CVE-2024-42025

A Command Injection vulnerability found in a Self-Hosted UniFi Network Servers Linux with UniFi Network Application Version 8.3.32 and earlier allows a malicious actor with unifi user shell access to escalate privileges to root on the host device...

Ubiquiti UniFi Network 安全漏洞

Ubiquiti UniFi Network is a wireless network management software solution from Ubiquiti, Inc. It is used to set up and manage UniFi Network devices. A security vulnerability exists in Ubiquiti UniFi Network version 8.3.32 and prior versions, which stems from the presence of a command injection...

PT-2024-29692 · Ubiquiti · Unifi Network Application

Name of the Vulnerable Software and Affected Versions: UniFi Network Application versions 8.3.32 and earlier Description: A Command Injection issue allows a malicious actor with unifi user shell access to escalate privileges to root on the host device. This issue affects Self-Hosted UniFi Network...

The vulnerability of the PowerScale OneFS operating system, related to incorrect privilege assignment, allows a perpetrator to elevate their privileges to the root level.

The vulnerability of the PowerScale OneFS operating system is related to the improper assignment of privileges. Exploiting this vulnerability can allow an attacker to elevate their privileges to the root level...

Veeam Agent for Linux 安全漏洞

Veeam Agent for Linux is a data protection and disaster recovery solution for physical and virtual machines from Veeam USA. A security vulnerability exists in Veeam Agent for Linux version 6.2 and prior versions, which stems from a lack of authorization validation that allows a local,...

CVE-2024-41160

in OpenHarmony v4.1.0 and prior versions allow a local attacker cause the common permission is upgraded to root and sensitive information leak through use after free...

PT-2024-29299 · Unknown · Openharmony

Name of the Vulnerable Software and Affected Versions: OpenHarmony versions prior to 4.1.0 Description: The issue allows a local attacker to upgrade common permissions to root and leak sensitive information through a use-after-free vulnerability. This could potentially lead to system compromise...

DEBIAN-CVE-2024-5290

An issue was discovered in Ubuntu wpasupplicant that resulted in loading of arbitrary shared objects, which allows a local unprivileged attacker to escalate privileges to the user that wpasupplicant runs as usually root. Membership in the netdev group or access to the dbus interface of...

SUSE CVE-2023-6917

A vulnerability has been identified in the Performance Co-Pilot PCP package, stemming from the mixed privilege levels utilized by systemd services associated with PCP. While certain services operate within the confines of limited PCP user/group privileges, others are granted full root privileges...

Privilege Escalation

github.com/dnscrypt/dnscrypt-proxy is vulnerable to Privilege escalation. The vulnerability is caused by insecure file permissions on the dnscrypt-proxy executable, which allows non-privileged users to overwrite it with malicious code, leading to potential privilege escalation to root when the...

PT-2024-13349 · Teledyne Flir · Teledyne Flir M300

Name of the Vulnerable Software and Affected Versions: Teledyne FLIR M300 versions 2.00 through 2.00-19 Description: An issue was discovered in the web server of the affected software, allowing unauthenticated remote code execution. This can be exploited by sending a POST request to the vulnerabl...

The vulnerability in the web interface of the Cisco Integrated Management Controller (IMC), a device for remote administration of servers, allows a perpetrator to elevate their privileges to the root level.

The vulnerability in the web interface of the Cisco Integrated Management Controller IMC exists because measures to neutralize special elements used in the operating system commands have not been taken. Exploiting this vulnerability can allow a malicious actor to elevate their privileges to the...

PT-2024-21805

Name of the Vulnerable Software and Affected Versions Support App versions prior to 2.5.1 Rev 2 Description The issue is related to the postinstall installer script, which can be abused to execute arbitrary code as root due to the use of the shebang !/bin/zsh. When the installer is executed, it...

openSUSE Security Advisory (SUSE-SU-2024:0473-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

openSUSE: Security Advisory for firejail (openSUSE-SU-2022:10016-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Important: sudo

Issue Overview: In sudo-1.8.23-10.amzn2.3.6 Amazon Linux 2 and sudo-1.8.23-10.58.amzn1 Amazon Linux 1, a user with an entry in the sudoers file, enabling them to run commands as another unprivileged user, can leverage it to run commands as root. No prior versions are affected. This issue has been...

SUSE-SU-2024:0473-1 Security update for tomcat10

This update for tomcat10 fixes the following issues: - CVE-2024-22029: Fixed escalation to root from tomcat user via %post script. bsc1219208...

SUSE-SU-2024:0472-1 Security update for tomcat

This update for tomcat fixes the following issues: Updated to Tomcat 9.0.85: - CVE-2023-45648: Improve trailer header parsing bsc1216118. - CVE-2023-42794: FileUpload: remove tmp files to avoid DoS on Windows bsc1216120. - CVE-2023-42795: Improve handling of failures during recycle methods...

Cisco ThousandEyes Enterprise Agent Security Vulnerability

Cisco ThousandEyes Enterprise Agent is an application from Cisco, Inc. It provides extended visibility, automated insights, and seamless workflow. A security vulnerability exists in Cisco ThousandEyes Enterprise Agent that stems from a flaw in the web-based management interface that could allow a...

The vulnerability of the microprogrammed software of Zyxel GS1900 series switches, related to insecure privilege management, allows attackers to execute arbitrary commands and elevate their privileges to the root level.

The vulnerability of the microprogrammed software of Zyxel GS1900 series switches is related to insecure management of privileges. Exploiting this vulnerability allows an attacker to execute arbitrary commands and elevate their privileges to the root level via SSH...