CVE-2020-27727

On BIG-IP version 16.0.0-16.0.0.1, 15.1.0-15.1.0.5, 14.1.0-14.1.3, and 13.1.0-13.1.3.4, when an authenticated administrative user installs RPMs using the iAppsLX REST installer, the BIG-IP system does not sufficiently validate user input, allowing the user read access to the filesystem...

Privilege Escalation

chromium is vulnerable to privilege escalation. Inappropriate implementation in installer allows a local attacker to elevate privilege via a malicious filesystem...

Privilege Escalation

chromium is vulnerable to Privilege Escalation. Insufficient data validation in installer allows a local attacker to elevate privilege via a malicious filesystem...

CVE-2020-4008

The installer of the macOS Sensor for VMware Carbon Black Cloud prior to 3.5.1 handles certain files in an insecure way. A malicious actor who has local access to the endpoint on which a macOS sensor is going to be installed, may overwrite a limited number of files with output from the sensor...

CVE-2020-4008

The installer of the macOS Sensor for VMware Carbon Black Cloud prior to 3.5.1 handles certain files in an insecure way. A malicious actor who has local access to the endpoint on which a macOS sensor is going to be installed, may overwrite a limited number of files with output from the sensor...

VMware Carbon Black Cloud Security Vulnerability

VMware Carbon Black Cloud is a Sass platform from VMware, Inc. that provides security checking defense capabilities for cloud endpoints. A security vulnerability exists in the Vmware Carbon Black Cloud MacoS Sensor that stems from the macOS Sensor's installer handling certain files in an insecure...

Pulse Secure Installer Service TOCTOU Privilege Escalation Vulnerability (SA44503)

The Pulse Secure Installer Service installed on the remote Windows system is affected by a TOCTOU time-of-check to time-of-use privilege escalation vulnerability. C Tenable Network Security, Inc. include'compat.inc'; if description scriptid144327; scriptversion"1.1";...

VMware Carbon Black Cloud macOS Sensor installer updates address file overwrite issue (CVE-2020-4008)

3. VMware Carbon Black Cloud macOS Sensor installer file overwrite issue CVE-2020-4008 The installer of the macOS Sensor for VMware Carbon Black Cloud handles certain files in an insecure way. VMware has evaluated the severity of this issue to be in the Low severity range with a CVSSv3 base score...

CVE-2020-0460

In createNameCredentialDialog of CertInstaller.java, there exists the possibility of improperly installed certificates due to a logic error. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product:...

SUSE SLES15 Security Update : rmt-server (SUSE-SU-2020:3147-1)

This update for rmt-server fixes the following issues : Version 2.6.5 Solved potential bug of SCC repository URLs changing over time. RMT now self heals by removing the previous invalid repository and creating the correct one. Version 2.6.4 Add web server settings to /etc/rmt.conf: Now it's...

Description of the security update for Office 2010: December 8, 2020

Description of the security update for Office 2010: December 8, 2020 Summary This security update resolves Microsoft Excel remote code execution vulnerabilities. To learn more about these vulnerabilities, see Microsoft Common Vulnerabilities and Exposures CVE-2020-17122. Note To apply this securi...

Security Bulletin: OSS security Scan issues for Concerto installer.

Summary Fixed in IBM Netezza for Cloud Pak for Data 11.1.1.0 Vulnerability Details CVEID: CVE-2018-19838 DESCRIPTION: LibSass is vulnerable to a denial of service, caused by a stack-based buffer overflow in the IMPLEMENTASTOPERATORS expansion in ast.cpp. By persuading a victim to open a...

Design/Logic Flaw

Kirby is a CMS. In Kirby CMS getkirby/cms before version 3.3.6, and Kirby Panel before version 2.5.14 there is a vulnerability in which the admin panel may be accessed if hosted on a .dev domain. In order to protect new installations on public servers that don't have an admin account for the Pane...

CVE-2020-5798

inSync Client installer for macOS versions v6.8.0 and prior could allow an attacker to gain privileges of a root user from a lower privileged user due to improper integrity checks and directory permissions...

CVE-2020-5798

inSync Client installer for macOS versions v6.8.0 and prior could allow an attacker to gain privileges of a root user from a lower privileged user due to improper integrity checks and directory permissions...

Druva inSync Client Security Vulnerability

Druva inSync Client is a lightweight application from Druva USA that supports managing data backups and allows collaboration with other users. A security vulnerability exists in the inSync Client installer, which stems from incorrect integrity checking and directory permissions, and which the...

CVE-2020-28950

The installer of Kaspersky Anti-Ransomware Tool KART prior to KART 4.0 Patch C was vulnerable to a DLL hijacking attack that allowed an attacker to elevate privileges during installation process...

Code injection

The installer of Kaspersky Anti-Ransomware Tool KART prior to KART 4.0 Patch C was vulnerable to a DLL hijacking attack that allowed an attacker to elevate privileges during installation process...

CVE-2020-28950

The CVE relates to Kaspersky Anti-Ransomware Tool (KART) installer prior to 4.0 Patch C, where a DLL hijacking flaw could allow local privilege escalation during installation. Affected product: KART (pre-4.0 Patch C). Root cause: DLL hijacking in the installer. Impact: privilege elevation during ...

The vulnerability of the software installer for collecting and analyzing data on the performance, power consumption, and temperature of various Intel Data Center Manager Console devices allows a hacker to exploit their privileges.

The vulnerability of the software installer for collecting and analyzing data on the performance, power consumption, and temperature of various Intel Data Center Manager Console devices is related to errors in saving permissions. Exploiting this vulnerability can allow attackers to increase their...