CVE-2018-9021

An authentication bypass vulnerability in CA Privileged Access Manager 2.8.2 and earlier allows remote attackers to execute arbitrary commands with specially crafted requests...

CVE-2018-9025

An input validation vulnerability in CA Privileged Access Manager 2.x allows remote attackers to poison log files with specially crafted input...

CVE-2018-9029

An improper input validation vulnerability in CA Privileged Access Manager 2.x allows remote attackers to conduct SQL injection attacks...

CVE-2018-9026

CA Privileged Access Manager 2.x is affected by CVE-2018-9026, a session fixation vulnerability that could allow remote attackers to hijack user sessions via a specially crafted request. The CNVD/NVD entries confirm the affected product version (2.x) and the vulnerability class but do not provide...

CVE-2018-9022

An authentication bypass vulnerability in CA Privileged Access Manager 2.8.2 and earlier allows remote attackers to execute arbitrary code or commands by poisoning a configuration file...

CVE-2015-4664

An improper input validation vulnerability in CA Privileged Access Manager 2.4.4.4 and earlier allows remote attackers to execute arbitrary commands...

CVE-2018-9028

CA Privileged Access Manager 2.x has weak password encryption that reduces password-cracking complexity, as described for CVE-2018-9028. The connected CNVD/NVD entries corroborate a weak encryption vulnerability in this product line. No specific exploit details, affected versions beyond 2.x, or r...

Security Bulletin: Privileged access can be obtained from IBM Service account on IBM Storwize V7000 Unified (CVE-2014-3043)

Summary A fix is available for IBM Storwize V7000 Unified, for the security issue that privileged access can be obtained from IBM Service account. Vulnerability Details CVEID: CVE-2014-3043 DESCRIPTION: The IBM Storwize V7000 Unified service account can be used to obtain unauthorized privileges o...

Security Bulletin: Samba vulnerability issue on IBM Storwize V7000 Unified (CVE-2013-4408 and CVE-2012-6105)

Summary An attacker could gain privileged access to IBM Storwize V7000 Unified system by exploiting a vulnerability in Samba. Vulnerability Details CVE ID: CVE-2013-4408 and CVE-2012-6105 DESCRIPTION: This issue affects only those IBM Storwize V7000 Unified systems that use Active Directory serve...

Google Android Qualcomm Qdsp6v2 Privilege Access Control Vulnerability

Android on Google Pixel and Nexus is an open source Linux-based operating system for the Google Pixel and Nexus smartphones developed by Google Inc. and the Open Handset Alliance OHA.The Qualcomm Qdsp6v2 is one of the Qualcomm Qualcomm digital signal processor components. A privilege access contr...

CVE-2017-7761

The Mozilla Maintenance Service "helper.exe" application creates a temporary directory writable by non-privileged users. When this is combined with creation of a junction a form of symbolic link, protected files in the target directory of the junction can be deleted by the Mozilla Maintenance...

CVE-2017-7768

The Mozilla Maintenance Service can be invoked by an unprivileged user to read 32 bytes of any arbitrary file on the local system by convincing the service that it is reading a status file provided by the Mozilla Windows Updater. The Mozilla Maintenance Service executes with privileged access,...

CVE-2017-7761

The Mozilla Maintenance Service "helper.exe" application creates a temporary directory writable by non-privileged users. When this is combined with creation of a junction a form of symbolic link, protected files in the target directory of the junction can be deleted by the Mozilla Maintenance...

Design/Logic Flaw

The Mozilla Maintenance Service "helper.exe" application creates a temporary directory writable by non-privileged users. When this is combined with creation of a junction a form of symbolic link, protected files in the target directory of the junction can be deleted by the Mozilla Maintenance...

Code injection

The Mozilla Maintenance Service can be invoked by an unprivileged user to read 32 bytes of any arbitrary file on the local system by convincing the service that it is reading a status file provided by the Mozilla Windows Updater. The Mozilla Maintenance Service executes with privileged access,...

CVE-2017-7768

CVE-2017-7768: Local privilege issue where an unprivileged user can read 32 bytes from any local file via Mozilla Maintenance Service by convincing it to read a status file from the Windows updater. Affected: Firefox ESR < 52.2 and Firefox

CVE-2017-5409

The Mozilla Windows updater can be called by a non-privileged user to delete an arbitrary local file by passing a special path to the callback parameter through the Mozilla Maintenance Service, which has privileged access. Note: This attack requires local system access and only affects Windows...

kernel: Out-of-bounds write via userland offsets in ebt_entry struct in netfilter/ebtables.c

A flaw was found in the Linux kernel's implementation of 32-bit syscall interface for bridging. This allowed a privileged user to arbitrarily write to a limited range of kernel memory...

Microsoft Active Directory CVE-2018-0890 Security Bypass Vulnerability

Description Microsoft Active Directory is prone to a security-bypass vulnerability. An attacker can exploit this issue to bypass certain security restrictions and perform unauthorized actions; this may aid in launching further attacks. Technologies Affected Microsoft Windows 10 Version 1607 for...

CVE-2016-8717

An exploitable Use of Hard-coded Credentials vulnerability exists in the Moxa AWK-3131A Wireless Access Point running firmware 1.1. The device operating system contains an undocumented, privileged root account with hard-coded credentials, giving attackers full control of affected devices...