Cisco AnyConnect Privilege Escalations (CVE-2020-3153 and CVE-2020-3433)

The installer component of Cisco AnyConnect Secure Mobility Client for Windows prior to 4.8.02042 is vulnerable to path traversal and allows local attackers to create/overwrite files in arbitrary locations with system level privileges. The installer component of Cisco AnyConnect Secure Mobility...

openSUSE Security Update : roundcubemail (openSUSE-2020-1516)

This update for roundcubemail fixes the following issues : roundcubemail was upgraded to 1.3.15 This is a security update to the LTS version 1.3. boo1175135 - Security: Fix cross-site scripting XSS via HTML messages with malicious svg content CVE-2020-16145 - Security: Fix cross-site scripting XS...

The vulnerability of the Windows Language Pack Installer component on Windows operating systems allows a malicious individual to execute processes under privileged access.

The vulnerability of the Windows Language Pack Installer component in Windows operating systems is related to file operation errors. Exploiting this vulnerability can allow an attacker to execute processes in privileged mode using a specially created application...

The Windows installer for PostgreSQL 9.5 - 12 invokes system-provided executables that do not have fully-qualified paths. Executables in the directory where the installer loads or the current working directory take precedence over the intended executables. An attacker having permission to add files into one of those directories can use this to execute arbitrary code with the installer's administrative rights.

...

The vulnerability of the Naver Whale web browser installer allows a hacker to gain unauthorized access to protected information or compromise the integrity of data.

The vulnerability of the Naver Whale web browser installer is related to improper verification of the cryptographic signature. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information or compromise the integrity of the data...

CVE-2019-16000

A vulnerability in the automatic update process of Cisco Umbrella Roaming Client for Windows could allow an authenticated, local attacker to install arbitrary, unapproved applications on a targeted device. The vulnerability is due to insufficient verification of the Windows Installer. An attacker...

Design/Logic Flaw

A vulnerability in the automatic update process of Cisco Umbrella Roaming Client for Windows could allow an authenticated, local attacker to install arbitrary, unapproved applications on a targeted device. The vulnerability is due to insufficient verification of the Windows Installer. An attacker...

CVE-2019-16000 Cisco Umbrella Roaming Client for Windows Install Vulnerability

A vulnerability in the automatic update process of Cisco Umbrella Roaming Client for Windows could allow an authenticated, local attacker to install arbitrary, unapproved applications on a targeted device. The vulnerability is due to insufficient verification of the Windows Installer. An attacker...

CVE-2019-16000

CVE-2019-16000 affects the Cisco Umbrella Roaming Client for Windows. The issue is in the automatic update process where Windows Installer verification is insufficient, allowing an authenticated, local attacker to place a file in a specific location and bypass policy to install unapproved applica...

CVE-2019-16000 Cisco Umbrella Roaming Client for Windows Install Vulnerability

A vulnerability in the automatic update process of Cisco Umbrella Roaming Client for Windows could allow an authenticated, local attacker to install arbitrary, unapproved applications on a targeted device. The vulnerability is due to insufficient verification of the Windows Installer. An attacker...

Google Android elevation of privilege vulnerability (CNVD-2020-53769)

Android is a Linux-based open source operating system from Google and the Open Handheld Alliance OHA. There is a security vulnerability in Android version 11. The vulnerability stems from PackageInstaller and can be exploited by an attacker to elevate local privileges...

Micro Focus Operations Bridge Reporter HPE-OBR Incorrect Permission Assignment Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Micro Focus Operations Bridge Reporter. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists with...

The vulnerability of the Windows Modules Installer component allows attackers to enhance their privileges.

The vulnerability of the Windows Modules Installer component in operating systems is related to incorrect handling of objects in memory. Exploiting this vulnerability can allow an attacker to enhance their privileges through a specially created application...

CVE-2020-6574

Insufficient policy enforcement in installer in Google Chrome on OS X prior to 85.0.4183.102 allowed a local attacker to potentially achieve privilege escalation via a crafted binary...

CVE-2020-6546

Inappropriate implementation in installer in Google Chrome prior to 84.0.4147.125 allowed a local attacker to potentially elevate privilege via a crafted filesystem...

Information disclosure

Inappropriate implementation in installer in Google Chrome prior to 84.0.4147.125 allowed a local attacker to potentially elevate privilege via a crafted filesystem...

CVE-2020-6574

Insufficient policy enforcement in installer in Google Chrome on OS X prior to 85.0.4183.102 allowed a local attacker to potentially achieve privilege escalation via a crafted binary...

UBUNTU-CVE-2020-6574

Insufficient policy enforcement in installer in Google Chrome on OS X prior to 85.0.4183.102 allowed a local attacker to potentially achieve privilege escalation via a crafted binary...

UBUNTU-CVE-2020-6546

Inappropriate implementation in installer in Google Chrome prior to 84.0.4147.125 allowed a local attacker to potentially elevate privilege via a crafted filesystem...

CVE-2020-6574

CVE-2020-6574 affects Chromium-based Chrome on macOS before 85.0.4183.102, due to insufficient policy enforcement in the installer that could allow a local privilege-escalation via a crafted binary. Several connected advisories confirm the issue and cite upgrades to at least 85.0.4183.102 (or lat...