203 matches found
CVE-2022-50927
Cyclades Serial Console Server 3.3.0 contains a local privilege escalation vulnerability due to overly permissive sudo privileges for the admin user and admin group. Attackers can exploit the default user configuration to gain root access by manipulating system binaries and leveraging unrestricte...
CVE-2024-39033
In Newgensoft OmniDocs 11.0SP103006, Insecure Direct Object Reference IDOR in the getuserproperty function allows user's configuration and PII to be stolen...
CVE-2023-50313
IBM WebSphere Application Server 8.5 and 9.0 could provide weaker than expected security for outbound TLS connections caused by a failure to honor user configuration. IBM X-Force ID: 274812...
CVE-2019-12348
An issue was discovered in zzcms 2019. SQL Injection exists in user/ztconfig.php via the daohang or img POST parameter...
theshit vulnerable to unsafe loading of user-owned Python rules when running as root
The application loads custom Python rules and configuration files from user-writable locations e.g., /.config/theshit/ without validating ownership or permissions when executed with elevated privileges. If the tool is invoked with sudo or otherwise runs with an effective UID of root, it continues...
CVE-2023-53879 NVClient 5.0 Stack Buffer Overflow Vulnerability via User Configuration
NVClient 5.0 contains a stack buffer overflow vulnerability in the user configuration contact field that allows attackers to crash the application. Attackers can overwrite 846 bytes of memory by pasting a crafted payload into the contact box, causing a denial of service condition...
CVE-2025-56802
The Reolink desktop application uses a hard-coded and predictable AES encryption key to encrypt user configuration files allowing attackers with local access to decrypt sensitive application data stored in %APPDATA%. A different vulnerability than CVE-2025-56801. NOTE: the Supplier's position is...
CVE-2025-56802
The Reolink desktop application (specifically version 8.18.12 ) is vulnerable to a cryptographic flaw where it uses hard-coded and predictable AES-CFB keys to protect user configuration files. An attacker with local access can navigate to the %APPDATA% directory to locate files such as .json. The...
Remote Code Execution
Flowise is vulnerable toRemote Code Execution. The vulnerability is due to unsafe evaluation of user-supplied configuration in the convertToValidJSONString function executing the mcpServerConfig input as JavaScript, An attackers can use this to execute arbitrary Node.js code to run commands or...
EUVD-2019-3154
Malware in sbrugna...
EUVD-2014-8502
Malware in sbrugna...
EUVD-2008-5374
Malware in sbrugna...
EUVD-2014-9504
Malware in sbrugna...
EUVD-2018-11529
Malware in sbrugna...
EUVD-2018-8827
Malware in sbrugna...
EUVD-2018-3490
Malware in sbrugna...
EUVD-2019-3983
Malware in sbrugna...
EUVD-2025-12710
Malicious code in bioql PyPI...