Victron Energy Venus OS 安全漏洞

Victron Energy Venus OS is a software application.Victron Energy Unix-like distribution with a linux kernel. A security vulnerability exists in Victron Energy Venus OS version 2.72 and earlier, which arises from root access rights granting physical access to the device to anyone by default...

PT-2021-21364 · Victron Energy · Victron Energy Venus Os

Name of the Vulnerable Software and Affected Versions: Victron Energy Venus OS versions through 2.72 Description: The issue allows root access by default to anyone with physical access to the device, which may be considered a violation of security best practices. However, the vendor disagrees wit...

FortiManager & FortiAnalyzer - Use after free vulnerability in fgfmsd daemon

A Use After Free CWE-416 vulnerability in FortiManager and FortiAnalyzer fgfmsd daemon may allow a remote, non-authenticated attacker to execute unauthorized code as root via sending a specifically crafted request to the fgfm port of the targeted device...

CVE-2021-29707: Undefined Security Weakness

IBM HMC Hardware Management Console V9.1.910.0 and V9.2.950.0 could allow a local user to escalate their privileges to root access on a restricted shell. IBM X-Force ID: 200879...

IBM Power Hardware Management Console 安全漏洞

IBM Power HMC is a set of graphical interface software for configuring and managing the Power System family of servers from IBM in the United States. The software is primarily used to manage hardware such as servers. IBM Power HMC has an elevation of privilege vulnerability that could be exploite...

runc through 1.0-rc6 as used in Docker before 18.09.2 and other products allows attackers to overwrite the host runc binary (and consequently obtain host root access) by leveraging the ability to execute a command as root within one of these types of containers: (1) a new container with an attacker-controlled image or (2) an existing container to which the attacker previously had write access that can be attached with docker exec. This occurs because of file-descriptor mishandling related to /proc/self/exe.

...

CVE-2021-0278

An Improper Input Validation vulnerability in J-Web of Juniper Networks Junos OS allows a locally authenticated attacker to escalate their privileges to root over the target device. junos:18.3R3-S5 junos:18.4R3-S9 junos:19.1R3-S6 junos:19.3R2-S6 junos:19.3R3-S3 junos:19.4R1-S4 junos:19.4R3-S4...

OPENSUSE-SU-2021:2177-1 Security update for arpwatch

This update for arpwatch fixes the following issues: - CVE-2021-25321: Fixed local privilege escalation from runtime user to root bsc1186240...

Security update for arpwatch (important)

openSUSE Security Update: Security update for arpwatch Announcement ID: openSUSE-SU-2021:2177-1 Rating: important References: 1186240 Cross-References: CVE-2021-25321 CVSS scores: CVE-2021-25321 SUSE: 7.7 CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N Affected Products: openSUSE Leap 15.3 An update...

CVE-2021-1359

A vulnerability in the configuration management of Cisco AsyncOS for Cisco Web Security Appliance WSA could allow an authenticated, remote attacker to perform command injection and elevate privileges to root. This vulnerability is due to insufficient validation of user-supplied XML input for the...

CVE-2021-33217

An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. The Web Application allows Arbitrary Read/Write actions by authenticated users. The API allows an HTTP POST of arbitrary content into any file on the filesystem as root...

CVE-2020-24143

Directory traversal in the Video Downloader for TikTok aka downloader-tiktok plugin 1.3 for WordPress lets an attacker get access to files that are stored outside the web root folder via the njt-tk-download-video parameter...

PT-2021-3591 · Fortinet · Fortiwan

Name of the Vulnerable Software and Affected Versions: FortiWAN versions 4.5.7 and earlier Description: The issue exists due to the lack of neutralization of special elements used in the operating system command. Exploitation of this issue may allow an attacker to escalate their privileges. A...

FortiWAN - OS command injection leads to privilege escalation

An OS command injection CWE-78 vulnerability in FortiWAN Command Line Interface may allow a local, authenticated and unprivileged attacker to escalate their privileges to root via executing a specially-crafted command...

CVE-2021-33217: Out-of-bounds Write

An issue was discovered in CommScope Ruckus IoT Controller 1.7.1.0 and earlier. The Web Application allows Arbitrary Read/Write actions by authenticated users. The API allows an HTTP POST of arbitrary content into any file on the filesystem as root...

polkit: local privilege escalation using polkit_system_bus_name_get_creds_sync()

It was found that polkit could be tricked into bypassing the credential checks for D-Bus requests, elevating the privileges of the requestor to the root user. This flaw could be used by an unprivileged local attacker to, for example, create a new local administrator. The highest threat from this...

The vulnerability of SUSE Linux Enterprise Server and openSUSE Leap lies in the improper assignment of permissions to files, allowing an attacker to execute the arpwatch daemon and elevate their privileges to root level.

The vulnerability of SUSE Linux Enterprise Server and openSUSE Leap lies in the improper assignment of permissions to files. Exploiting this vulnerability allows an attacker to enable the arpwatch daemon and elevate their privileges to the root level...

Visual Tools DVR VX16 4.2.28 Privilege Escalation

Exploit Title: Visual Tools DVR VX16 4.2.28 - Local Privilege Escalation Date: 2021-07-05 Exploit Author: Andrea D'Ubaldo Vendor Homepage: https://visual-tools.com/ Version: Visual Tools VX16 v4.2.28.0 Tested on: VX16 Embedded Linux 2.6.35.4. An attacker can perform a system-level root local...

Visual Tools DVR VX16 4.2.28 - Local Privilege Escalation

Exploit Title: Visual Tools DVR VX16 4.2.28 - Local Privilege Escalation Date: 2021-07-05 Exploit Author: Andrea D'Ubaldo Vendor Homepage: https://visual-tools.com/ Version: Visual Tools VX16 v4.2.28.0 Tested on: VX16 Embedded Linux 2.6.35.4. An attacker can perform a system-level root local...

CVE-2021-22369

There is a Time-of-check Time-of-use TOCTOU Race Condition Vulnerability in Huawei Smartphone. Successful exploitation of these vulnerabilities may escalate the permission to that of the root user...