1607 matches found
Privilege escalation
Azure Connected Machine Agent Elevation of Privilege Vulnerability...
CVE-2023-35624 Azure Connected Machine Agent Elevation of Privilege Vulnerability
...
CVE-2023-35624
Azure Connected Machine Agent contains an Elevation of Privilege vulnerability (CVE-2023-35624). Affected: Azure Connected Machine Agent on Windows. Root cause: insufficient access control enabling a local attacker with LOW privileges and user interaction to escalate to HIGH privileges (CVSSv3.1:...
Azure Connected Machine Agent Elevation of Privilege Vulnerability
...
Microsoft Azure Connected Machine Agent Security Vulnerability
Microsoft Azure is a suite of open, enterprise-grade cloud computing platforms from the U.S.-based Microsoft Corporation Microsoft. A security vulnerability exists in the Microsoft Azure Connected Machine Agent. An attacker can exploit the vulnerability to elevate privileges...
Security Updates for Azure Connected Machine Agent (December 2023)
The Microsoft Azure Connected Machine Agent running on the remote host is prior to 1.37. It is, therefore affected by an elevation of privilege vulnerability. Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number. %NASLMINLEVE...
PT-2023-8027 · Microsoft · Azure Connected Machine Agent
Name of the Vulnerable Software and Affected Versions: Azure Connected Machine Agent affected versions not specified Description: The issue is related to insufficient access control in the Azure Connected Machine Agent, which can be exploited to elevate privileges. Recommendations: At the moment,...
Cybersecurity considerations to have when shopping for holiday gifts
As I wrote about last week, there are holiday shopping-related scams already popping up all over the place. But another aspect of security that many shoppers dont consider this time of year is the security of the products theyre buying, even through a legitimate online marketplace. This is a...
mariadb: node crashes with Transport endpoint is not connected mysqld got signal 6
A vulnerability was found in MariaDB. An OpenVAS port scan on ports 3306 and 4567 allows a malicious remote client to cause a denial of service...
Internet Bug Bounty: Misconfiguration in AWS CloudFront CDN configuration makes rubygems.org serve (and cache) content from a unclaimed S3-bucket
A misconfiguration in the AWS CloudFront CDN configuration for rubygems.org caused content to be served from an unclaimed S3 bucket. This could have enabled an attacker to serve malicious content and affect availability. Artifactory instances were observed accessing files, presenting a potential...
Top 5 Marketing Tech SaaS Security Challenges
Effective marketing operations today are driven by the use of Software-as-a-Service SaaS applications. Marketing apps such as Salesforce, Hubspot, Outreach, Asana, Monday, and Box empower marketing teams, agencies, freelancers, and subject matter experts to collaborate seamlessly on campaigns and...
HTML Injection
ethyca-fides is vulnerable to HTML Injection. The vulnerability arises due lack of of input validation coming from connected systems and data stores which is reflected in the downloaded data. This results in an HTML injection that can be abused to perform phishing attacks or malicious JS executio...
CVE-2023-47114
Fides is an open-source privacy engineering platform for managing the fulfillment of data privacy requests in your runtime environment, and the enforcement of privacy regulations in your code. The Fides web application allows data subject users to request access to their personal data. If the...
GHSA-3VPF-MCJ7-5H38 Ethyca Fides HTML Injection Vulnerability in HTML-Formatted DSR Packages
Impact The Fides web application allows data subject users to request access to their personal data. If the request is approved by the data controller user operating the Fides web application, the data subject's personal data can then retrieved from connected systems and data stores before being...
The vulnerability of the /goform/formEasySetupWizard3 component of the D-Link N300 WI-Fi Router DIR-605L wireless access point software allows a attacker to cause a service failure or execute arbitrary code.
The vulnerability of the /goform/formEasySetupWizard3 component of the D-Link N300 WI-Fi Router DIR-605L wireless access point lies in the ability to write data beyond the buffer in memory. Exploiting this vulnerability could allow a malicious actor to cause service interruptions or execute...
PT-2023-8442 · Ibm · Ibm Db2
Name of the Vulnerable Software and Affected Versions: IBM DB2 for Linux, UNIX and Windows includes Db2 Connect Server versions 10.1 through 11.5 Description: The issue is related to insufficient input validation in the IBM DB2 database management system and the IBM DB2 Connect Server. It could...
CVE-2023-36321
Connected Vehicle Systems Alliance COVESA up to v2.18.8 was discovered to contain a buffer overflow via the component /shared/dltcommon.c...
DEBIAN-CVE-2023-36321
Connected Vehicle Systems Alliance COVESA up to v2.18.8 was discovered to contain a buffer overflow via the component /shared/dltcommon.c...