CVE-2024-24892

Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection', Improper Privilege Management vulnerability in openEuler migration-tools on Linux allows Command Injection, Restful Privilege Elevation. This vulnerability is associated with program files...

CVE-2024-24892 Unauthorized RCE in migration-tools

Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection', Improper Privilege Management vulnerability in openEuler migration-tools on Linux allows Command Injection, Restful Privilege Elevation. This vulnerability is associated with program files...

CVE-2024-24892

CVE-2024-24892 describes an OS command injection and privilege escalation in openEuler migration-tools (versions 1.0.0–1.0.1). The root cause is improper neutralization of elements used in OS commands, allowing remote command execution via an exposed interface, which can lead to high-severity imp...

GHSA-R6VW-8V8R-PMP4 Server Side Template Injection (SSTI)

Summary Due to the unrestricted access to twig extension class from grav context, an attacker can redefine config variable. As a result, attacker can bypass previous patch. Details The twig context has a function declared called getFunction. php public function getFunction$name if...

CVE-2024-28118

Grav is an open-source, flat-file content management system. Prior to version 1.7.45, due to the unrestricted access to twig extension class from Grav context, an attacker can redefine config variable. As a result, attacker can bypass a previous SSTI mitigation. Twig processing of static pages ca...

CVE-2024-28119 Grav vulnerable to Server Side Template Injection (SSTI) via Twig escape handler

Grav is an open-source, flat-file content management system. Prior to version 1.7.45, due to the unrestricted access to twig extension class from grav context, an attacker can redefine the escape function and execute arbitrary commands. Twig processing of static pages can be enabled in the front...

CVE-2024-28117

Grav (CVE-2024-28117) is vulnerable to Server-Side Template Injection due to improper validation of accessible functions: Utils::isDangerousFunction checks are bypassed for twig_array_map, allowing an attacker to execute arbitrary commands via the Twig processor when static pages are processed. A...

CVE-2024-28117 Grav vulnerable to Server Side Template Injection (SSTI)

Grav is an open-source, flat-file content management system. Prior to version 1.7.45, Grav validates accessible functions through the Utils::isDangerousFunction function, but does not impose restrictions on twig functions like twigarraymap, allowing attackers to bypass the validation and execute...

CVE-2024-28117 Grav vulnerable to Server Side Template Injection (SSTI)

Grav is an open-source, flat-file content management system. Prior to version 1.7.45, Grav validates accessible functions through the Utils::isDangerousFunction function, but does not impose restrictions on twig functions like twigarraymap, allowing attackers to bypass the validation and execute...

The vulnerability of the Azure Data Studio software for data development and management, which involves connecting to cloud and local databases, stems from lack of access control mechanisms. This allows attackers to exploit their privileges.

The vulnerability of the Azure Data Studio software for data development and management, which connects to cloud and local databases, is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to enhance their privileges...

Cisco IOS XR Flaws Enable Privilege Elevation and DoS Attacks

Summary: Three high-severity vulnerabilities have been discovered in the Cisco IOS XR software, posing risks of denial-of-service DoS attacks and elevation of privilege. These vulnerabilities are tracked as CVE-2024-20320, CVE-2024-20318, and CVE-2024-20327. Threat Level - Amber | Vulnerability...

NETGEAR DGND4000 Elevation of Privilege Vulnerability

The NETGEAR DGND4000 is a wireless router , with modem capabilities. An elevation of privilege vulnerability exists in the ETGEAR DGND4000 that originates from elevating privileges to the /setup.cgi component via the nextfile parameter. No details of the vulnerability are provided at this time...

Security Bulletin: IBM i is vulnerable to a privilege elevation due to an unqualified library call in Db2 for IBM i. [CVE-2024-22346]

Summary IBM i is vulnerable to a user gaining elevated privilege due to a CL command being called without library qualification, in Db2 for IBM i, as described in the vulnerability details section. This bulletin identifies the steps to take to address the vulnerability as described in the...

Microsoft Windows Multiple Vulnerabilities (KB5035845)

This host is missing an important security update according to Microsoft KB5035845 SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescriptio...

Microsoft Windows Multiple Vulnerabilities (KB5035853)

This host is missing an important security update according to Microsoft KB5035853 SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescriptio...

Microsoft Windows Multiple Vulnerabilities (KB5035858)

This host is missing a critical security update according to Microsoft KB5035858 SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2024-21418

Software for Open Networking in the Cloud SONiC Elevation of Privilege Vulnerability...

CVE-2024-21330 Open Management Infrastructure (OMI) Elevation of Privilege Vulnerability

...

PT-2024-2121 · Microsoft · Windows Graphics +1

Name of the Vulnerable Software and Affected Versions: Windows Graphics Component affected versions not specified Description: The issue is related to insufficient access restrictions in the Windows Graphics Component, allowing an attacker to elevate their privileges. This can affect the system,...

Microsoft Windows USB Print Driver 安全漏洞

Microsoft Windows USB Print Driver is a USB printer device driver from Microsoft USA. Microsoft Windows USB Print Driver suffers from an elevation of privilege vulnerability due to a flaw in the kernel, which can be exploited by an authenticated attacker to gain SYSTEM privileges...