MAL-015

MAL-015：Ansible Tower 中的隔离逃逸 2 在特定 Rhel 7/8 配置上的 Ansible Tower 安装可能容易受到“作业隔离”逃逸的影响，该逃逸允许攻击者从隔离环境外部提升到“awx”用户。 在 CVE-2021-20253 被修复后，攻击者可以利用以下文件/配置来执行作业隔离逃逸漏洞： 文件“/var/spool/mail/awx”： 如果目标上安装了 SMTP 服务器，攻击者可以创建该文件 也可能由“useradd”等程序创建（如果使用自定义的 awx 用户） 在 Rhel 7 或更低版本中，为了安装 AWX，需要安装运行时版本的...

CVE-2021-20253

CVE-2021-20253: Ansible Tower 中通过作业隔离逃逸实现权限提升 在 ansible-tower 中发现了一个缺陷。默认安装容易受到作业隔离逃逸的影响，允许攻击者从隔离环境外部将权限从低权限用户提升到 awx 用户。此漏洞的最大威胁在于数据机密性、完整性以及系统可用性。 供应商披露： 该漏洞的供应商披露和修复方法可在此处找到：此处。 要求： 此漏洞需要： 能够在 Ansible Tower 的隔离环境中执行命令 具有对操作系统的低权限访问 概念验证： 更多详细信息和利用过程可在此 PDF 中找到。...

CVE-2026-81443

Dell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Server-Side Request Forgery SSRF vulnerability. A low privileged attacker with remote access could potentially exploit this vulnerability, leading to Server-side request forgery...

CVE-2026-83163

Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite component: Attachments / File Upload. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracl...

CVE-2026-83122

Vulnerability in the Oracle Report Manager product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low privileged attacker with network access via HTTPS to compromise Oracle Report Manager...

EUVD-2026-79739

Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite component: Internal Operations. Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Product Hub...

PT-2026-92113

SmartAdmin API Java17 SpringBoot3 version 3.30.0 contains an improper authorization vulnerability in the /employee/queryAll endpoint. The endpoint does not enforce the required function-level permission or data-scope authorization, allowing an authenticated low-privileged employee to retrieve...

EUVD-2026-78812

SmartAdmin API Java17 SpringBoot3 version 3.30.0 contains an improper authorization vulnerability in the /employee/queryAll endpoint. The endpoint does not enforce the required function-level permission or data-scope authorization, allowing an authenticated low-privileged employee to retrieve...

PT-2026-92671

Vulnerability in Oracle Application Testing Suite. The supported version that is affected is 13.3.0.1. Easily exploitable vulnerability allows low privileged attacker having Test Manager for Web Apps privilege with network access via HTTP to compromise Oracle Application Testing Suite. Successful...

CVE-2026-90933

laradashboard through 1.2.2 contains a missing authorization vulnerability in the Local License API endpoints that allows any authenticated user to read, overwrite, and delete premium module license keys. Attackers with low-privileged accounts can access GET /api/admin/licenses/show, POST...

CVE-2026-90933

laradashboard through 1.2.2 contains a missing authorization vulnerability in its Local License API endpoints. Any authenticated user with low privileges can access three endpoints — GET /api/admin/licenses/show , POST /api/admin/licenses/store , and POST /api/admin/licenses/remove — to read, ove...

Kibana 9.1.7 < 9.4.5 / 9.5.x < 9.5.1 DoS (ESA-2026-115)

The version of Kibana installed on the remote host is 9.1.7 or later prior to 9.4.5, or 9.5.x prior to 9.5.1. It is, therefore, affected by a vulnerability as referenced in the ESA-2026-115 advisory. - Uncaught Exception CWE-248 in Kibana can lead to a denial of service via Input Data Manipulatio...

CVE-2026-75729

Adobe Experience Manager is affected by a stored Cross-Site Scripting (XSS) vulnerability (CWE-79). A low-privileged attacker can inject malicious scripts into vulnerable form fields, which then execute in a victim's browser when the affected page is viewed. The CVSS 3.1 score is 5.4 (Medium) wit...

CVE-2026-75733 Adobe Experience Manager | Cross-site Scripting (Stored XSS) (CWE-79)

Adobe Experience Manager is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the...

CVE-2026-76968

SAP Web Dispatcher, Internet Communication Manager, and SAP Content Server are affected by an information disclosure vulnerability (CVSS 6.5, MEDIUM). An authenticated low-privileged attacker can access certain administrative functionality or interfaces to obtain sensitive information about the s...

PT-2026-88354

Adobe Experience Manager is affected by a stored Cross-Site Scripting XSS vulnerability that could be abused by a low-privileged attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the...

CVE-2026-78488

Dell SCG 5.0 Appliance versions prior to 5.36.00.16 and Dell SCG 5.0 Application versions prior to 5.36.00.00, contains an Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability. A low privileged attacker with remote access could potentially exploit...

EUVD-2026-71451

An information disclosure vulnerability in the ugw-deviceinfo method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V60005 returns detailed system version fields operatingsystem, gatewayversion to any authenticated user, including users with the low-privileged Standard role...

CVE-2026-75163

An information disclosure vulnerability in the ugw-deviceinfo method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V60005 returns detailed system version fields operatingsystem, gatewayversion to any authenticated user, including users with the low-privileged Standard role...

CVE-2026-75162

An information disclosure vulnerability in the opcua-configuration method of /cgi-bin/wwwugw.cgi in MBS-Solutions X-Serie Gateway firmware V60005 allows any remote authenticated user, including users with the low-privileged Standard role, to retrieve the configured OPC-UA authentication credentia...