CVE-2018-11541: Missing Authorization

A root privilege escalation vulnerability in the Sonus SBC 1000 / SBC 2000 / SBC SWe Lite web interface allows unauthorised access to privileged content via an unspecified vector. It affects the 1000 and 2000 devices 6.0.x up to Build 446, 6.1.x up to Build 492, and 7.0.x up to Build 485. It...

PNP4Nagios: Root privilege escalation

Background PNP4Nagios is an addon for the Nagios Network Monitoring System. Description It was found that PHP4Nagios creates files owned by an unprivileged user that are used by root. Impact A local attacker could escalate privileges to root. Workaround There is no known workaround at this time...

Security Bulletin:  IBM Security Guardium is affected by Open Source Oracle MySQL Vulnerabilities (CVE-2016-6662)

Summary MySQL Server could allow a remote authenticated attacker to gain elevated privileges on the system, caused by improper restrictions to logging functions. By executing a specially crafted series of SQL statements, an attacker could exploit this vulnerability to create or modify my.conf...

Security Bulletin: IBM InfoSphere Information Server is vulnerable to root privilege escalation (CVE-2015-1900)

Summary IBM InfoSphere Information Server could allow a local user to execute code with root privileges on the engine tier. Vulnerability Details CVEID: CVE-2015-1900 DESCRIPTION: IBM InfoSphere DataStage could allow a local user to bypass security and replace executables with malicious files tha...

Micro Focus openSUSE Command Execution Vulnerability

Micro Focus openSUSE is a Linux-based free operating system from Micro Focus in the UK. mdadm is one of the packages used to manage and monitor RAID. A security vulnerability in the mdcheck script of the mdadm package in Micro Focus openSUSE versions 3.3.1-5.14.1 prior to version 13.2 stems from...

CVE-2018-1235

Dell EMC RecoverPoint versions prior to 5.1.2 and RecoverPoint for VMs versions prior to 5.1.1.3, contain a command injection vulnerability. An unauthenticated remote attacker may potentially exploit this vulnerability to execute arbitrary commands on the affected system with root privilege...

Command injection

Dell EMC RecoverPoint versions prior to 5.1.2 and RecoverPoint for VMs versions prior to 5.1.1.3, contain a command injection vulnerability. An unauthenticated remote attacker may potentially exploit this vulnerability to execute arbitrary commands on the affected system with root privilege...

CVE-2018-1235

Dell EMC RecoverPoint versions prior to 5.1.2 and RecoverPoint for VMs versions prior to 5.1.1.3, contain a command injection vulnerability. An unauthenticated remote attacker may potentially exploit this vulnerability to execute arbitrary commands on the affected system with root privilege...

CVE-2018-1235

Dell EMC RecoverPoint versions prior to 5.1.2 and RecoverPoint for VMs versions prior to 5.1.1.3, contain a command injection vulnerability. An unauthenticated remote attacker may potentially exploit this vulnerability to execute arbitrary commands on the affected system with root privilege...

PT-2018-11137

Name of the Vulnerable Software and Affected Versions Dell EMC RecoverPoint versions prior to 5.1.2 Dell EMC RecoverPoint for VMs versions prior to 5.1.1.3 Description The issue allows an unauthenticated remote attacker to potentially execute arbitrary commands on the affected system with root...

CVE-2018-1235: Improper Neutralization of Special Elements used in an OS Command

Dell EMC RecoverPoint versions prior to 5.1.2 and RecoverPoint for VMs versions prior to 5.1.1.3, contain a command injection vulnerability. An unauthenticated remote attacker may potentially exploit this vulnerability to execute arbitrary commands on the affected system with root privilege...

dhcp: Command injection vulnerability in the DHCP client NetworkManager integration script

A command injection flaw was found in the NetworkManager integration script included in the DHCP client packages in Red Hat Enterprise Linux. A malicious DHCP server, or an attacker on the local network able to spoof DHCP responses, could use this flaw to execute arbitrary commands with root...

Moxa EDR-810 Command Injection Vulnerability (CNVD-2018-11721)

The EDR-810 is a highly integrated industrial multi-port security router with firewall/NAT/VPN and two-layer manageable switch functionality. A command injection vulnerability exists in the web server functionality of the Moxa EDR-810 V4.1 build 17030317. The vulnerability can be exploited to...

The vulnerability of the com.privat.vpn.helper component of the software for accessing VPN services, PrivateVPN, allows a hacker to execute arbitrary code with root privileges.

The vulnerability of the com.privat.vpnhelper component, which implements the XPC service for accessing the PrivateVPN service, is related to deficiencies in access control. Exploiting this vulnerability allows a malicious actor, operating remotely, to execute arbitrary code with root privileges...

GLSA-201805-01 : hesiod: Root privilege escalation

The remote host is affected by the vulnerability described in GLSA-201805-01 hesiod: Root privilege escalation Multiple vulnerabilities have been discovered in hesiod that have remained unaddressed. Please review the referenced CVE identifiers for details. Impact : A remote or local attacker may ...

CVE-2018-1000167

OISF suricata-update version 1.0.0a1 contains an Insecure Deserialization vulnerability in the insecure yaml.load-Function as used in the following files: config.py:136, config.py:142, sources.py:99 and sources.py:131. The "list-sources"-command is affected by this bug. that can result in Remote...

CVE-2018-10192

IPVanish 3.0.11 for macOS suffers from a root privilege escalation vulnerability. The com.ipvanish.osx.vpnhelper LaunchDaemon implements an insecure XPC service that could allow an attacker to execute arbitrary code as the root user. IPVanish uses a third-party library for converting xpcobjectt...

CVE-2018-10192

IPVanish 3.0.11 for macOS suffers from a root privilege escalation vulnerability. The com.ipvanish.osx.vpnhelper LaunchDaemon implements an insecure XPC service that could allow an attacker to execute arbitrary code as the root user. IPVanish uses a third-party library for converting xpcobjectt...

CVE-2018-10192

IPVanish 3.0.11 for macOS contains a root privilege escalation due to an insecure XPC service in the com.ipvanish.osx.vpnhelper LaunchDaemon. The component does not validate incoming connections, allowing any local application to send XPC messages. In the VPNHelperConnect path (used on establishi...

CVE-2017-0358 ntfs-3g: Modprobe influence vulnerability via environment variables

Jann Horn of Google Project Zero discovered that NTFS-3G, a read-write NTFS driver for FUSE, does not scrub the environment before executing modprobe with elevated privileges. A local user can take advantage of this flaw for local root privilege escalation...