kylinos kylin-system-updater OS Command Injection Vulnerability

kylinos kylin-system-updater is an operating system component from China's KylinSoft kylinos. An operating system command injection vulnerability exists in KylinSoft kylin-system-updater 2.0.5.16-0k2.33 and earlier versions, which originates in /usr/share/kylin-system-...

CVE-2023-7093: Improper Neutralization of Special Elements used in an OS Command

A vulnerability classified as critical has been found in KylinSoft kylin-system-updater up to 2.0.5.16-0k2.33. Affected is an unknown function of the file /usr/share/kylin-system-updater/SystemUpdater/UpgradeStrategiesDbus.py of the component com.kylin.systemupgrade Service. The manipulation of t...

Plantronics Hub – Local Privilege Escalation

A privilege escalation exists in the updater for Plantronics Hub 3.25.1 and below. Upgrade to the latest version of Plantronics Hub 3.25.2...

Parallels Desktop Updater Link Following Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Desktop. An attacker must first obtain the ability to execute low-privileged code on the target host system in order to exploit this vulnerability. The specific flaw exists within the Updater...

PT-2024-5220 · Google +3 · Google Chrome +3

Name of the Vulnerable Software and Affected Versions: Google Chrome versions prior to 120.0.6099.62 Description: The issue is related to insufficient data validation in the Updater component of Google Chrome, allowing a remote attacker to perform OS-level privilege escalation via a malicious fil...

The vulnerability of the Updater service in Parallels Desktop hypervisor allows a hacker to execute arbitrary code and increase their privileges.

The vulnerability of the Toolgate controller in Parallels Desktop lies in initialization errors. Exploiting this vulnerability allows an attacker to execute arbitrary code and enhance their privileges...

The vulnerability of the Updater service in Parallels Desktop hypervisor allows a hacker to execute arbitrary code and increase their privileges.

The vulnerability of the Updater service in Parallels Desktop operating systems is related to initialization errors. Exploiting this vulnerability allows an attacker to execute arbitrary code and increase their privileges...

The vulnerability of the Updater service in Parallels Desktop hypervisor allows a hacker to execute arbitrary code and increase their privileges.

The vulnerability of the Updater service in Parallels Desktop operating systems is related to synchronization errors when using a shared resource. Exploiting this vulnerability allows an attacker to execute arbitrary code and increase their privileges...

Agent Racoon Backdoor Targets Organizations in Middle East, Africa, and U.S.

Organizations in the Middle East, Africa, and the U.S. have been targeted by an unknown threat actor to distribute a new backdoor called Agent Racoon. "This malware family is written using the .NET framework and leverages the domain name service DNS protocol to create a covert channel and provide...

CVE-2023-32658

Unquoted search path in some IntelR NUC Kits NUC7i3DN, NUC7i5DN, NUC7i7DN HDMI firmware update tool software before version 1.79.1.1 may allow an authenticated user to potentially enable escalation of privilege via local access...

Information Disclosure

@tauri-apps/cli is vulnerable to Information Disclosure. This vulnerability is due to a commonly used misconfiguration which leads to the leakage of the private key and updater key password. If envPrefix: 'VITE', 'TAURI', was pasted from the documentation into vite.config.ts, the TAURIPRIVATEKEY...

Tauri's Updater Private Keys Possibly Leaked via Vite Environment Variables

Impact This advisory is not describing a vulnerability in the Tauri code base itself but a commonly used misconfiguration which could lead to leaking of the private key and updater key password into bundled Tauri applications using the Vite frontend in a specific configuration. The Tauri...

CVE-2023-46115 Updater Private Keys Possibly Leaked via Vite Environment Variables in tauri-cli

Tauri is a framework for building binaries for all major desktop platforms. This advisory is not describing a vulnerability in the Tauri code base itself but a commonly used misconfiguration which could lead to leaking of the private key and updater key password into bundled Tauri applications...

Exploit for Code Injection in Cisco Telepresence_Video_Communication_Server

I started looking at Cisco Expressway after I noticed quite a fe...

WordPress Comment Blacklist Updater Plugin <= 1.1.0 is vulnerable to Broken Access Control

Software Comment Blacklist Updater Type Plugin Vulnerable versions = 1.1.0 Fixed in 1.2.0 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-44147 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 32e14d976eb2 Credits Nguyen Xuan Chien...

CVE-2023-41902

An XPC misconfiguration vulnerability in CoreCode MacUpdater before 2.3.8, and 3.x before 3.1.2, allows attackers to escalate privileges by crafting malicious .pkg files...

Oracle Linux 6 : firefox (ELSA-2018-2693)

The remote Oracle Linux 6 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2018-2693 advisory. - Added fix for mozbz1348168/CVE-2017-5428 Tenable has extracted the preceding description block directly from the Oracle Linux security advisory. Note...

PT-2023-8166 · Parallels · Parallels Desktop

Name of the Vulnerable Software and Affected Versions: Parallels Desktop affected versions not specified Description: The issue is related to the improper verification of a cryptographic signature in the Updater service of Parallels Desktop, allowing local attackers to escalate privileges and...

Veeam Backup for Microsoft 365 Updater Fails With: "Error opening installation log file."

Challenge For Veeam Backup for Microsoft 365 deployments from AWS Marketplace or Microsoft Marketplace, when attempting to install discovered updates or when the auto-updater attempts to update Veeam Backup for Microsoft 365, the update process fails with the error: Error opening installation log...

CVE-2023-2317

DOM-based XSS in updater/update.html in Typora before 1.6.7 on Windows and Linux allows a crafted markdown file to run arbitrary JavaScript code in the context of Typora main window via loading typora://app/typemark/updater/update.html in tag. This vulnerability can be exploited if a user opens a...