CVE-2023-21257

In updateSettingsInternalLI of InstallPackageHelper.java, there is a possible way to sideload an app in the work profile due to a missing permission check. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...

PT-2023-25870 · Umbraco · Umbraco

Name of the Vulnerable Software and Affected Versions: Umbraco versions prior to 10.6.1 Umbraco versions prior to 11.4.2 Umbraco versions prior to 12.0.1 Description: Under rare conditions, a restart of Umbraco can allow unauthorized users to gain admin-level permissions, potentially leading to...

Fedora 38 : mingw-nsis (2023-dfb6cc599f)

The remote Fedora 38 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2023-dfb6cc599f advisory. Update to 3.09, fixes CVE-2023-37378. Tenable has extracted the preceding description block directly from the Fedora security advisory. Note that Nessus has...

Code injection

A CWE-94: Improper Control of Generation of Code 'Code Injection' vulnerability exists that could cause remote code execution when an admin user on DCE uploads or tampers with install packages...

CVE-2023-37198

Schneider Electric StruxureWare Data Center Expert (DCE) contains a CWE-94 code injection vulnerability that could allow remote code execution when an administrator uploads or tampers with installation packages. The issue affects StruxureWare Data Center Expert and related components (v7.9.3 and ...

CVE-2023-37198

A CWE-94: Improper Control of Generation of Code 'Code Injection' vulnerability exists that could cause remote code execution when an admin user on DCE uploads or tampers with install packages...

CVE-2023-35347

Microsoft Install Service Elevation of Privilege Vulnerability...

CVE-2023-35347

Microsoft Install Service Elevation of Privilege Vulnerability...

Privilege escalation

Microsoft Install Service Elevation of Privilege Vulnerability...

CVE-2023-35347 Microsoft Install Service Elevation of Privilege Vulnerability

...

CVE-2023-35347 Microsoft Install Service Elevation of Privilege Vulnerability

...

CVE-2023-35347

Technical details about CVE-2023-35347 are not provided in the supplied documents. Monitor official sources (Microsoft/MSRC) for updates on affected products, impact, and remediation.

Microsoft Install Service Elevation of Privilege Vulnerability

...

Siemens RUGGEDCOM ROX 系列多款产品 命令注入漏洞

RUGGEDCOM products offer a degree of robustness and reliability that sets the standard for communication networks deployed in harsh environments. A command injection vulnerability exists in the Siemens RUGGEDCOM ROX, which stems from a lack of server-side input validation, making the install-app...

PT-2023-3853 · Microsoft · Windows +1

Name of the Vulnerable Software and Affected Versions: Microsoft Install Service affected versions not specified Description: The issue is related to insufficient access restrictions in the Windows operating system installer, which can be exploited to elevate privileges. This allows an attacker t...

Ubuntu: Security Advisory (USN-6206-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

ROS-2-1349

2.1349 Vulnerability in Mozilla Firefox browser CVE-2021-29967 1. Vulnerability description: A vulnerability in the Mozilla Firefox browser that allows an attacker to execute arbitrary code on the target system.Identifier of the Information Security Threats Data Bank of the FSTEC of Russia: 2...

ROS-2-1264

2.1264 Apache Ant utility vulnerability CVE-2021-36374, CVE-2021-36373 1. Vulnerability Description: CVE-2021-36374 A vulnerability in the Apache Ant utility, is related to the application improperly controlling internal resource consumption when processing ZIP archives. Exploitation of the...

CVE-2023-36821

Uptime Kuma, a self-hosted monitoring tool, allows an authenticated attacker to install a maliciously crafted plugin in versions prior to 1.22.1, which may lead to remote code execution. Uptime Kuma allows authenticated users to install plugins from an official list of plugins. This feature is...

Remote code execution

Uptime Kuma, a self-hosted monitoring tool, allows an authenticated attacker to install a maliciously crafted plugin in versions prior to 1.22.1, which may lead to remote code execution. Uptime Kuma allows authenticated users to install plugins from an official list of plugins. This feature is...