278 matches found
CVE-2023-42702
In firewall service, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed...
CVE-2023-42699
In omacp service, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed...
CVE-2023-42698
In omacp service, there is a possible way to write permission usage records of an app due to a missing permission check. This could lead to local information disclosure with no additional execution privileges needed...
CVE-2023-42674
CVE-2023-42674 affects the IMS service (imsservice) in UNISOC chipsets. The vulnerability arises from a missing permission check that permits writing permission usage records for an app, enabling local information disclosure without requiring additional execution privileges. Multiple sources corr...
CVE-2023-42655
CVE-2023-42655 relates to the sim service where there is a missing permission check that allows writing permission usage records, enabling local privilege escalation to System level. The advisory consistently references the sim service as the affected component and describes the root cause as ins...
CVE-2023-40361
SECUDOS Qiata DOMOS OS 4.13 has Insecure Permissions for the previewRm.sh daily cronjob. To exploit this, an attacker needs access as a low-privileged user to the underlying DOMOS system. Every user on the system has write permission for previewRm.sh, which is executed by the root user...
GitHub: [PATs] Token with Read-Only permissions on Issues able to modify issue comments using content write permission
An incorrect authorization vulnerability was identified in GitHub Enterprise Server that allowed issue comments to be updated with an improperly scoped token...
CVE-2021-46891
Vulnerability of incomplete read and write permission verification in the GPU module. Successful exploitation of this vulnerability may affect service confidentiality, integrity, and availability...
CVE-2021-46890
Vulnerability of incomplete read and write permission verification in the GPU module. Successful exploitation of this vulnerability may affect service confidentiality, integrity, and availability...
Huawei HarmonyOS 安全漏洞
Huawei HarmonyOS is an operating system from Huawei, a Chinese company. It provides a full-scenario distributed operating system based on a microkernel.Huawei EMUI is a user interface developed by Huawei based on the Android operating system. A security bypass vulnerability exists in Huawei...
Denial Of Service (DoS)
github.com/hashicorp/consul is vulnerable to Denial Of Service DoS. The vulnerability exists because upstream watch handling was shared between connect-proxy and gateways, allowing an attacker with service:write permission to cause a server and client crash...
Consul Server Panic when Ingress and API Gateways Configured with Peering Connections
Summary A vulnerability was identified in Consul and Consul Enterprise “Consul” an authenticated user with service:write permissions could trigger a workflow that causes Consul server and client agents to crash under certain circumstances. This vulnerability, CVE-2023-0845, was fixed in Consul...
SUSE CVE-2013-2033
Cross-site scripting XSS vulnerability in Jenkins before 1.514, LTS before 1.509.1, and Enterprise 1.466.x before 1.466.14.1 and 1.480.x before 1.480.4.1 allows remote authenticated users with write permission to inject arbitrary web script or HTML via unspecified vectors...
SUSE CVE-2013-3703
The controller of the Open Build Service API prior to version 2.4.4 is missing a write permission check, allowing an authenticated attacker to add or remove user roles from packages and/or project meta data...
SUSE CVE-2023-0242
Rapid7 Velociraptor allows users to be created with different privileges on the server. Administrators are generally allowed to run any command on the server including writing arbitrary files. However, lower privilege users are generally forbidden from writing or modifying files on the server. Th...
CVE-2022-45301
Insecure permissions in Chocolatey Ruby package v3.1.2.1 and below grants all users in the Authenticated Users group write privileges for the path C:\tools\ruby31 and all files located in that folder...
Chocolatey Azure-Pipelines-Agent 安全漏洞
Chocolatey can handle various types of installation packages.Azure Pipelines Agent Also known as Azure Pipelines Agent, it is mainly used to generate code or deploy software in the Devops process. A privilege design vulnerability exists in the Chocolatey Azure Pipelines Agent package v2.211.1 and...
PT-2022-23177 · Gocd · Gocd
Name of the Vulnerable Software and Affected Versions: GoCD versions prior to 22.2.0 Description: GoCD is a continuous delivery server. The issue arises from inadequate permission restrictions during Windows installations of GoCD server or agent installers outside of the default location. This...
OESA-2022-1878 samba security update
Samba is a suite of programs for Linux and Unix to interoperate with Windows. Security Fixes: CVE-2022-32743 samba: Validated dnsHostname write right needs to be implemented https://bugzilla.samba.org/showbug.cgi?id=14833CVE-2022-32743...