CVE-2024-38509

CVE-2024-38509 affects Lenovo’s XClarity Controller (XCC). A flaw in how IPMI commands are processed can let an authenticated XCC user with elevated privileges execute arbitrary code, i.e., privilege escalation and code execution. The issue is documented with a base CVSS of 7.2 (HIGH) and is desc...

CVE-2024-38508

A privilege escalation vulnerability was discovered in the web interface or SSH captive command shell interface of XCC that could allow an authenticated XCC user with elevated privileges to perform command injection via a specially crafted request...

CVE-2024-38508

Lenovo XClarity Controller (XCC) web interface or SSH captive command shell interface contains a privilege-escalation vulnerability (CVE-2024-38508). An authenticated XCC user with elevated privileges can perform arbitrary code execution by sending a specially crafted request. IBM’s advisory for ...

CVE-2024-39304 ChurchCRM SQL Injection Vulnerability

ChurchCRM is an open-source church management system. Versions of the application prior to 5.9.2 are vulnerable to an authenticated SQL injection due to an improper sanitization of user input. Authentication is required, but no elevated privileges are necessary. This allows attackers to inject SQ...

Dell Edge Gateway Buffer Overflow Vulnerability

Dell Edge Gateway is a series of intelligent gateway devices from Dell, Inc. It is designed to aggregate, protect, analyze and relay data from a variety of sensors and devices at the edge of the network. A buffer overflow vulnerability exists in Dell Edge Gateway BIOS versions 3200 and 5200, whic...

The vulnerability of Siemens SCALANCE industrial switches, related to the ability to bypass authentication through spoofing, allows attackers to enhance their privileges.

The vulnerability of Siemens SCALANCE industrial switches relates to the ability to bypass authentication through spoofing. Exploiting this vulnerability can allow a malicious actor to gain increased privileges...

WordPress plugin Request a Quote 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in the...

Alert: HotPage Adware Disguised as Ad Blocker Installs Malicious Kernel Driver

Cybersecurity researchers have shed light on an adware module that purports to block ads and malicious websites, while stealthily offloading a kernel driver component that grants attackers the ability to run arbitrary code with elevated permissions on Windows hosts. The malware, dubbed HotPage,...

CVE-2024-20435

A vulnerability in the CLI of Cisco AsyncOS for Secure Web Appliance could allow an authenticated, local attacker to execute arbitrary commands and elevate privileges to root. This vulnerability is due to insufficient validation of user-supplied input for the CLI. An attacker could exploit this...

Cisco Secure Web Appliance Privilege Escalation Vulnerability

A vulnerability in the CLI of Cisco AsyncOS for Secure Web Appliance could allow an authenticated, local attacker to execute arbitrary commands and elevate privileges to root. This vulnerability is due to insufficient validation of user-supplied input for the CLI. An attacker could exploit this...

CVE-2024-6435

A privilege escalation vulnerability exists in the affected products which could allow a malicious user with basic privileges to access functions which should only be available to users with administrative level privileges. If exploited, an attacker could read sensitive data, and create users. Fo...

CVE-2022-48802 fs/proc: task_mmu.c: don't read mapcount for migration entry

In the Linux kernel, the following vulnerability has been resolved: fs/proc: taskmmu.c: don't read mapcount for migration entry The syzbot reported the below BUG: kernel BUG at include/linux/page-flags.h:785! invalid opcode: 0000 1 PREEMPT SMP KASAN CPU: 1 PID: 4392 Comm: syz-executor560 Not...

PT-2024-37624 · Rockwell Automation · Pavilion8

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: A privilege escalation issue exists in the affected products, allowing a malicious user with basic privileges to access functions that should only be...

CVE-2024-5402

Unquoted Search Path or Element vulnerability in ABB Mint Workbench. A local attacker who successfully exploited this vulnerability could gain elevated privileges by inserting an executable file in the path of the affected service. This issue affects Mint Workbench I versions: from 5866 before 58...

CVE-2024-5402

CVE-2024-5402 affects ABB Mint Workbench I, specifically versions 5866 through 5868. The issue is an unquoted search path or element vulnerability that lets a local attacker escalate privileges by placing an executable in the path of the affected service. The root cause is the unquoted path handl...

CVE-2024-5402 Mint Workbench I Unquoted Service Path Enumeration

Unquoted Search Path or Element vulnerability in ABB Mint Workbench. A local attacker who successfully exploited this vulnerability could gain elevated privileges by inserting an executable file in the path of the affected service. This issue affects Mint Workbench I versions: from 5866 before 58...

OTRS Security Vulnerabilities

OTRS is a software application from the German company OTRS. A service management software. A security vulnerability exists in OTRS that stems from the presence of an incorrect privilege assignment vulnerability that could lead to elevated privileges...

Vulnerabilities fixed in Juniper Junos OS and Junos OS Evolved

Vulnerabilities have been found and fixed in Juniper Junos OS and Junos OS Evolved. The vulnerabilities allow a malicious party to carry out attacks that can lead to denial-of-service DoS, access to sensitive information, execution of code with increased user privileges and bypassing a security...

Fortinet FortiExtender Access Control Error Vulnerability (CNVD-2024-37340)

Fortinet FortiExtender is a wireless WAN wide area network extender device from Fortinet. An Access Control Error vulnerability exists in Fortinet FortiExtender, which stems from the presence of improper access control and can be exploited by an attacker to create a user with elevated privileges...

Juniper Networks Junos OS Evolved Security Vulnerability

Juniper Networks Junos OS Evolved is an upgraded version of Juniper Networks' Junos OS. A security vulnerability exists in Juniper Networks Junos OS Evolved that stems from a lack of authorization vulnerability that could allow an authenticated, low-privileged local attacker to modify certain...