Design/Logic Flaw

A Privilege Context Switching issue was discovered in join.c in Firejail 0.9.68. By crafting a bogus Firejail container that is accepted by the Firejail setuid-root program as a join target, a local attacker can enter an environment in which the Linux user namespace is still the initial user...

CVE-2022-31214

A Privilege Context Switching issue was discovered in join.c in Firejail 0.9.68. By crafting a bogus Firejail container that is accepted by the Firejail setuid-root program as a join target, a local attacker can enter an environment in which the Linux user namespace is still the initial user...

CVE-2022-31214

A Privilege Context Switching issue was discovered in join.c in Firejail 0.9.68. By crafting a bogus Firejail container that is accepted by the Firejail setuid-root program as a join target, a local attacker can enter an environment in which the Linux user namespace is still the initial user...

CVE-2022-31214

Firejail (version 0.9.68 affected) has a Privilege Context Switching flaw in join.c that lets a local user exploit a crafted join target to drop out of the initial user namespace and gain root privileges via setuid-root binaries. mitigations rely on upgrading to patched releases (e.g., Firejail 0...

GHSA-G9FW-9X87-RMRJ Privilege Context Switching Error in Elasticsearch

Elasticsearch versions before 6.8.13 and 7.9.2 contain a document disclosure flaw when Document or Field Level Security is used. Search queries do not properly preserve security permissions when executing certain complex queries. This could result in the search disclosing the existence of documen...

The vulnerability of the “gset” meta-command implementation in the PostgreSQL database management system allows a hacker to execute arbitrary code.

The vulnerability of the “gset” meta-command in the PostgreSQL database management system is related to errors in privilege context switching. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

Task Scheduler S4U Logon Elevation of Privilege

The windows task scheduler allows a split token administrator to register a task which runs as a batch job from a limited privilege context. This doesn’t require a user’s password to accomplish as the task will be run non-interactively and so doesn’t need access to the password in order to access...

CVE-2018-1000400

Kubernetes CRI-O version prior to 1.9 contains a Privilege Context Switching Error CWE-270 vulnerability in the handling of ambient capabilities that can result in containers running with elevated privileges, allowing users abilities they should not have. This attack appears to be exploitable via...

CVE-2018-1000400

Kubernetes CRI-O version prior to 1.9 contains a Privilege Context Switching Error CWE-270 vulnerability in the handling of ambient capabilities that can result in containers running with elevated privileges, allowing users abilities they should not have. This attack appears to be exploitable via...

CVE-2018-1000400

Kubernetes CRI-O version prior to 1.9 contains a Privilege Context Switching Error CWE-270 vulnerability in the handling of ambient capabilities that can result in containers running with elevated privileges, allowing users abilities they should not have. This attack appears to be exploitable via...

CVE-2018-1000400

KVE- CVE-2018-1000400 affects Kubernetes CRI-O prior to 1.9. The vulnerability arises from a Privilege Context Switching Error in handling ambient capabilities, allowing containers to run with elevated privileges. The initial description notes exploitation via container execution and a fix in 1.9...

CVE-2018-1000400

Kubernetes CRI-O version prior to 1.9 contains a Privilege Context Switching Error CWE-270 vulnerability in the handling of ambient capabilities that can result in containers running with elevated privileges, allowing users abilities they should not have. This attack appears to be exploitable via...

CVE-2018-1000400

Kubernetes CRI-O version prior to 1.9 contains a Privilege Context Switching Error CWE-270 vulnerability in the handling of ambient capabilities that can result in containers running with elevated privileges, allowing users abilities they should not have. This attack appears to be exploitable via...

Cron local privilege escalation

Palo Alto Networks firewalls use the cron infrastructure to perform household system cleanup at regular intervals. Due to an error in user input normalization, a file locally created by an end user and placed in a specific directory could be executed in a higher privilege context Ref. 93612...

Advantech WebAccess Dashboard Viewer FileUploadHandler Unrestricted File Upload Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Advantech WebAccess. Authentication is not required to exploit this vulnerability. The specific flaw exists within the WebAccess Dashboard Viewer. Insufficient validation within the FileUpload scri...

thunderbird: multiple issues

CVE-2015-0801 same-origin bypass: Mozilla developer Olli Pettay reported that while investigating Mozilla Foundation Security Advisory 2015-28, he and Mozilla developer Boris Zbarsky found an alternate way to trigger a similar vulnerability. The previously reported flaw used an issue with SVG...

DUO-PSA-2014-005: Duo Product Security Advisory

Duo Product Security Advisory Advisory ID: DUO-PSA-2014-005 Publication Date: 2014-05-12 Revision Date: 2014-05-27 Status: Confirmed, Fixed Document Revision: 3 Overview Duo Security has identified an issue in its Credential-Provider based Remote Desktop Protocol RDP integrations e.g. those...

DUO-PSA-2014-005: Duo Product Security Advisory

Duo Product Security Advisory Advisory ID: DUO-PSA-2014-005 Publication Date: 2014-05-12 Revision Date: 2014-05-27 Status: Confirmed, Fixed Document Revision: 3 Overview Duo Security has identified an issue in its Credential-Provider based Remote Desktop Protocol RDP integrations e.g. those...

Autodesk AutoCAD 2007 - 'color.dll' DLL Hijacking

/ Description: A vulnerability exists in windows that allows other applications dynamic link libraries to execute malicious code without the users consent, in the privelage context of the targeted application. Title: Autocad 2007 Professional dll color.dll Hijacking exploit Author: xsploited...

Autodesk AutoCAD 2007 - color.dll DLL Hijacking

Autodesk AutoCAD 2007 - color.dll DLL Hijacking / Description: A vulnerability exists in windows that allows other applications dynamic link libraries to execute malicious code without the users consent, in the privelage context of the targeted application. Title: Autocad 2007 Professional dll...