CVE-2023-29444 Uncontrolled Search Path Element in PTC's Kepware KEPServerEX

An uncontrolled search path element vulnerability DLL hijacking has been discovered that could allow a locally authenticated adversary to escalate privileges to SYSTEM. Alternatively, they could host a trojanized version of the software and trick victims into downloading and installing their...

WAGO PFC100 Security Vulnerability

The WAGO PFC100 is a programmable logic controller PLC from WAGO. A security vulnerability exists in the WAGO PFC100 that originates from a vulnerability that allows a locally authenticated attacker to elevate non-root privileges by changing the password of another non-administrative user...

Input validation

Dell Precision Tower BIOS contains an Improper Input Validation vulnerability. A locally authenticated malicious user with admin privileges could potentially exploit this vulnerability to perform arbitrary code execution...

CVE-2023-35080

A vulnerability has been identified in the Ivanti Secure Access Windows client, which could allow a locally authenticated attacker to exploit a vulnerable configuration, potentially leading to various security risks, including the escalation of privileges, denial of service, or information...

PT-2023-7118 · Cisco · Cisco Secure Client

Name of the Vulnerable Software and Affected Versions: Cisco Secure Client Software affected versions not specified Description: The issue is related to multiple vulnerabilities in Cisco Secure Client Software that could allow an authenticated, local attacker to cause a denial of service DoS...

CVE-2023-26589

Use after free in some IntelR Aptio V UEFI Firmware Integrator Tools may allowed an authenticated user to potentially enable denial of service via local access...

Ivanti Secure Access Client Security Vulnerability

Ivanti Secure Access Client is a security software client from Ivanti. A security vulnerability exists in Ivanti Secure Access Client versions prior to 22.6R1.1, which stems from a vulnerability that allows locally authenticated attackers to exploit vulnerable configurations, resulting in a denia...

Ivanti Avalanche security breach

Ivanti Avalanche is an enterprise mobile device management system from Ivanti, USA. The system is primarily used to manage devices such as smartphones, tablets and barcode scanners. A security vulnerability exists in Ivanti Avalanche, which stems from a lack of authentication local lifting...

CVE-2023-23632

BeyondTrust Privileged Remote Access PRA versions 22.2.x to 22.4.x are vulnerable to a local authentication bypass. Attackers can exploit a flawed secret verification process in the BYOT shell jump sessions, allowing unauthorized access to jump items by guessing only the first character of the...

CVE-2023-23632

BeyondTrust Privileged Remote Access PRA versions 22.2.x to 22.4.x are vulnerable to a local authentication bypass. Attackers can exploit a flawed secret verification process in the BYOT shell jump sessions, allowing unauthorized access to jump items by guessing only the first character of the...

CVE-2023-23632

BeyondTrust Privileged Remote Access PRA versions 22.2.x to 22.4.x are vulnerable to a local authentication bypass. Attackers can exploit a flawed secret verification process in the BYOT shell jump sessions, allowing unauthorized access to jump items by guessing only the first character of the...

PT-2023-19093 · Beyondtrust · Beyondtrust Privileged Remote Access

Name of the Vulnerable Software and Affected Versions: BeyondTrust Privileged Remote Access PRA versions 22.2.x through 22.4.x Description: The issue concerns a local authentication bypass in BeyondTrust Privileged Remote Access PRA. Attackers can exploit a flawed secret verification process in t...

CVE-2023-23632

BeyondTrust Privileged Remote Access (PRA) 22.2.x–22.4.x contains a local authentication bypass through a flawed secret verification in the BYOT shell jump sessions, enabling access to jump items by guessing the first character of the secret. Affected product: BeyondTrust PRA. Root cause: insecur...

PT-2023-6146 · Juniper Networks · Junos Evolved +1

Name of the Vulnerable Software and Affected Versions: Juniper Networks Junos OS versions prior to 20.4R3-S4 Juniper Networks Junos OS versions 21.1 prior to 21.1R3-S4 Juniper Networks Junos OS versions 21.2 prior to 21.2R3-S2 Juniper Networks Junos OS versions 21.3 prior to 21.3R2-S2, 21.3R3-S1...

CVE-2023-4401

Dell SmartFabric Storage Software v1.4 and earlier contains an OS Command Injection Vulnerability in the CLI use of the ‘more’ command. A local or remote authenticated attacker could potentially exploit this vulnerability, leading to the ability to gain root-level access...

CVE-2023-42820

JumpServer is an open source bastion host. This vulnerability is due to exposing the random number seed to the API, potentially allowing the randomly generated verification codes to be replayed, which could lead to password resets. If MFA is enabled users are not affect. Users not using local...

Design/Logic Flaw

JumpServer is an open source bastion host. This vulnerability is due to exposing the random number seed to the API, potentially allowing the randomly generated verification codes to be replayed, which could lead to password resets. If MFA is enabled users are not affect. Users not using local...

CVE-2023-42820

JumpServer is an open source bastion host. This vulnerability is due to exposing the random number seed to the API, potentially allowing the randomly generated verification codes to be replayed, which could lead to password resets. If MFA is enabled users are not affect. Users not using local...

CVE-2023-42820 Random seed leakage in Jumpserver

JumpServer is an open source bastion host. This vulnerability is due to exposing the random number seed to the API, potentially allowing the randomly generated verification codes to be replayed, which could lead to password resets. If MFA is enabled users are not affect. Users not using local...

CVE-2023-42820 Random seed leakage in Jumpserver

JumpServer is an open source bastion host. This vulnerability is due to exposing the random number seed to the API, potentially allowing the randomly generated verification codes to be replayed, which could lead to password resets. If MFA is enabled users are not affect. Users not using local...