CVE-2021-42082

Local users are able to execute scripts under root privileges. POC On the local host run the following command: curl 'localhost:8154/qstor/qsupgrade.py?taskId=1&a=;whoami'...

CVE-2021-42082 Local Privilege Escalation to root in OSNEXUS QuantaStor before 6.0.0.355

Local users are able to execute scripts under root privileges. POC On the local host run the following command: curl 'localhost:8154/qstor/qsupgrade.py?taskId=1&a=;whoami'...

CVE-2021-42082

CVE-2021-42082 affects OSNEXUS QuantaStor prior to 6.0.0.355, enabling local users to escalate to root by executing scripts (e.g., via a crafted upgrade script). Evidence from CVE records and related sources confirms the affected product/version and local-privilege escalation impact, with a PoC s...

CVE-2021-42082: Improper Privilege Management

Local users are able to execute scripts under root privileges. POC On the local host run the following command: curl 'localhost:8154/qstor/qsupgrade.py?taskId=1&a=;whoami'...

Input validation

Improper Information in Cybersecurity Guidebook in Bosch Building Integration System BIS 5.0 may lead to wrong configuration which allows local users to access data via network...

CVE-2023-29241

Improper Information in Cybersecurity Guidebook in Bosch Building Integration System BIS 5.0 may lead to wrong configuration which allows local users to access data via network...

CVE-2023-29241

Improper Information in Cybersecurity Guidebook in Bosch Building Integration System BIS 5.0 may lead to wrong configuration which allows local users to access data via network...

CVE-2023-29241: Incomplete Documentation of Program Execution

Improper Information in Cybersecurity Guidebook in Bosch Building Integration System BIS 5.0 may lead to wrong configuration which allows local users to access data via network...

CVE-2023-2818

An insecure filesystem permission in the Insider Threat Management Agent for Windows enables local unprivileged users to disrupt agent monitoring. All versions prior to 7.14.3 are affected. Agents for MacOS and Linux and Cloud are unaffected...

CVE-2023-2818 ITM Windows Agent Insecure Filesystem Permissions

An insecure filesystem permission in the Insider Threat Management Agent for Windows enables local unprivileged users to disrupt agent monitoring. All versions prior to 7.14.3 are affected. Agents for MacOS and Linux and Cloud are unaffected...

Low: screen

Issue Overview: socket.c in GNU Screen through 4.9.0, when installed setuid or setgid the default on platforms such as Arch Linux and FreeBSD, allows local users to send a privileged SIGHUP signal to any PID, causing a denial of service or disruption of the target process. CVE-2023-24626 Affected...

Important: ncurses

Issue Overview: ncurses before 6.4 20230408, when used by a setuid application, allows local users to trigger security-relevant memory corruption via malformed data in a terminfo database file that is found in $HOME/.terminfo or reached via the TERMINFO or TERM environment variable. CVE-2023-2949...

CVE-2023-36631

Lack of access control in wfc.exe in Malwarebytes Binisoft Windows Firewall Control 6.9.2.0 allows local unprivileged users to bypass Windows Firewall restrictions via the user interface's rules tab. NOTE: the vendor's perspective is "this is intended behavior as the application can be locked usi...

Malwarebytes 安全漏洞

Malwarebytes is an application from the American company Malwarebytes that provides anti-malware features to devices. The software is designed to protect against viruses, spyware, Trojans, worms, dial-up programs, and other malware. A security vulnerability exists in Malwarebytes Binisoft Windows...

PT-2023-25644 · Malwarebytes · Malwarebytes Binisoft Windows Firewall Control

Name of the Vulnerable Software and Affected Versions: Malwarebytes Binisoft Windows Firewall Control version 6.9.2.0 Description: The issue concerns a lack of access control in the wfc.exe component of Malwarebytes Binisoft Windows Firewall Control, allowing local unprivileged users to bypass...

K000135206: Linux kernel vulnerability CVE-2023-32233

Security Advisory Description In the Linux kernel through 6.3.1, a use-after-free in Netfilter nftables when processing batch requests can be abused to perform arbitrary read and write operations on kernel memory. Unprivileged local users can obtain root privileges. This occurs because anonymous...

CVE-2023-26427

Default permissions for a properties file were too permissive. Local system users could read potentially sensitive information. We updated the default permissions for noreply.properties set during package installation. No publicly available exploits are known...

Open-Xchange OX App Suite 安全漏洞

Open-Xchange OX App Suite is an e-mail and productivity suite client software from German company Open-Xchange. A security vulnerability exists in OX App Suite that stems from overly lax default permissions on file attributes, which allows local system users to read potentially sensitive...

PT-2023-20623 · Ox Software Gmbh +1 · Ox App Suite +1

Name of the Vulnerable Software and Affected Versions: No specific software name or version is mentioned in the provided descriptions. Description: The issue concerns default permissions for a properties file being too permissive, allowing local system users to read potentially sensitive...

CVE-2023-26427: Insecure Storage of Sensitive Information

Default permissions for a properties file were too permissive. Local system users could read potentially sensitive information. We updated the default permissions for noreply.properties set during package installation. No publicly available exploits are known...