7252 matches found
Cross site scripting
Rapid7 Velociraptor 0.5.9 and prior is vulnerable to a post-authentication persistent cross-site scripting XSS issue, where an authenticated user could abuse MIME filetype sniffing to embed executable code on a malicious upload. This issue was fixed in version 0.6.0. Note that login rights to...
CVE-2021-21406
Combodo iTop is an open source, web based IT Service Management tool. In versions prior to 2.7.4, there is a command injection vulnerability in the Setup Wizard when providing Graphviz executable path. The vulnerability is patched in version 2.7.4 and 3.0.0...
Command injection
Combodo iTop is an open source, web based IT Service Management tool. In versions prior to 2.7.4, there is a command injection vulnerability in the Setup Wizard when providing Graphviz executable path. The vulnerability is patched in version 2.7.4 and 3.0.0...
CVE-2021-21406 Command Injection vulnerability in the Setup Wizard
Combodo iTop is an open source, web based IT Service Management tool. In versions prior to 2.7.4, there is a command injection vulnerability in the Setup Wizard when providing Graphviz executable path. The vulnerability is patched in version 2.7.4 and 3.0.0...
Trojan-Spy.Win32.SpyEyes.hqd Insecure Permissions
Discovery / credits: Malvuln - malvuln.com c 2021 Original source: https://malvuln.com/advisory/6f484fea8f6bb3974185fc856f37541b.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Trojan-Spy.Win32.SpyEyes.hqd Vulnerability: Insecure Permissions Description: The malware creates a...
Trojan-Spy.Win32.SpyEyes.abdb Insecure Permissions
Discovery / credits: Malvuln - malvuln.com c 2021 Original source: https://malvuln.com/advisory/9185538b01ad700603f38fb0eb8b6e3b.txt Contact: [email protected] Media: twitter.com/malvuln Threat: Trojan-Spy.Win32.SpyEyes.abdb Vulnerability: Insecure Permissions Description: The malware creates a...
runc through 1.0-rc6 as used in Docker before 18.09.2 and other products allows attackers to overwrite the host runc binary (and consequently obtain host root access) by leveraging the ability to execute a command as root within one of these types of containers: (1) a new container with an attacker-controlled image or (2) an existing container to which the attacker previously had write access that can be attached with docker exec. This occurs because of file-descriptor mishandling related to /proc/self/exe.
...
CVE-2021-35056
Unisys Stealth 5.1 before 5.1.025.0 and 6.0 before 6.0.055.0 has an unquoted Windows search path for a scheduled task. An unintended executable might run...
CVE-2021-35056
Unisys Stealth 5.1 before 5.1.025.0 and 6.0 before 6.0.055.0 has an unquoted Windows search path for a scheduled task. An unintended executable might run...
CVE-2021-34692
iDrive RemotePC before 7.6.48 on Windows allows privilege escalation. A local and low-privileged user can force RemotePC to execute an attacker-controlled executable with SYSTEM privileges...
CVE-2021-34692
iDrive RemotePC before 7.6.48 on Windows allows privilege escalation. A local and low-privileged user can force RemotePC to execute an attacker-controlled executable with SYSTEM privileges...
sharkdp BAT 代码问题漏洞
sharkdp BAT is an open source cat syntax highlighting and Git integrated cloning tool . A security vulnerability exists in sharkdp BAT prior to 0.18.2, which stems from the execution of less.exe from the current working directory. No details of the vulnerability are provided at this time...
jsish Jsi_ObjSetLength function buffer overflow vulnerability
Jsish is a small JavaScript parser written in C with a built-in database.Jsish has a buffer overflow vulnerability in versions prior to 3.0.8, which stems from the failure of the product's JsiObjSetLength function to restrict integer data boundaries, allowing an attacker to execute arbitrary code...
Unisys Stealth 代码问题漏洞
The unisys stealthcore is a firewall from Unisys. This firewall is easy to configure and expand, can be upgraded by micro-segmentation, and fully protects internal data security. Unisys Stealth has a security vulnerability. An unexpected executable file may be run...
YSoft SafeQ 6 has an unspecified vulnerability
YSoft SAFEQ 6 FlexiSpooler is an application. A print management solution. A security vulnerability exists in YSoft SafeQ 6, which stems from incorrect privileges in the MU55 FlexiSpooler service in version 6.0.55 of YSoft SafeQ 6. An attacker could exploit the vulnerability to escalate local use...
CVE-2021-31859
Incorrect privileges in the MU55 FlexiSpooler service in YSoft SafeQ 6 6.0.55 allows local user privilege escalation by overwriting the executable file via an alternative data stream...
CVE-2021-31859
Incorrect privileges in the MU55 FlexiSpooler service in YSoft SafeQ 6 6.0.55 allows local user privilege escalation by overwriting the executable file via an alternative data stream...
CVE-2021-31859
CVE-2021-31859 affects YSoft SafeQ 6 MU55 FlexiSpooler (version 6.0.55). The vulnerability is described as incorrect privileges in the MU55 FlexiSpooler service that enables local privilege escalation by overwriting the executable file via an alternate data stream. The available documents confirm...
PT-2021-19553 · Ysoft · Ysoft Safeq 6
Name of the Vulnerable Software and Affected Versions: YSoft SafeQ 6 version 6.0.55 Description: The issue concerns incorrect privileges in the MU55 FlexiSpooler service, allowing a local user to escalate privileges by overwriting the executable file via an alternative data stream. Recommendation...
CVE-2021-36122
An issue was discovered in Echo ShareCare 8.15.5. The UnzipFile feature in Access/EligFeedParseSup/UnzipFileUpd.cfm is susceptible to a command argument injection vulnerability when processing remote input in the zippass parameter from an authenticated user, leading to the ability to inject...