523 matches found
CVE-2022-23597 Remote program execution with user interaction
Element Desktop is a Matrix client for desktop platforms with Element Web at its core. Element Desktop before 1.9.7 is vulnerable to a remote program execution bug with user interaction. The exploit is non-trivial and requires clicking on a malicious link, followed by another button click. To the...
CVE-2022-23597
Element Desktop before 1.9.7 is vulnerable to a remote code execution bug via user interaction that requires a malicious link click followed by another button click. The attacker can specify a binary path on the victim’s machine for execution (arguments cannot be set), and in some configurations ...
SUSE SLES12 Security Update : containerd, docker (SUSE-SU-2022:0213-1)
The remote SUSE Linux SLES12 / SLESSAP12 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2022:0213-1 advisory. - CVE-2021-41089: Fixed 'cp' can chmod host files bsc1191015. - CVE-2021-41091: Fixed flaw that could lead to data directory...
Palo Alto Networks Cortex XDR Elevation of Privilege Vulnerability
Palo Alto Networks Cortex XDR is a security operations platform for remote endpoint-based detection from Palo Alto Networks Malaysia. An elevation of privilege vulnerability exists in the Palo Alto Networks Cortex XDR agent that originates from an incorrectly programmed call to an advanced local...
Cortex XDR Agent: Unintended Program Execution When Using Live Terminal Session
An untrusted search path vulnerability exists in the Palo Alto Networks Cortex XDR agent that enables a local attacker with file creation privilege in the Windows root directory such as C:\ to store a program that can then be unintentionally executed by another local user when that user utilizes ...
Privilege Escalation
github.com/containerd/containerd is vulnerable to privilege escalation. The vulnerability exists due to insecure permission which allows an attacker to traverse directory contents and execute programs...
Design/Logic Flaw
Improper control of program execution vulnerability in RevoWorks Browser 2.1.230 and earlier allows an attacker to execute an arbitrary command or code via unspecified vectors...
CVE-2021-20790
CVE-2021-20790 affects RevoWorks Browser (versions up to 2.1.230) and is described as an improper control of program execution (CWE-114) between the isolated environment and the local environment. The vulnerability allows an attacker to execute arbitrary commands or code on the user’s browser run...
PT-2021-14245
Name of the Vulnerable Software and Affected Versions: RevoWorks Browser versions 2.1.230 and earlier Description: The issue allows an attacker to execute arbitrary commands or code via unspecified vectors, due to improper control of program execution. Recommendations: For RevoWorks Browser...
CVE-2021-20790: Undefined Security Weakness
Improper control of program execution vulnerability in RevoWorks Browser 2.1.230 and earlier allows an attacker to execute an arbitrary command or code via unspecified vectors...
JVN#81658818: Multiple vulnerabilities in RevoWorks Browser
RevoWorks Browser provided by J’s Communication Co., Ltd. is a virtual browser which enables internet isolation. It provides the function that enables access to drives, folders, files, and registries under the isolated environment from the local environment when running the web browser. RevoWorks...
PT-2021-7961
Name of the Vulnerable Software and Affected Versions Moby Docker Engine versions prior to 20.10.9 Description A bug was found in Moby Docker Engine where the data directory typically /var/lib/docker contained subdirectories with insufficiently restricted permissions, allowing otherwise...
GHSA-HR3C-6MMP-6M39 Memory corruption slice-deque
Affected versions of this crate did not properly update the head and tail of the deque when inserting and removing elements from the front if, before insertion or removal, the tail of the deque was in the mirrored memory region, and if, after insertion or removal, the head of the deque is exactly...
Design/Logic Flaw
The USB vHub in the Teradici PCOIP Software Agent prior to version 21.07.0 would accept commands from any program, which may allow an attacker to elevate privileges by changing the flow of program execution within the vHub driver...
CVE-2021-35448
Emote Interactive Remote Mouse 3.008 on Windows allows attackers to execute arbitrary programs as Administrator by using the Image Transfer Folder feature to navigate to cmd.exe. It binds to local ports to listen for incoming connections...
CVE-2021-35448
The CVE-2021-35448 entry concerns Emote Interactive Remote Mouse 3.008 for Windows. Affected functionality is the Image Transfer Folder feature, where an attacker can navigate to cmd.exe, enabling arbitrary program execution with Administrator privileges. The exploit is a local privilege escalati...
CVE-2021-35448: Improper Privilege Management
Emote Interactive Remote Mouse 3.008 on Windows allows attackers to execute arbitrary programs as Administrator by using the Image Transfer Folder feature to navigate to cmd.exe. It binds to local ports to listen for incoming connections...
CVE-2021-3013
ripgrep before 13 on Windows allows attackers to trigger execution of arbitrary programs from the current working directory via the -z/--search-zip or --pre flag...
