CVE-2022-29842

Improper Neutralization of Special Elements used in a Command 'Command Injection' vulnerability that could allow an attacker to execute code in the context of the root user on a vulnerable CGI file was discovered in Western Digital My Cloud OS 5 devicesThis issue affects My Cloud OS 5: before...

CVE-2022-1681

Authentication Bypass Using an Alternate Path or Channel in GitHub repository requarks/wiki prior to 2.5.281. User can get root user permissions...

CVE-2020-10882

This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1750 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the tdpServer service, which listens on...

CVE-2024-10082

CodeChecker is an analyzer tooling, defect database and viewer extension for the Clang Static Analyzer and Clang Tidy. Authentication method confusion allows logging in as the built-in root user from an external service. The built-in root user up until 6.24.1 is generated in a weak manner, cannot...

CVE-2024-55954

OpenObserve is a cloud-native observability platform. A vulnerability in the user management endpoint /api/orgid/users/emailid allows an "Admin" role user to remove a "Root" user from the organization. This violates the intended privilege hierarchy, enabling a non-root user to remove the...

ROS-20250121-05

A vulnerability in the modsql component of the ProFTPD FTP server is related to privilege management errors. Exploitation of the vulnerability could allow an attacker acting remotely to elevate his privileges to the root user...

CVE-2024-55954 OpenObserve Improper Authorization Allows Admin User to Remove Root User

OpenObserve is a cloud-native observability platform. A vulnerability in the user management endpoint /api/orgid/users/emailid allows an "Admin" role user to remove a "Root" user from the organization. This violates the intended privilege hierarchy, enabling a non-root user to remove the...

CVE-2024-55954 OpenObserve Improper Authorization Allows Admin User to Remove Root User

OpenObserve is a cloud-native observability platform. A vulnerability in the user management endpoint /api/orgid/users/emailid allows an "Admin" role user to remove a "Root" user from the organization. This violates the intended privilege hierarchy, enabling a non-root user to remove the...

CVE-2024-55954

OpenObserve CVE-2024-55954 affects the DELETE /api/{org_id}/users/{email_id} endpoint, where insufficient role checks in remove_user_from_org allow an Admin to remove a Root user. The root cause is improper authorization within the user management endpoint, enabling a non-root to delete a highest...

CVE-2024-55954 OpenObserve Improper Authorization Allows Admin User to Remove Root User

OpenObserve is a cloud-native observability platform. A vulnerability in the user management endpoint /api/orgid/users/emailid allows an "Admin" role user to remove a "Root" user from the organization. This violates the intended privilege hierarchy, enabling a non-root user to remove the...

CVE-2024-55954: Improper Privilege Management

OpenObserve is a cloud-native observability platform. A vulnerability in the user management endpoint /api/orgid/users/emailid allows an "Admin" role user to remove a "Root" user from the organization. This violates the intended privilege hierarchy, enabling a non-root user to remove the...

ROS-20250110-13

MinIO object storage server vulnerability is related to insecure privilege management. Exploitation exploitation of the vulnerability could allow an attacker acting remotely to elevate their privileges to root...

CVE-2024-43648 Authenticated command injection via <redacted>.exe <redacted> parameter

Command injection in the parameter of a .exe request leads to remote code execution as the root user. This issue affects Iocharger firmware for AC models before version 24120701. Likelihood: Moderate – This action is not a common place for command injection vulnerabilities to occur. Thus, an...

CVE-2024-43648

CVE-2024-43648 affects Iocharger firmware for AC models before version 24120701. The issue is a command injection in the parameter of a .exe request, which results in remote code execution as the root user. This grants full control over the charging station, enabling arbitrary file/service addit...

CVE-2024-43649: Improper Neutralization of Special Elements used in an OS Command

Authenticated command injection in the filename of a .exe request leads to remote code execution as the root user. This issue affects Iocharger firmware for AC models before version 24120701. Likelihood: Moderate – This action is not a common place for command injection vulnerabilities to occur...

PT-2025-2650

Name of the Vulnerable Software and Affected Versions Iocharger firmware for AC models versions prior to 24120701 Description The issue is related to authenticated command injection in the filename of a certain .exe request, leading to remote code execution as the root user. This allows an attack...

CVE-2024-43648: Improper Neutralization of Special Elements used in an OS Command

Command injection in the parameter of a .exe request leads to remote code execution as the root user. This issue affects Iocharger firmware for AC models before version 24120701. Likelihood: Moderate – This action is not a common place for command injection vulnerabilities to occur. Thus, an...

ABB AC500 安全漏洞

ABB AC500 is a programmable logic controller PLC from ABB Switzerland. A security vulnerability exists in ABB AC500 V3 prior to version 3.8.0, which stems from a directory traversal vulnerability that could allow an authenticated attacker to inject arbitrary commands into a specially crafted file...

CBL Mariner 2.0 Security Update: kernel (CVE-2024-49924)

The version of kernel installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-49924 advisory. - In the Linux kernel, the following vulnerability has been resolved: fbdev: pxafb: Fix possible use after fre...

kernel: selinux,smack: don't bypass permissions check in inode_setsecctx hook

A flaw was found in the Linux kernel. A highly privileged user on a Network File System NFS client can bypass intended security restrictions and modify security labels on files located on an NFS filesystem. This issue occurs even when root squashing, a security feature designed to limit root user...