1263 matches found
CVE-2025-1121: Improper Privilege Management
Privilege escalation in Installer and Recovery image handling in Google ChromeOS version 15786.48.2 on device allows an attacker with physical access to gain root code execution and potentially unenroll enterprise-managed devices via a specially crafted recovery image...
CVE-2025-1121
Privilege escalation in Installer and Recovery image handling in Google ChromeOS version 15786.48.2 on device allows an attacker with physical access to gain root code execution and potentially unenroll enterprise-managed devices via a specially crafted recovery image...
CVE-2025-1121
Google ChromeOS version 15786.48.2 is vulnerable to a privilege escalation flaw in the Installer and Recovery image handling . An attacker with physical access to the device can exploit this by providing a specially crafted recovery image to gain root code execution . This vulnerability may also ...
PT-2025-10016 · Google · Chrome Os
Name of the Vulnerable Software and Affected Versions: Google ChromeOS version 123.0.6312.112 Description: The issue allows an attacker with physical access to gain root code execution and potentially unenroll enterprise-managed devices via a specially crafted recovery image. This is a result of...
CVE-2022-3093
This vulnerability allows physical attackers to execute arbitrary code on affected Tesla vehicles. Authentication is not required to exploit this vulnerability. The specific flaw exists within the iceupdater update mechanism. The issue results from the lack of proper validation of user-supplied...
Parallels Desktop Postback Link Vulnerability
Parallels Desktop is a suite of virtual machine software for the macOS platform from US-based Parallels, Inc. Parallels Desktop suffers from a backlink vulnerability that stems from an issue in the Technical Data Reporter component, whereby the service can be abused to change the permissions of...
CVE-2024-23970: Improper Certificate Validation
This vulnerability allows network-adjacent attackers to compromise transport security on affected installations of ChargePoint Home Flex charging stations. Authentication is not required to exploit this vulnerability. The specific flaw exists within the CURLOPTSSLVERIFYHOST setting. The issue...
CVE-2024-23929: Incorrect Authorization
This vulnerability allows network-adjacent attackers to create arbitrary files on affected installations of Pioneer DMH-WT7600NEX devices. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the...
CVE-2024-23970 ChargePoint Home Flex Improper Certificate Validation
This vulnerability allows network-adjacent attackers to compromise transport security on affected installations of ChargePoint Home Flex charging stations. Authentication is not required to exploit this vulnerability. The specific flaw exists within the CURLOPTSSLVERIFYHOST setting. The issue...
CVE-2025-21606
stats is a macOS system monitor in for the menu bar. The Stats application is vulnerable to a local privilege escalation due to the insecure implementation of its XPC service. The application registers a Mach service under the name "eu.exelban.Stats.SMC.Helper". The associated binary,...
CVE-2024-11946
iXsystems TrueNAS CORE fetchpluginpackagesites tar Cleartext Transmission of Sensitive Information Vulnerability. This vulnerability allows network-adjacent attackers to tamper with firmware update files on affected installations of iXsystems TrueNAS devices. Authentication is not required to...
PT-2025-25573 · Google · Chrome Os
Name of the Vulnerable Software and Affected Versions: Google ChromeOS versions 16063.45.2 and potentially others Description: The issue allows a local attacker to gain root code execution via exploiting a debug shell accessible through specific key combinations during developer mode entry and...
monitoring adaptive configuration instance_create Code Execution
The vulnerability of the instancecreate function in the monitoring and adaptive configuration of system devices related to tuned systems lies in the lack of measures taken to clean data at the management level. Exploiting this vulnerability allows an attacker to execute arbitrary code with root...
plctool Binary Execution Privilege Escalation
The vulnerability of the binary file of the microprogramming software for modular controllers of variable current charging stations and wall-mounted charging devices, the Phoenix Contact CHARX SEC-3100, exists due to insufficient verification of input data. Exploiting this vulnerability could all...
Visteon Infotainment SQL injection vulnerability
Visteon Infotainment is an automotive infotainment system from Visteon Corporation. Visteon Infotainment suffers from a SQL injection vulnerability that stems from improper validation of user-supplied strings when DeviceManager parses iAP serial numbers, which could lead to an attacker executing...
needrestart Code Execution Root
The vulnerability of the needrestart utility is related to an uncontrolled element in the search process. Exploiting this vulnerability allows a malicious actor to execute arbitrary code in the context of the root user by manipulating the PYTHONPATH variable during Python initialization...
needrestart Code Execution Root
The vulnerability of the needrestart utility is related to an uncontrolled element in the search process. Exploiting this vulnerability allows a malicious actor to execute arbitrary code in the context of the root user, when processing the RUBYLIB variable...
DEBIAN-CVE-2024-48992
Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by tricking needrestart into running the Ruby interpreter with an attacker-controlled RUBYLIB environment variable...
