Race condition

A vulnerability classified as problematic has been found in Mirmay Secure Private Browser and File Manager up to 2.5. Affected is the Auto Lock. A race condition leads to a local authentication bypass. The exploit has been disclosed to the public and may be used...

PT-2022-8043

Name of the Vulnerable Software and Affected Versions Mirmay Secure Private Browser and File Manager versions up to 2.5 Description A race condition in the Auto Lock feature leads to a local authentication bypass. The issue has been publicly disclosed and may be exploited. Recommendations For...

Microsoft Windows Security Account Manager 权限许可和访问控制问题漏洞

Microsoft Windows Security Account Manager is a Windows security account manager from Microsoft USA for storing user passwords. It can be used to authenticate local and remote users. Microsoft Windows Security Account Manager is vulnerable to privilege permission and access control issues. No...

MariaDB CONNECT Storage Engine Format String Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of MariaDB. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of SQL queries. The issue results from the lack of proper validation of a user-supplied string before using it as a format specifier. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of the service account. Was ZDI-CAN-16193.

...

CVE-2022-24051

MariaDB CONNECT Storage Engine Format String Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of MariaDB. Authentication is required to exploit this vulnerability. The specific flaw exists within the processing of SQL...

CVE-2021-27654

Forgotten password reset functionality for local accounts can be used to bypass local authentication checks...

Default credentials

Forgotten password reset functionality for local accounts can be used to bypass local authentication checks...

CVE-2021-27654

CVE-2021-27654 affects Pegasystems Pega. The vulnerability arises from a forgotten password reset functionality for local accounts that can bypass local authentication checks. Public data shows CVSS details: CVSS v3.1 base score 7.8 (HIGH) with LOCAL access, LOW attack complexity, privileges requ...

Pegasystems Pega 授权问题漏洞

Pegasystems Pega is a Java-based business process management tool from the U.S. company Pegasystems. It is used to build enterprise applications. A security vulnerability exists in Pegasystems Pega, which stems from a forgotten password reset feature for local accounts that can be used to bypass...

PT-2022-9840

Name of the Vulnerable Software and Affected Versions No specific software or versions mentioned. Description The issue concerns the forgotten password reset functionality for local accounts, which can be exploited to bypass local authentication checks. Recommendations At the moment, there is no...

CVE-2021-27654: Weak Password Recovery Mechanism for Forgotten Password

Forgotten password reset functionality for local accounts can be used to bypass local authentication checks...

FlexNet Unauthorized Access Vulnerability

An unauthorized access vulnerability exists in FlexNet 2020 R2.5 and prior versions of FlexNet, a software license manager from Flexera, Inc. of Chicago, USA. An attacker could exploit this vulnerability to modify other restricted files after passing local authentication...

PT-2022-4184 · Hewlett Packard · Hpe Oneview

Name of the Vulnerable Software and Affected Versions: HPE OneView versions prior to 6.6 Description: A local authentication restriction bypass issue was found, related to weaknesses in the authentication procedure. This could allow an attacker to bypass existing security restrictions. HPE has...

Security Bulletin: Linux Kernel as used by IBM QRadar SIEM contains multiple vulnerabilities

Summary Linux Kernel as used by IBM QRadar SIEM contains multiple vulnerabilities Vulnerability Details CVEID: CVE-2020-12362 DESCRIPTION: Intel Graphics Drivers could allow a local authenticated attacker to gain elevated privileges on the system, caused by an integer overflow in the firmware. An...

CVE-2021-32600

An exposure of sensitive information to an unauthorized actor vulnerability in FortiOS CLI 7.0.0, 6.4.0 through 6.4.6, 6.2.0 through 6.2.9, 6.0.x and 5.6.x may allow a local and authenticated user assigned to a specific VDOM to retrieve other VDOMs information such as the admin account list and t...

Vulnerability fixed in Cisco AnyConnect Secure Mobility Client

A vulnerability has been fixed in Cisco AnyConnect Secure Mobility Client. The vulnerability allows a locally authenticated malicious party to obtain elevated privileges. Cisco has released updates to fix the vulnerabilities. More information can be found on the page below:...

Fixed vulnerability in Snow Inventory Agent for Windows

A vulnerability has been fixed in Snow Inventory Agent for Windows. The vulnerability allows a locally authenticated malicious person able to manipulate data. Snow Globe has released updates to fix the vulnerability. fix. More information can be found on the page below:...

CVE-2021-34729

A vulnerability in the CLI of Cisco IOS XE SD-WAN Software and Cisco IOS XE Software could allow an authenticated, local attacker to execute arbitrary commands with elevated privileges on an affected device. This vulnerability is due to insufficient validation of arguments passed to certain CLI...

FlexNet Code Insight 安全漏洞

An unauthorized access vulnerability exists in FlexNet 2020 R2.5 and prior versions of FlexNet, a software license manager from Flexera, Inc. of Chicago, USA. An attacker could exploit this vulnerability to modify other restricted files after passing local authentication...

Cisco Patches Critical Bug With Public Exploit

Cisco has patched a near-max critical bug in its NFVIS software for which there’s a publicly available proof-of-concept PoC exploit. On Wednesday, Cisco released patches for the flaw – an authentication bypass vulnerability in Enterprise NFV Infrastructure Software NFVIS that’s tracked as...