SEACMS is a video-on-demand system designed for webmasters with different needs. A command execution vulnerability exists in SEACMS. An attacker can exploit this vulnerability to inject malicious code, execute system commands, and obtain system privileges...

Google Android 缓冲区错误漏洞

Google Android is a Linux-based open source operating system developed by Google and the Open Handheld Consortium Google. Google Android 11 suffers from a buffer overflow vulnerability that originates from memory corruption in ksd due to a heap buffer overflow. An attacker can exploit the...

Adobe ColdFusion is vulnerable to privilege escalation due to weak ACLs

Overview Adobe ColdFusion fails to properly set ACLs, which can allow an unprivileged Windows user to be able to run arbitrary code with SYSTEM privileges. Description The Adobe ColdFusion installer fails to set a secure access-control list ACL on the default installation directory, such as...

The vulnerabilities of the Network Access Manager and Web Security Agent components of the Cisco AnyConnect Secure Mobility Client cryptographic security tool for Windows allow a perpetrator to execute arbitrary code.

The vulnerability of the Network Access Manager and Web Security Agent components of the Cisco AnyConnect Secure Mobility Client cryptographic security solution for Windows is related to an uncontrolled element in the search path. Exploiting this vulnerability could allow a attacker to execute...

Proofpoint Insider Threat Management Server Security Vulnerability

Proofpoint Insider Threat Management Server is a server-side application from Proofpoint, Inc. that is used to prevent malicious operations by enterprise insiders. A security vulnerability exists in the Insider Threat Management Windows Agent Local Privilege Escalation, which stems from the...

Binary Vulnerability in Avira Antivirus

Avira AntiVirus is a suite of antivirus programs. A binary vulnerability exists in Avira Antivirus. An attacker can exploit the vulnerability to write to arbitrary files with system privileges...

Acronis: Acronis True Image 2020 Build 22510 Nonstop Backup Service Unquoted service path (privilege escalation)

Vulnerability description not provided...

CVE-2021-1280

A vulnerability in the loading mechanism of specific DLLs of Cisco Advanced Malware Protection AMP for Endpoints for Windows and Immunet for Windows could allow an authenticated, local attacker to perform a DLL hijacking attack. To exploit this vulnerability, the attacker would need valid...