CVE-2024-35288

Nitro PDF Pro before 13.70.8.82 and 14.x before 14.26.1.0 allows Local Privilege Escalation in the MSI Installer because custom actions occur unsafely in repair mode. CertUtil is run in a conhost.exe window, and there is a mechanism allowing CTRL+o to launch cmd.exe as NT AUTHORITY\SYSTEM...

CVE-2024-35288

Nitro PDF Pro before 13.70.8.82 and 14.x before 14.26.1.0 allows Local Privilege Escalation in the MSI Installer because custom actions occur unsafely in repair mode. CertUtil is run in a conhost.exe window, and there is a mechanism allowing CTRL+o to launch cmd.exe as NT AUTHORITY\SYSTEM...

CVE-2024-35288

CVE-2024-35288 affects Nitro PDF Pro, specifically versions prior to 13.70.8.82 and 14.x prior to 14.26.1.0. The root cause is unsafe custom actions in the MSI installer when in repair mode, enabling Local Privilege Escalation. CertUtil runs in a conhost.exe window, and there is a mechanism allow...

CVE-2024-35288

Nitro PDF Pro before 13.70.8.82 and 14.x before 14.26.1.0 allows Local Privilege Escalation in the MSI Installer because custom actions occur unsafely in repair mode. CertUtil is run in a conhost.exe window, and there is a mechanism allowing CTRL+o to launch cmd.exe as NT AUTHORITY\SYSTEM...

Nitro Software Nitro PDF Pro 权限许可和访问控制问题漏洞

Nitro Software Nitro PDF Pro is a software that can be used to create and edit PDF files from Nitro Software, Inc. in the United States. A privilege license and access control issue vulnerability exists in Nitro Software Nitro PDF Pro versions 13.70.7.60 and earlier and 14.18.1.41 and earlier,...

Nitro PDF Pro Local Privilege Escalation

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Local Privilege Escalation via MSI Installer product: Nitro PDF Pro vulnerable version: 14.26.1.0 13.70.8.82 fixed version: 14.26.1.0 or higher 13.70.8.82 or higher CVE...

PT-2024-26417

Name of the Vulnerable Software and Affected Versions Nitro PDF Pro versions prior to 13.70.8.82 Nitro PDF Pro versions 14.x prior to 14.26.1.0 Description The issue allows Local Privilege Escalation in the MSI Installer because custom actions occur unsafely in repair mode. CertUtil is run in a...

Medium: docker

Issue Overview: When following an HTTP redirect to a domain which is not a subdomain match or exact match of the initial domain, an http.Client does not forward sensitive headers such as "Authorization" or "Cookie". For example, a redirect from foo.com to www.foo.com will forward the Authorizatio...

PT-2024-30783 · Nitropack · Nitropack

Name of the Vulnerable Software and Affected Versions: NitroPack versions 1.16.7 and earlier Description: The issue is related to improper control of code generation, allowing code injection. This is due to a Code Injection vulnerability in NitroPack Inc.'s NitroPack. Recommendations: For version...

Medium: runc

Issue Overview: The various Is methods IsPrivate, IsLoopback, etc did not work as expected for IPv4-mapped IPv6 addresses, returning false for addresses which would return true in their traditional IPv4 forms. CVE-2024-24790 Affected Packages: runc Note: This advisory is applicable to Amazon Linu...

The vulnerability of the get_user_pages_unlocked() function in the nitro_enclaves component of the Linux operating system allows a hacker to trigger a service failure.

The vulnerability of the getuserpagesunlocked function in the nitroenclaves component of the Linux operating system’s kernel is related to the use of this function to handle the mmap assertion. Exploiting this vulnerability could allow a attacker to trigger a service failure...

Malicious code in nitro-checker (PyPI)

--- -= Per source details. Do not edit below this line.=-...

MAL-2024-5412 Malicious code in nitro-checker (PyPI)

--- -= Per source details. Do not edit below this line.=-...

OPENSUSE-SU-2024:12757-1 aws-nitro-enclaves-binaryblobs-upstream-1.2.2~git0.4ccc639-1.1 on GA media

These are all security issues fixed in the aws-nitro-enclaves-binaryblobs-upstream-1.2.2git0.4ccc639-1.1 package on the GA media of openSUSE Tumbleweed...

openSUSE: Security Advisory for aws (SUSE-SU-2024:1984-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

OPENSUSE-SU-2024:13857-1 aws-nitro-enclaves-binaryblobs-upstream-1.2.3~git11.d3d77e0-1.1 on GA media

These are all security issues fixed in the aws-nitro-enclaves-binaryblobs-upstream-1.2.3git11.d3d77e0-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2024:11931-1 aws-nitro-enclaves-binaryblobs-upstream-1.2.0~git2.841ef94-1.1 on GA media

These are all security issues fixed in the aws-nitro-enclaves-binaryblobs-upstream-1.2.0git2.841ef94-1.1 package on the GA media of openSUSE Tumbleweed...

SUSE SLES15: aws-nitro-enclaves-binaryblobs-upstream / aws-nitro-enclaves-cli / etc (SUSE-SU-2024:1984-1)

The remote SUSE Linux SLES15 / SLESSAP15 / openSUSE 15 host has packages installed that are affected by a vulnerability as referenced in the SUSE-SU-2024:1984-1 advisory. - CVE-2023-50711: Fixed out of bounds memory accesses in embedded vmm-sys-util bsc1218501. Tenable has extracted the preceding...

openSUSE: Security Advisory for aws (SUSE-SU-2024:1966-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

SUSE-SU-2024:1984-1 Security update for aws-nitro-enclaves-cli

This update for aws-nitro-enclaves-cli fixes the following issues: - CVE-2023-50711: Fixed out of bounds memory accesses in embedded vmm-sys-util bsc1218501...