14261 matches found
cups: Cupsd Listen arbitrary chmod 0140777
A flaw was found in the cupsd server. When starting the cupsd server with a Listen configuration item pointing to a symbolic link, the cupsd process can perform an arbitrary chmod of the provided argument, providing world-writable access to the target. Since cupsd is often running as root, this...
The vulnerability of the SINEMA Remote Connect VPN service, related to the lack of data cleansing at the management level, allows a perpetrator to execute arbitrary codes.
The vulnerability of the SINEMA Remote Connect VPN service lies in the lack of data cleansing measures at the management level. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands with root privileges...
The vulnerability of the PowerScale OneFS operating system, related to incorrect privilege assignment, allows attackers to elevate their privileges.
The vulnerability of the PowerScale OneFS operating system is related to the improper assignment of privileges. Exploiting this vulnerability can allow an attacker to elevate their privileges to the root level...
CVE-2024-37066
Summary: CVE-2024-37066 affects Wyze V4 Pro firmware prior to 4.50.4.9222. The flaw enables an attacker to inject and execute arbitrary commands as root over Bluetooth during the camera setup process. Affected component: Wyze V4 Pro firmware (pre-4.50.4.9222). Root cause/impact: command injection...
CVE-2024-37066
A command injection vulnerability exists in Wyze V4 Pro firmware versions before 4.50.4.9222, which allows attackers to execute arbitrary commands over Bluetooth as root during the camera setup process...
CVE-2024-37066
A command injection vulnerability exists in Wyze V4 Pro firmware versions before 4.50.4.9222, which allows attackers to execute arbitrary commands over Bluetooth as root during the camera setup process...
PT-2024-27282 · Wyze · Wyze V4 Pro
Name of the Vulnerable Software and Affected Versions: Wyze V4 Pro firmware versions prior to 4.50.4.9222 Description: A command injection issue exists, allowing attackers to execute arbitrary commands over Bluetooth as root during the camera setup process. Recommendations: For Wyze V4 Pro firmwa...
CVE-2024-41111
CVE-2024-41111 affects Sliver 1.6.0 prerelease. The issue is remote code execution on the Sliver teamserver via a low‑privileged operator, executing as root. Exploitation relies on a command-injection in the generate msf-stager flow to inject flags into msfvenom and overwrite Sliver’s own Go bina...
CVE-2024-40629 Arbitrary File Write in Ansible Playbooks leads to RCE in Jumpserver
JumpServer is an open-source Privileged Access Management PAM tool that provides DevOps and IT teams with on-demand and secure access to SSH, RDP, Kubernetes, Database and RemoteApp endpoints through a web browser. An attacker can exploit the Ansible playbook to write arbitrary files, leading to...
CVE-2024-40629 Arbitrary File Write in Ansible Playbooks leads to RCE in Jumpserver
JumpServer is an open-source Privileged Access Management PAM tool that provides DevOps and IT teams with on-demand and secure access to SSH, RDP, Kubernetes, Database and RemoteApp endpoints through a web browser. An attacker can exploit the Ansible playbook to write arbitrary files, leading to...
PT-2024-5028 · Unknown +2 · Jumpserver +2
Name of the Vulnerable Software and Affected Versions: JumpServer versions prior to 3.10.12 JumpServer versions prior to 4.0.0 Description: The issue is related to the JumpServer Privileged Access Management PAM tool, which provides secure access to various endpoints through a web browser. An...
PT-2024-5027 · Unknown · Jumpserver
Name of the Vulnerable Software and Affected Versions: JumpServer versions prior to 3.10.12 JumpServer versions prior to 4.0.0 Description: JumpServer is an open-source Privileged Access Management PAM tool that provides DevOps and IT teams with on-demand and secure access to SSH, RDP, Kubernetes...
CVE-2024-20296
A vulnerability in the web-based management interface of Cisco Identity Services Engine ISE could allow an authenticated, remote attacker to upload arbitrary files to an affected device. To exploit this vulnerability, an attacker would need at least valid Policy Admin credentials on the affected...
PT-2024-5457 · Cisco · Cisco Rv345 +1
Name of the Vulnerable Software and Affected Versions: Cisco RV340 and RV345 Dual WAN Gigabit VPN Routers affected versions not specified Description: A vulnerability in the upload module could allow an authenticated, remote attacker to execute arbitrary code on an affected device. This issue is...
PT-2024-5455 · Cisco · Cisco Secure Web Appliance +1
Name of the Vulnerable Software and Affected Versions: Cisco Secure Web Appliance versions affected versions not specified Description: The issue is related to insufficient validation of user-supplied input for the Command Line Interface CLI of Cisco AsyncOS for Secure Web Appliance. This could...
Unspecified Vulnerability in Magic R230 of Xinhua San Technologies Ltd.
Magic R230 is a wireless router from China's Xinhua San H3C. A security vulnerability exists in the Magic R230 V100R002 of Xinhua San Technologies Co. The vulnerability stems from a hard-coded password vulnerability in /etc/shadow, which can be exploited by an attacker to log in as root...
cups: Cupsd Listen arbitrary chmod 0140777
A flaw was found in the cupsd server. When starting the cupsd server with a Listen configuration item pointing to a symbolic link, the cupsd process can perform an arbitrary chmod of the provided argument, providing world-writable access to the target. Since cupsd is often running as root, this...
CVE-2024-35338
Tenda i29V1.0 V1.0.0.5 was discovered to contain a hardcoded password for root...
PT-2024-8105 · Unknown · Data Center Expert
Name of the Vulnerable Software and Affected Versions: Data Center Expert affected versions not specified Description: The issue is related to an improper verification of cryptographic signature, which could compromise the Data Center Expert software. This vulnerability allows an attacker to...
