Dräger ICMHelper 安全漏洞

Dräger ICMHelper is a client assistance service software from Dräger, Germany. A security vulnerability exists in Dräger ICMHelper 1.4.0.1 and earlier versions, which stems from the use of a hard-coded encryption key that could lead to elevated privileges...

Themetags Writebot – AI Content Generator Saas React Template 安全漏洞

Themetags Writebot - AI Content Generator Saas React Template is an AI content generator template from Themetags. A security vulnerability exists in Themetags Writebot - AI Content Generator Saas React Template version 4.0.0 and earlier, which stems from a flaw in the file upload endpoint that...

Agenzia Impresa Eccobook 安全漏洞

Agenzia Impresa EccoBook is a ledger software from Agenzia Impresa, Italy. A security vulnerability exists in Agenzia Impresa Eccobook version v2.81.1, which stems from improper access control in CaricaVerbale, and may result in elevated privileges...

CVE-2025-54585

GitProxy is an application that stands between developers and a Git remote endpoint. In versions 1.19.1 and below, attackers can exploit the way GitProxy handles new branch creation to bypass the approval of prior commits on the parent branch. The vulnerability impacts all users or organizations...

CVE-2025-6250

Prior to 25.4.270.0, when wmic.exe is elevated with a full admin token the user can stop the Defendpoint service, bypassing anti-tamper protections. Once the service is disabled, the malicious user can add themselves to Administrators group and run any process with elevated permissions...

CVE-2025-24119

This issue was addressed through improved state management. This issue is fixed in macOS Sequoia 15.3, macOS Ventura 13.7.7, macOS Sonoma 14.7.7. An app may be able to execute arbitrary code out of its sandbox or with certain elevated privileges...

Ventem e-School 安全漏洞

Ventem e-School is a smart school platform from Feiyu Hi-Tech Ventem of Taiwan, China. A security vulnerability exists in Ventem e-School, which stems from a lack of authorization checking and could lead to elevated privileges...

Johnson Controls iSTAR Ultra 安全漏洞

Johnson Controls iSTAR Ultra is an access controller from Johnson Controls, Inc. It provides network resiliency and faster processing speeds. A security vulnerability exists in the Johnson Controls iSTAR Ultra that stems from the presence of OS command injection in the web application, which coul...

PT-2025-31115 · Crowdstrike · Defendpoint

Name of the Vulnerable Software and Affected Versions: Symantec Defendpoint versions prior to 25.4.270.0 Description: Prior to version 25.4.270.0, when wmic.exe is elevated with a full admin token, a user can stop the Defendpoint service, bypassing anti-tamper protections. Once the service is...

CVE-2024-13976

A DLL injection vulnerability exists in Commvault for Windows 11.20.0, 11.28.0, 11.32.0, 11.34.0, and 11.36.0. During the installation of maintenance updates, an attacker with local access may exploit uncontrolled search path or DLL loading behavior to execute arbitrary code with elevated...

CVE-2024-13976

A DLL injection vulnerability exists in Commvault for Windows 11.20.0, 11.28.0, 11.32.0, 11.34.0, and 11.36.0. During the installation of maintenance updates, an attacker with local access may exploit uncontrolled search path or DLL loading behavior to execute arbitrary code with elevated...

Open Source MANO 安全漏洞

Open Source MANO OSM is an open source software for managing and orchestrating future networks from Open Source MANO, Inc. A security vulnerability exists in Open Source MANO OSM versions 14.x and 15.x that stems from an unrestricted administrator authentication attempt that could result in...

NewStart CGSL MAIN 7.02 : libX11 Multiple Vulnerabilities (NS-SA-2025-0138)

The remote NewStart CGSL host, running version MAIN 7.02, has libX11 packages installed that are affected by multiple vulnerabilities: - A vulnerability was found in libX11 due to an integer overflow within the XCreateImage function. This flaw allows a local user to trigger an integer overflow an...

CVE-2025-6018

A Local Privilege Escalation LPE vulnerability has been discovered in pam-config within Linux Pluggable Authentication Modules PAM. This flaw allows an unprivileged local attacker for example, a user logged in via SSH to obtain the elevated privileges normally reserved for a physically present,...

CVE-2025-6018 Pam-config: lpe from unprivileged to allow_active in pam

A Local Privilege Escalation LPE vulnerability has been discovered in pam-config within Linux Pluggable Authentication Modules PAM. This flaw allows an unprivileged local attacker for example, a user logged in via SSH to obtain the elevated privileges normally reserved for a physically present,...

CVE-2025-6018

CVE-2025-6018 is a Local Privilege Escalation in pam-config of Linux PAM. The PAM environment module pam_env.so can be fed via a user’s ~/.pam_environment and, if loaded before pam_systemd.so (e.g., in sshd PAM stacks), may cause Polkit to treat the user as a local active user and grant elevated ...

SAP FICA ODN framework 代码注入漏洞

SAP FICA ODN framework is a component for generating official credential numbers from SAP, Germany. A code injection vulnerability exists in the SAP FICA ODN framework that originates from an elevated privilege user being able to inject the value of a local variable, potentially leading to...

HP Poly Clariti Manager 安全漏洞

HP Poly Clariti Manager is a centralized management, control, and optimization of video conferencing infrastructure from Hewlett-Packard HP in the United States. A security vulnerability exists in HP Poly Clariti Manager versions prior to 10.12.2, which stems from an improper implementation of...

Microsoft Windows Resource Management Error Vulnerability (CNVD-2025-16946)

Microsoft Windows is a set of operating systems for use on personal devices from the American company Microsoft. Microsoft Windows has a security vulnerability. The vulnerability can be exploited by an attacker to gain elevated privileges...

Turpak Automatic Station Monitoring System 安全漏洞

Turpak Automatic Station Monitoring System is an automated gas station monitoring system from Turpak. A security vulnerability exists in Turpak Automatic Station Monitoring System versions prior to 5.0.6.51, which originates from bypassing authorization via a user control key and may result in...