15851 matches found
MGASA-2022-0216 Updated webmin packages fix security vulnerability
Less privileged Webmin users excluding those created by Virtualmin and Cloudmin can modify arbitrary files with root privileges, and so run commands as root CVE-2022-30708...
PT-2022-21193 · Starwind · Starwind Stack +1
Name of the Vulnerable Software and Affected Versions: StarWind SAN and NAS version 0.2 build 1914 Description: A flaw was found in the REST API of StarWind Stack, allowing remote code execution. The REST command for changing the hostname does not check the new hostname parameter, which can be...
CVE-2022-30234
A CWE-798: Use of Hard-coded Credentials vulnerability exists that could allow arbitrary code to be executed when root level access is obtained. Affected Products: Wiser Smart, EER21000 & EER21001 V4.5 and prior...
CVE-2022-31483
An authenticated attacker can upload a file with a filename including “..” and “/” to achieve the ability to upload the desired file anywhere on the filesystem. This vulnerability impacts products based on HID Mercury Intelligent Controllers LP1501, LP1502, LP2500, LP4502, and EP4502 which contai...
UBUNTU-CVE-2022-32250
net/netfilter/nftablesapi.c in the Linux kernel through 5.18.1 allows a local user able to create user/net namespaces to escalate privileges to root because an incorrect NFTSTATEFULEXPR check leads to a use-after-free...
CVE-2021-44080
A Command Injection vulnerability in httpd web server setup.cgi in SerComm h500s, FW: lowi-h500s-v3.4.22 allows logged in administrators to arbitrary OS commands as root in the device via the connectiontype parameter of the statussupportdiagnostictracing.json endpoint...
SerComm h500s 操作系统命令注入漏洞
The SerComm h500s is a router device from SerComm China. A security vulnerability exists in the SerComm h500s lowi-h500s-v3.4.22 version, which stems from a command injection issue in the httpd web server setup.cgi. The vulnerability can be exploited to execute arbitrary operating system commands...
CVE-2021-44080: Improper Neutralization of Special Elements used in an OS Command
A Command Injection vulnerability in httpd web server setup.cgi in SerComm h500s, FW: lowi-h500s-v3.4.22 allows logged in administrators to arbitrary OS commands as root in the device via the connectiontype parameter of the statussupportdiagnostictracing.json endpoint...
Schneider Electric C-Bus Automation Controller (5500SHAC) 1.10 Remote Root Exploit
Summary The C-Bus Network Automation Controller 5500NAC and the Wiser for C-Bus Automation Controller 5500SHAC is an advanced controller from Schneider Electric. It is specifically designed to unite the C-Bus home automation solution with common household communication protocols, from lighting an...
CVE-2022-26691
An authorization vulnerability was found in the CUPS printing system. This security vulnerability occurs when local authorization happens. This flaw allows an attacker to authenticate to CUPS as root/admin without the 32-byte secret key and perform arbitrary code execution. Mitigation Red Hat has...
Linux perf Heap Buffer Overflow Privilege Escalation
The vulnerability of the sysperfeventopen function in the Linux operating system’s perf subsystem stems from the race condition within this subsystem. This condition can be exploited to initiate access to a freed memory area in the kernel. Exploiting this vulnerability allows a local attacker to...
Linux kernel io_uring Memory Corruption Privilege Escalation
The vulnerability of the asynchronous input/output interface iouring in Linux operating systems is related to integer overflow. Exploiting this vulnerability can allow an attacker to cause memory corruption and elevate their privileges to the root level...
CVE-2022-29402
TP-Link TL-WR840N EU v6.20 was discovered to contain insecure protections for its UART console. This vulnerability allows attackers to connect to the UART port via a serial connection and execute commands as the root user without authentication...
TP-LINK TL-WR840N 访问控制错误漏洞
The TP-LINK TL-WR840N is a wireless router from China P&L TP-LINK. An Access Control Error vulnerability exists in the TP-Link TL-WR840N EU v6.20, which stems from an insecure UART console, and can be exploited by an attacker to execute commands as the root user without authentication...
GHSA-FMRF-GVJP-5J5G Improper Privilege Management in Cilium
Impact If an attacker is able to perform a container escape of a container running as root on a host where Cilium is installed, the attacker can leverage Cilium's Kubernetes service account to gain access to cluster privileges that are more permissive than what is minimally required to operate...
Centreon Privilege Escalation
In Centreon VM through 19.04.3, centreon-backup.pl allows attackers to become root via a crafted script, due to incorrect rights of sourced configuration files...
GHSA-F24J-F97W-65H8 Centreon Privilege Escalation
In Centreon VM through 19.04.3, centreon-backup.pl allows attackers to become root via a crafted script, due to incorrect rights of sourced configuration files...
SUSE-SU-2022:1831-1 Security update for slurm_20_11
This update for slurm2011 fixes the following issues: - CVE-2022-29500: Fixed architectural flaw that could have been exploited to allow an unprivileged user to execute arbitrary processes as root bsc1199278. - CVE-2022-29501: Fixed a problem that an unprivileged user could have sent data to...
SUSE-SU-2022:1815-1 Security update for slurm_20_11
This update for slurm2011 fixes the following issues: - CVE-2022-29500: Fixed architectural flaw that could have been exploited to allow an unprivileged user to execute arbitrary processes as root bsc1199278. - CVE-2022-29501: Fixed a problem that an unprivileged user could have sent data to...
