Hitachi Energy APM Edge

1. EXECUTIVE SUMMARY CVSS v3 7.8 ATTENTION: Low attack complexity/public exploits are available Vendor: Hitachi Energy Equipment: Lumada Asset Performance Management APM Edge Vulnerabilities: Out-of-Bounds Write and Improper Authentication 2. RISK EVALUATION Successful exploitation of this...

Security Bulletin: Vulnerabilities in IBM Java SDK (CVE-2012-4820, CVE-2012-4821, CVE-2012-4822, CVE-2012-4823)

Abstract These vulnerabilities are only applicable to Java deployments where untrusted code may be executed under a security manager e.g. Java applets running in a web browser. Content VULNERABILITY DETAILS: CVE IDs: CVE-2012-4820, CVE-2012-4821, CVE-2012-4822, CVE-2012-4823 DESCRIPTION: There ar...

ProcessMaker Privilege Escalation

Exploit Title: ProcessMaker - User Profile Privilege Escalation Description: ProcessMaker before v3.5.4 was discovered to contain insecure permissions in the user profile page. This vulnerability allows attackers to escalate normal users to Administrators. Date: 20220822 Exploit Author: Sornram...

CVE-2022-3239

A flaw use after free in the Linux kernel video4linux driver was found in the way user triggers em28xxusbprobe for the Empia 28xx based TV cards. A local user could use this flaw to crash the system or potentially escalate their privileges on the system...

Design/Logic Flaw

A vulnerability on Trend Micro HouseCall version 1.62.1.1133 and below could allow a local attacker to escalate privlieges due to an overly permissive folder om the product installer...

CVE-2022-38577

ProcessMaker before v3.5.4 was discovered to contain insecure permissions in the user profile page. This vulnerability allows attackers to escalate normal users to Administrators...

CVE-2022-38577

ProcessMaker before v3.5.4 was discovered to contain insecure permissions in the user profile page. This vulnerability allows attackers to escalate normal users to Administrators...

CVE-2022-2977

A flaw was found in the Linux kernel implementation of proxied virtualized TPM devices. On a system where virtualized TPM devices are configured this is not the default a local attacker can create a use-after-free and create a situation where it may be possible to escalate privileges on the syste...

CVE-2022-38633

Genymotion Desktop v3.2.1 was discovered to contain a DLL hijacking vulnerability which allows attackers to escalate privileges and execute arbitrary code via a crafted binary...

Vulnerability fixed in Microsoft Defender

Microsoft has fixed a vulnerability in Defender Endpoint for macOS. A local, authenticated malicious party can exploit the exploit the vulnerability to grant itself elevated privileges and thus execute code with SYSTEM/root privileges. Microsoft has made updates available that fix the described...

CVE-2022-33179. A vulnerability in Brocade Fabric OS CLI could allow an attacker to break out of restricted shells and escalate privileges

Security Advisory ID : BSA-2022-2079 Component : FOS Revision : 1.1 A vulnerability in Brocade Fabric OS CLI before Brocade Fabric OS v9.1.0, 9.0.1e, 8.2.3c, and 7.4.2j could allow a local authenticated user to break out of restricted shells with “set context” and escalate privileges. Affecte...

CVE-2022-33179. A vulnerability in Brocade Fabric OS CLI could allow an attacker to break out of restricted shells and escalate privileges

A vulnerability in Brocade Fabric OS CLI before Brocade Fabric OS v9.1.0, 9.0.1e, 8.2.3c, and 7.4.2j could allow a local authenticated user to break out of restricted shells with “set context” and escalate privileges. Affected Product All Brocade Fabric OS versions...

USN-5602-1: Linux kernel (Raspberry Pi) vulnerabilities

Asaf Modelevsky discovered that the IntelR 10GbE PCI Express ixgbe Ethernet driver for the Linux kernel performed insufficient control flow management. A local attacker could possibly use this to cause a denial of service. CVE-2021-33061 Moshe Kol, Amit Klein and Yossi Gilad discovered that the I...

CVE-2022-31251

A Incorrect Default Permissions vulnerability in the packaging of the slurm testsuite of openSUSE Factory allows local attackers with control over the slurm user to escalate to root. This issue affects: openSUSE Factory slurm versions prior to 22.05.2-3.3...

Trojan.Win32.Autoit.fhj MVID-2022-0637 Insecure Permissions

Discovery / credits: Malvuln John Page aka hyp3rlinx c 2022 Original source: https://malvuln.com/advisory/d871836f77076eeed87eb0078c1911c7.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Trojan.Win32.Autoit.fhj Vulnerability: Insecure Permissions Description: The malware write...

CVE-2022-36670

PCProtect Endpoint prior to v5.17.470 for Microsoft Windows lacks tamper protection, allowing authenticated attackers with Administrator privileges to modify processes within the application and escalate privileges to SYSTEM via a crafted executable...

CVE-2022-37771

CVE-2022-37771 affects IObit Malware Fighter v9.2 on Windows, where lack of tamper protection lets an authenticated Administrator modify application processes and escalate to SYSTEM via a crafted executable. The issue is described as a local vulnerability with high impact on confidentiality, inte...

SUSE-SU-2022:3080-1 Security update for the Linux Kernel (Live Patch 23 for SLE 15 SP3)

This update for the Linux Kernel 5.3.18-1503005990 fixes one issue. The following security issue was fixed: - CVE-2022-1116: Fixed integer overflow or wraparound vulnerability in iouring, where a local attacker could have caused memory corruption and escalate privileges to root bsc1199648...

CVE-2021-25657

CVE-2021-25657 describes a local privilege-escalation vulnerability in Avaya IP Office Admin Lite and USB Creator, affecting version 11.1 Feature Pack 2 Service Pack 1 and earlier. The documented impact is that a local user may escalate privileges. The CVSS metrics in the sources flag high impact...

CVE-2022-1902

A flaw was found in the Red Hat Advanced Cluster Security for Kubernetes. Notifier secrets were not properly sanitized in the GraphQL API. This flaw allows authenticated ACS users to retrieve Notifiers from the GraphQL API, revealing secrets that can escalate their privileges...