McAfee Agent Command Injection Vulnerability

The McAfee McAfee Agent MA is a set of client components from McAfee, Inc. that provides secure communications between ePolicy Orchestrator the antivirus management platform and managed products. A security vulnerability exists in the McAfee Agent that originates from allowing a local user to...

Important: kernel

Issue Overview: A flaw was found in the Linux kernel. Memory corruption can be exploited to gain root privileges from unprivileged processes. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability. CVE-2020-14386 Affected Packages: kerne...

Mageia: Security Advisory (MGASA-2019-0068)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Mageia: Security Advisory (MGASA-2019-0087)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Grandstream Networks UCM6200 Series SQL Injection Vulnerability

Grandstream UCM6200 series is vulnerable to an unauthenticated remote SQL injection via crafted HTTP request. Exploitation can allow for code execution as root...

Exploit for Out-of-bounds Write in Polkit_Project Polkit

CVE-2021-4034 https://www.qualys.com/2022/01/25/cve-2021-4034...

Ubiquitous Linux Bug: ‘An Attacker’s Dream Come True’

UPDATE Every major Linux distribution has an easily exploited memory-corruption bug that’s been lurking for 12 years – a stunning revelation that’s likely to be followed soon by in-the-wild exploits, researchers warn. Successful exploitation gives full root access to any unprivileged user. The...

Exploit for Out-of-bounds Write in Polkit_Project Polkit

CVE-2021-4034 Exploit for the pwnkit vulnerabilityhttps://...

Exploit for Out-of-bounds Write in Polkit_Project Polkit

poc-cve-2021-4034 PoC for CVE-2021-4034 dubbed pwnkit !Rele...

polkit: Local privilege escalation in pkexec due to incorrect handling of argument vector

A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool designed to allow unprivileged users to run commands as privileged users according predefined policies. The current version of pkexec doesn't handle the calling parameters coun...

CVE-2021-34865

This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of multiple NETGEAR routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the minihttpd service, which listens on TCP port 80 by default. The...

CVE-2021-46089

In JeecgBoot 3.0, there is a SQL injection vulnerability that can operate the database with root privileges...

Polkit buffer error vulnerability

pkexec is a SUID root program that is installed on every major Linux distribution by default. polkit pkexec elevation of privilege vulnerability can be exploited to gain full root privileges on a host...

Grandstream UCM62xx IP PBX sendPasswordEmail Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Grandstream UCM62xx IP PBX sendPasswordEmail RCE', 'Description' = %q This module exploits an unauthenticated SQL injection vulnerability...

CVE-2020-17383

A directory traversal vulnerability on Telos Z/IP One devices through 4.0.0r grants an unauthenticated individual root level access to the device's file system. This can be used to identify configuration settings, password hashes for built-in accounts, and the cleartext password for remote...

CVE-2020-17383

A directory traversal vulnerability on Telos Z/IP One devices through 4.0.0r grants an unauthenticated individual root level access to the device's file system. This can be used to identify configuration settings, password hashes for built-in accounts, and the cleartext password for remote...

CVE-2020-17383

The CVE-2020-17383 entry documents a directory traversal vulnerability in Telos Z/IP One devices (versions before 4.0.0r). The underlying issue is lack of filtering/escaping of directory parameters and special characters, enabling an unauthenticated attacker to obtain root access to the device fi...

Telos Alliance Telos Z/IP One path traversal vulnerability

The Telos Alliance Telos Z/Ip One is a single space rack unit from Telos Alliance USA. 1 Ru rackmount Ip codec for remote broadcasting. A path traversal vulnerability exists in Telos Alliance Telos Z/IP One versions prior to 4.0.0r that stems from the software's lack of filtering and escaping of...

xrdp -- privilege escalation

xrdp project reports: An integer underflow leading to a heap overflow in the sesman server allows any unauthenticated attacker which is accessible to a sesman server listens by default on localhost when installing xrdp, but can be remote if configured otherwise to execute code as root...

DEBIAN-CVE-2022-23220

USBView 2.1 before 2.2 allows some local users e.g., ones logged in via SSH to execute arbitrary code as root because certain Polkit settings e.g., allowany=yes for pkexec disable the authentication requirement. Code execution can, for example, use the --gtk-module option. This affects Ubuntu,...