CVE-2020-13646

CVE-2020-13646 affects Cheetah free WiFi 5.1. The liebaonat.sys driver does not validate input values for IOCTLs 0x830020f8, 0x830020E0, 0x830020E4, or 0x8300210c, enabling local attackers to cause a denial of service (BSOD) or possibly other impact. Root cause: input validation failure in IOCTL ...

CVE-2020-13812

An issue was discovered in Foxit Studio Photo before 3.6.6.922. It allows local users to gain privileges via a crafted DLL in the current working directory...

CVE-2020-13813

An issue was discovered in Foxit Studio Photo before 3.6.6.922. It allows local users to gain privileges via a crafted DLL in the current working directory when FoxitStudioPhoto3663.6.6.916.exe is used...

Directory traversal

An issue was discovered in Foxit Studio Photo before 3.6.6.922. It allows local users to gain privileges via a crafted DLL in the current working directory...

Directory traversal

An issue was discovered in Foxit Studio Photo before 3.6.6.922. It allows local users to gain privileges via a crafted DLL in the current working directory when FoxitStudioPhoto3663.6.6.916.exe is used...

CVE-2020-13813

An issue was discovered in Foxit Studio Photo before 3.6.6.922. It allows local users to gain privileges via a crafted DLL in the current working directory when FoxitStudioPhoto3663.6.6.916.exe is used...

CVE-2014-8938

Lexiglot through 2014-11-20 allows local users to obtain sensitive information by listing a process because the username and password are on the command line...

CVE-2020-13634

CVE-2020-13634 affects Windows Master (Windows Optimization Master) version 7.99.13.604. The vulnerability resides in the WoptiHWDetect.SYS driver, which fails to validate input values received via IOCTL 0xF1002558, enabling local users to trigger a denial of service (BSOD) and potentially other ...

CVE-2020-13149

Weak permissions on the "%PROGRAMDATA%\MSI\Dragon Center" folder in Dragon Center before 2.6.2003.2401, shipped with Micro-Star MSI Gaming laptops, allows local authenticated users to overwrite system files and gain escalated privileges. One attack method is to change the Recommended App binary...

CVE-2020-13149

Weak permissions on the "%PROGRAMDATA%\MSI\Dragon Center" folder in Dragon Center before 2.6.2003.2401, shipped with Micro-Star MSI Gaming laptops, allows local authenticated users to overwrite system files and gain escalated privileges. One attack method is to change the Recommended App binary...

Pillow Temporary file name leakage

The 1 JpegImagePlugin.py and 2 EpsImagePlugin.py scripts in Python Image Library PIL 1.1.7 and earlier and Pillow before 2.3.1 uses the names of temporary files on the command line, which makes it easier for local users to conduct symlink attacks by listing the processes...

Insecure Temporary Directory

ant uses an insecure temporary directory. The system property java.io.tempdir causes insecure permissions to be set on a directory, allowing local users to access the temporary directory or write arbitrary files into it. This could also lead to an attacker injecting modified source files into the...

CVE-2020-1998 PAN-OS: Improper SAML SSO authorization of shared local users

An improper authorization vulnerability in PAN-OS that mistakenly uses the permissions of local linux users instead of the intended SAML permissions of the account when the username is shared for the purposes of SSO authentication. This can result in authentication bypass and unintended resource...

Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2020-5671)

The remote Oracle Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2020-5671 advisory. - HID: hiddev: do cleanup in failure of opening a device Hillf Danton Orabug: 31206361 CVE-2019-19527 - HID: hiddev: avoid opening a disconnected...

CVE-2020-12680

Avira Free Antivirus through 15.0.2005.1866 allows local users to discover user credentials. The functions of the executable file Avira.PWM.NativeMessaging.exe are aimed at collecting credentials stored in Chrome, Firefox, Opera, and Edge. The executable does not verify the calling program and th...

Design/Logic Flaw

Avira Free Antivirus through 15.0.2005.1866 allows local users to discover user credentials. The functions of the executable file Avira.PWM.NativeMessaging.exe are aimed at collecting credentials stored in Chrome, Firefox, Opera, and Edge. The executable does not verify the calling program and th...

CVE-2020-7264

Privilege Escalation vulnerability in McAfee Endpoint Security ENS for Windows prior to 10.7.0 Hotfix 199847 allows local users to delete files the user would otherwise not have access to via manipulating symbolic links to redirect a McAfee delete action to an unintended file. This is achieved...

CVE-2020-7266

Privilege Escalation vulnerability in McAfee VirusScan Enterprise VSE for Windows prior to 8.8 Patch 14 Hotfix 116778 allows local users to delete files the user would otherwise not have access to via manipulating symbolic links to redirect a McAfee delete action to an unintended file. This is...

Privilege escalation

Privilege Escalation vulnerability in McAfee VirusScan Enterprise VSE for Windows prior to 8.8 Patch 14 Hotfix 116778 allows local users to delete files the user would otherwise not have access to via manipulating symbolic links to redirect a McAfee delete action to an unintended file. This is...

Privilege escalation

Privilege Escalation vulnerability in McAfee Endpoint Security ENS for Mac prior to 10.6.9 allows local users to delete files the user would otherwise not have access to via manipulating symbolic links to redirect a McAfee delete action to an unintended file. This is achieved through running a...