Design/Logic Flaw

HylaFAX+ through 7.0.2 and HylaFAX Enterprise have scripts that execute binaries from directories writable by unprivileged users e.g., locations under /var/spool/hylafax that are writable by the uucp account. This allows these users to execute code in the context of the user calling these binarie...

CVE-2020-8024

A Incorrect Default Permissions vulnerability in the packaging of hylafax+ of openSUSE Leap 15.2, openSUSE Leap 15.1, openSUSE Factory allows local attackers to escalate from user uucp to users calling hylafax binaries. This issue affects: openSUSE Leap 15.2 hylafax+ versions prior to...

PT-2020-19926

Name of the Vulnerable Software and Affected Versions hylafax+ versions prior to 7.0.2-lp152.2.1 hylafax+ version 5.6.1-lp151.3.7 and prior versions hylafax+ versions prior to 7.0.2-2.1 Description A vulnerability in the packaging of hylafax+ allows local attackers to escalate from user uucp to...

npm: Global node_modules Binary Overwrite

Versions of the npm CLI prior to 6.13.4 are vulnerable to an Arbitrary File Overwrite. It fails to prevent existing globally-installed binaries to be overwritten by other package installations. For example, if a package was installed globally and created a serve binary, any subsequent installs of...

Digital Signature Hijack - Binaries, PowerShell Scripts And Information About Digital Signature Hijacking

Hijacking legitimate digital signatures is a technique that can be used during red team assessments in order to sign PowerShell code and binaries. This could assist to bypass Device Guard restrictions and maintain stealthy in an engagement. DigitalSignatureHijack is a PowerShell script based on...

EQGRP

This is a repository containing the decrypted content of eqgrp-auction-file.tar.xz. The repository includes three files: Linux/bin/7z, Linux/bin/7z.so, and Linux/bin/7za. These files are likely related to the 7-Zip file archiver. The files are in ELF Executable and Linkable Format format, which i...

Linux: Blacklisted binaries

Some binaries have security issues or should not be available on the host for other reasons. This script checks if any of the given binaries is installed on the host by using locate, whereis or which. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a...

Cisco IOS XE Software Digital Signature Verification Bypass (cisco-sa-iosxe-digsig-bypass-FYQ3bmVq)

According to its self-reported version, Cisco IOS XE Software is affected by a vulnerability due to an improper check on the area of code that manages the verification of the digital signatures of system image files during the initial boot process. An attacker could exploit this vulnerability by...

CVE-2020-3209

A vulnerability in software image verification in Cisco IOS XE Software could allow an unauthenticated, physical attacker to install and boot a malicious software image or execute unsigned binaries on an affected device. The vulnerability is due to an improper check on the area of code that manag...

Input validation

A vulnerability in software image verification in Cisco IOS XE Software could allow an unauthenticated, physical attacker to install and boot a malicious software image or execute unsigned binaries on an affected device. The vulnerability is due to an improper check on the area of code that manag...

CVE-2020-3209 Cisco IOS XE Software Digital Signature Verification Bypass Vulnerability

A vulnerability in software image verification in Cisco IOS XE Software could allow an unauthenticated, physical attacker to install and boot a malicious software image or execute unsigned binaries on an affected device. The vulnerability is due to an improper check on the area of code that manag...

CVE-2020-3209 Cisco IOS XE Software Digital Signature Verification Bypass Vulnerability

A vulnerability in software image verification in Cisco IOS XE Software could allow an unauthenticated, physical attacker to install and boot a malicious software image or execute unsigned binaries on an affected device. The vulnerability is due to an improper check on the area of code that manag...

CVE-2020-3209

Cisco IOS XE Software Digital Signature Verification Bypass (CVE-2020-3209) is triggered by an improper check during boot-time signature verification of system image files. The flaw resides in the area of code that verifies digital signatures, permitting an unauthenticated, physical attacker to l...

CVE-2020-3209: Improper Verification of Cryptographic Signature

A vulnerability in software image verification in Cisco IOS XE Software could allow an unauthenticated, physical attacker to install and boot a malicious software image or execute unsigned binaries on an affected device. The vulnerability is due to an improper check on the area of code that manag...

Atlassian Companion app code issue vulnerability

The Atlassian Companion app is an application from Atlassian Australia that enables users to edit Confluence files in their preferred desktop application. A code issue vulnerability exists in the file editing functionality in versions of the Atlassian Companion app prior to 1.0.0. A local attacke...

HTTP Suspicious Linux Usr Paths

Linux sub-directory usr contains user binaries, their documentation, libraries, header files, and its supporting libraries. A remote attacker may create a malicious HTTP request to obtain sensitive information...

zziplib security update

0.13.68-8 - Fix CVE-2018-17828 in the 'single z' binaries - Resolves: 1772447...

Privilege Escalation

systemd is vulnerable to privilege escalation. The vulnerability exists as services with DynamicUser can get new privileges and create SGID binaries...

RHEL 8 : glibc (RHSA-2020:1828)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:1828 advisory. The glibc packages provide the standard C libraries libc, POSIX thread libraries libpthread, standard math libraries libm, and the name service cache...

zziplib: ZZIPlib: Arbitrary file overwrite via directory traversal

It was discovered that zziplib is vulnerable to a directory traversal flaw in most of its unzip binaries, including unzip-mem, unzzipcat-mem, unzzipcat-big, unzzipcat-mix, and unzzipcat-zip. An attacker may use this flaw to write files outside the intended target directory, overwriting existing...