5522 matches found
CVE-2023-38817
An issue in Inspect Element Ltd Echo.ac v.5.2.1.0 allows a local attacker to gain privileges via a crafted command to the echodriver.sys component. NOTE: the vendor's position is that the reported ability for user-mode applications to execute code as NT AUTHORITY\SYSTEM was "deactivated by...
CVE-2023-38817
An issue in Inspect Element Ltd Echo.ac v.5.2.1.0 allows a local attacker to gain privileges via a crafted command to the echodriver.sys component. NOTE: the vendor's position is that the reported ability for user-mode applications to execute code as NT AUTHORITY\SYSTEM was "deactivated by...
CVE-2023-38817
CVE-2023-38817 concerns Inspect Element Ltd Echo.ac v5.2.1.0. Red Hat and other sources confirm a local privilege escalation via a crafted command to the echo_driver.sys component, enabling a user to gain privileges (NT AUTHORITY\SYSTEM). The issue’s root cause is a problematic interaction with e...
GHSA-QPPJ-FM5R-HXR3 vulnerabilities
Vulnerabilities for packages: hey, kube-oidc-proxy, metrics-server-fips, gobuster, envoy-ratelimit, terraform-provider-azurerm, configmap-reload-fips, pulumi-language-yaml, src, k3d, bom, gke-gcloud-auth-plugin, metrics-server, kubeflow, frp, kubernetes-csi-livenessprobe-fips, cue,...
CVE-2023-44487 vulnerabilities
Vulnerabilities for packages: hey, kube-oidc-proxy, metrics-server-fips, gobuster, envoy-ratelimit, terraform-provider-azurerm, configmap-reload-fips, pulumi-language-yaml, src, k3d, bom, gke-gcloud-auth-plugin, metrics-server, kubeflow, frp, kubernetes-csi-livenessprobe-fips, cue,...
CVE-2023-45205
A vulnerability has been identified in SICAM PAS/PQS All versions = V8.00 V8.20. The affected application is installed with specific files and folders with insecure permissions. This could allow an authenticated local attacker to inject arbitrary code and escalate privileges to NT AUTHORITY/SYSTE...
Code injection
A vulnerability has been identified in SICAM PAS/PQS All versions = V8.00 V8.20. The affected application is installed with specific files and folders with insecure permissions. This could allow an authenticated local attacker to inject arbitrary code and escalate privileges to NT AUTHORITY/SYSTE...
CVE-2023-45205
A vulnerability has been identified in SICAM PAS/PQS All versions = V8.00 V8.20. The affected application is installed with specific files and folders with insecure permissions. This could allow an authenticated local attacker to inject arbitrary code and escalate privileges to NT AUTHORITY/SYSTE...
CVE-2023-45205
A vulnerability has been identified in SICAM PAS/PQS All versions = V8.00 V8.20. The affected application is installed with specific files and folders with insecure permissions. This could allow an authenticated local attacker to inject arbitrary code and escalate privileges to NT AUTHORITY/SYSTE...
Security Bulletin: Storage Virtualize ansible collection is affected by a vulnerability in the Python Cryptographic Authority package [CVE-2023-38325]
Summary The Python Cryptographic Authority package is used by paramiko, a third party library, which is used by Ansible collection for Storage Virtualize for authentication to target systems. This library is vulnerable to CVE-2023-38325. Vulnerability Details CVEID:CVE-2023-38325 DESCRIPTION:...
Tennessee Valley Authority: File listing through scripts folder
Files were publicly accessible through a SharePoint site, allowing attackers to potentially enumerate sensitive information...
Open redirect
Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority...
Security Bulletin: IBM Watson Discovery Cartridge for IBM Cloud Pak for Data affected by vulnerability in Python Cryptographic Authority cryptography
Summary IBM Watson Discovery Cartridge for IBM Cloud Pak for Data contains a vulnerable version of Python Cryptographic Authority cryptography. Vulnerability Details CVEID:CVE-2023-38325 DESCRIPTION: Python Cryptographic Authority cryptography could provide weaker than expected security, caused b...
Progress Software WS_FTP Unauthenticated Remote Code Execution
This module exploits an unsafe .NET deserialization vulnerability to achieve unauthenticated remote code execution against a vulnerable WSFTP server running the Ad Hoc Transfer module. All versions of WSFTP Server prior to 2020.0.4 version 8.7.4 and 2022.0.2 version 8.8.2 are vulnerable to this...
Ivanti Avalanche MDM Buffer Overflow
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Ivanti Avalanche MDM Buffer Overflow', 'Description' = %q This module exploits a buffer overflow condition in Ivanti Avalanche MDM versions befor...
Ivanti Avalanche MDM Buffer Overflow Exploit
This Metasploit module exploits a buffer overflow condition in Ivanti Avalanche MDM versions prior to 6.4.1. An attacker can send a specially crafted message to the Wavelink Avalanche Manager, which could result in arbitrary code execution with the NT/AUTHORITY SYSTEM permissions. This...
September 12, 2023—KB5030216 (OS Build 20348.1970)
None None...
FAS - Logon error, one of the CAs is not trusted
FAS logon fails with an error "The username or password is incorrect". Events are logged on CA/FAS/VDA/Domain Controllers that one of the CAs is not trusted, usually after a CA Certificate is changed/renewed...
Security Bulletin: z/Transaction Processing Facility is affected by a vulnerability in the Python Cryptographic Authority package [CVE-2023-38325]
Summary The Python Cryptographic Authority package is used by the z/TPF real-time insights dashboard starter kit when connecting to a MySQL database from Python. The starter kit was updated to address the vulnerability described by CVE-2023-38325. Vulnerability Details CVEID:CVE-2023-38325...
