CVE-2017-1301

IBM Spectrum Protect 7.1 and 8.1 could allow a local attacker to launch a symlink attack. IBM Spectrum Protect Backup-archive Client creates temporary files insecurely. A local attacker could exploit this vulnerability by creating a symbolic link from a temporary file to various files on the...

Ubuntu 14.04 LTS / 16.04 LTS : Firefox regression (USN-3435-2)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-3435-2 advisory. USN-3435-1 fixed vulnerabilities in Firefox. The update caused the Flash plugin to crash in some circumstances. This update fixes the problem. We...

CVE-2017-8448

An error was found in the permission model used by X-Pack Alerting 5.0.0 to 5.6.0 whereby users mapped to certain built-in roles could create a watch that results in that user gaining elevated privileges...

CVE-2017-8448

An error was found in the permission model used by X-Pack Alerting 5.0.0 to 5.6.0 whereby users mapped to certain built-in roles could create a watch that results in that user gaining elevated privileges...

Elastic X-Pack Alerting Elevation of Privilege Vulnerability

Elastic X-Pack Alerting is an extension of Elastic Stack a log analyzing system from Dutch company Elasticsearch. A security vulnerability exists in the permission schema used in Elastic X-Pack Alerting versions 5.0.0 through 5.6.0. An attacker could exploit the vulnerability to gain elevated...

CVE-2017-8448

CVE-2017-8448 affects Elastic X-Pack alerting in Elastic Stack versions 5.0.0–5.6.0, where the permission model allowed users mapped to certain built-in roles to create a watch that elevated their privileges. The issue stems from a privilege escalation vulnerability in the X-Pack alerting permiss...

The vulnerability of IBM DB2 database management systems, including IBM DB2 Connect (and IBM DB2 Connect servers), is related to deficiencies in access control. This allows attackers to obtain elevated privileges.

The vulnerabilities of IBM DB2 database management systems, including IBM DB2 Connect and the IBM DB2 Connect server, are related to deficiencies in access control. Exploiting these vulnerabilities can allow an attacker, operating locally, to gain elevated privileges and re-record DB2-formatted...

Schneider Electric InduSoft Web Studio and InTouch Machine Edition Remote Code Execution Vulnerability

InduSoft Web Studio and InTouch Machine Edition are both an embedded HMI software package from Schneider Electric France. A remote code execution vulnerability exists in Schneider Electric InduSoft Web Studio and InTouch Machine Edition. InduSoft Web Studio provides the ability for the HMI client...

CVE-2017-12214

A vulnerability in the Operations, Administration, Maintenance, and Provisioning OAMP credential reset functionality for Cisco Unified Customer Voice Portal CVP could allow an authenticated, remote attacker to gain elevated privileges. The vulnerability is due to a lack of proper input validation...

Input validation

A vulnerability in the Operations, Administration, Maintenance, and Provisioning OAMP credential reset functionality for Cisco Unified Customer Voice Portal CVP could allow an authenticated, remote attacker to gain elevated privileges. The vulnerability is due to a lack of proper input validation...

CVE-2017-12214

A vulnerability in the Operations, Administration, Maintenance, and Provisioning OAMP credential reset functionality for Cisco Unified Customer Voice Portal CVP could allow an authenticated, remote attacker to gain elevated privileges. The vulnerability is due to a lack of proper input validation...

Cisco Unified Customer Voice Portal Operations Console Privilege Escalation Vulnerability

A vulnerability in the Operations, Administration, Maintenance, and Provisioning OAMP credential reset functionality for Cisco Unified Customer Voice Portal CVP could allow an authenticated, remote attacker to gain elevated privileges. The vulnerability is due to a lack of proper input validation...

Privilege escalation

IBM DB2 for Linux, UNIX and Windows 9.7, 10,1, 10.5, and 11.1 includes DB2 Connect Server could allow a local user to obtain elevated privilege and overwrite DB2 files. IBM X-Force ID: 128180...

Microsoft Windows Kernel 'Win32k.sys' CVE-2017-8675 Local Privilege Escalation Vulnerability

Description Microsoft Windows is prone to a local privilege-escalation vulnerability. An attacker can exploit this issue to execute arbitrary code with elevated privileges. Failed exploit attempts may result in a denial of service condition; this can result in the attacker gaining complete contro...

mySCADA myPRO

CVSS v3 7.8 ATTENTION: Low skill level to exploit. Public exploits are available. Vendor: mySCADA Equipment: myPRO Vulnerability: Unquoted Search Path AFFECTED PRODUCTS The following versions of myPRO, an HMI/SCADA management platform, are affected: myPRO Versions 7.0.26 and prior. IMPACT...

Microsoft Windows Win32k CVE-2017-8720 Local Privilege Escalation Vulnerability

Description Microsoft Windows is prone to a local privilege-escalation vulnerability. An attacker can exploit this issue to execute arbitrary code with elevated privileges. Failed exploit attempts may result in a denial of service condition; this can result in the attacker gaining complete contro...

CVE-2017-0796

A elevation of privilege vulnerability in the MediaTek auxadc driver. Product: Android. Versions: Android kernel. Android ID: A-62458865. References: M-ALPS03353884, M-ALPS03353886, M-ALPS03353887...

Google Android Libraries Remote Code Execution Vulnerability (CNVD-2017-31649)

Android is a set of Linux-based open source operating system jointly developed by Google and the Open Handheld Alliance OHA for short. Libraries libgdx is one of the cross-platform 2D/3D game development framework written in Java/C/C++. A remote code execution vulnerability exists in...

Google Android Media Framework elevation of privilege vulnerability (CNVD-2017-31371)

Android is a Linux-based open source operating system jointly developed by Google and the Open Handset Alliance OHA, and Media framework libstagefright is one of the hard-decoding support frameworks for multimedia development. A boost vulnerability exists in Media frameworklibstagefright in...

Google Android Media Framework elevation of privilege vulnerability (CNVD-2017-31369)

Android is a Linux-based open source operating system jointly developed by Google and the Open Handset Alliance OHA, and Media framework libeffects is a library of multimedia effects. Media frameworklibeffects in Android suffers from a lifting vulnerability. An attacker can exploit this...