1177 matches found
CVE-2024-4762
An improper validation vulnerability was reported in the firmware update mechanism of LADM and LDCC that could allow a local attacker to escalate privileges...
CVE-2024-11969 Incorrect default permissions in Cradlepoint NetCloud Exchange
The NetCloud Exchange client for Windows, version 1.110.50, contains an insecure file and folder permissions vulnerability. A normal non-admin user could exploit the weakness in file and folder permissions to escalate privileges, execute arbitrary code and maintain persistence on the compromised...
CVE-2024-8114 Missing Authorization in GitLab
An issue has been discovered in GitLab CE/EE affecting all versions from 8.12 before 17.4.5, 17.5 before 17.5.3, and 17.6 before 17.6.1. This issue allows an attacker with access to a victim's Personal Access Token PAT to escalate privileges...
CVE-2024-8114
CVE-2024-8114 affects GitLab CE/EE versions 8.12 through before 17.4.5, 17.5 before 17.5.3, and 17.6 before 17.6.1. An attacker who has access to a victim’s Personal Access Token (PAT) can escalate privileges. The impact is privilege escalation with high potential impact on confidentiality, integ...
CVE-2024-8272
The com.uaudio.bsd.helper service, responsible for handling privileged operations, fails to implement critical client validation during XPC inter-process communication IPC. Specifically, the service does not verify the code requirements, entitlements, or security flags of any client attempting to...
CVE-2024-9244 Foxit PDF Reader Update Service Incorrect Permission Assignment Local Privilege Escalation Vulnerability
Foxit PDF Reader Update Service Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Foxit PDF Reader. An attacker must first obtain the ability to execute low-privileged code on the...
CVE-2024-11483
A vulnerability was found in the Ansible Automation Platform AAP. This flaw allows attackers to escalate privileges by improperly leveraging read-scoped OAuth2 tokens to gain write access. This issue affects API endpoints that rely on ansiblebase.oauth2provider for OAuth2 authentication. While th...
ROS-20241120-02
A vulnerability in the locking/wwmutex/test components of the Linux operating system kernel is related to improper locking in the functions listforeachentrysafe, stressonework, and stress in the kernel/locking/test/test-wwmutex.c. Exploitation of the vulnerability could allow an attacker to cause...
CVE-2024-51503
Summary: CVE-2024-51503 affects Trend Micro Deep Security Agent 20 (manual scan command injection). The vulnerability exists in the agent’s Notifier component and, under certain conditions, allows an attacker with legitimate domain access to escalate privileges and execute arbitrary code on remot...
CVE-2024-11075
The CVE-2024-11075 entry concerns SICK’s Incoming Goods Suite. The description attributes privilege escalation to the use of component vendor Docker images running with root permissions, enabling an unprivileged user with local access to gain administrative control over the system. Affected produ...
CVE-2024-48292
An issue in the wssrvc.exe service of QuickHeal Antivirus Pro Version v24.0 and Quick Heal Total Security v24.0 allows authenticated attackers to escalate privileges...
Google Android elevation of privilege vulnerability (CNVD-2024-47698)
Google Android is a Linux-based open source operating system from Google. Google Android suffers from an elevation of privilege vulnerability that can be exploited by an attacker to elevate privileges...
CVE-2024-47906
Excessive binary privileges in Ivanti Connect Secure before version 22.7R2.3 Not Applicable to 9.1Rx and Ivanti Policy Secure before version 22.7R1.2 Not Applicable to 9.1Rx allows a local authenticated attacker to escalate privileges...
CVE-2024-29119
A vulnerability has been identified in Spectrum Power 7 All versions V24Q3. The affected product contains several root-owned SUID binaries that could allow an authenticated local attacker to escalate privileges...
CVE-2024-44765
An Improper Authorization Access Control Misconfiguration vulnerability in MGT-COMMERCE GmbH CloudPanel v2.0.0 to v2.4.2 allows low-privilege users to bypass access controls and gain unauthorized access to sensitive configuration files and administrative functionality...
CVE-2024-50590
Elefant software (HASOMED Elefant) on Windows is affected by a local privilege escalation due to writable service binaries. The default install directory is C:\Elefant1, which is writable by all users, and the Elefant installer registers two Firebird database services running as NT AUTHORITY\SYST...
CVE-2024-48336
The install function of ProviderInstaller.java in Magisk App before canary version 27007 does not verify the GMS app before loading it, which allows a local untrusted app with no additional privileges to silently execute arbitrary code in the Magisk app and escalate privileges to root via a craft...
CVE-2024-48200
An issue in MobaXterm v24.2 allows a local attacker to escalate privileges and execute arbitrary code via the remove function of the MobaXterm MSI is spawning one Administrative cmd conhost.exe...
NVIDIA Windows GPU Display Driver (October 2024)
A display driver installed on the remote Windows host is affected by the following: - NVIDIA GPU Display Driver for Windows and Linux contains a vulnerability which could allow a privileged attacker to escalate permissions. A successful exploit of this vulnerability might lead to code execution,...