CVE-2023-3932 Incorrect User Management in GitLab

An issue has been discovered in GitLab EE affecting all versions starting from 13.12 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. It was possible for an attacker to run pipeline jobs as an arbitrary user via scheduled security scan...

CVE-2023-3932 Incorrect User Management in GitLab

An issue has been discovered in GitLab EE affecting all versions starting from 13.12 before 16.0.8, all versions starting from 16.1 before 16.1.3, all versions starting from 16.2 before 16.2.2. It was possible for an attacker to run pipeline jobs as an arbitrary user via scheduled security scan...

openssl file names of certificates being hashed were possibly passed to a command executed through the shell

In addition to the crehash shell command injection identified in CVE-2022-1292, further circumstances where the crehash script does not properly sanitise shell metacharacters to prevent command injection were found by code review. When the CVE-2022-1292 was fixed it was not discovered that there...

Net-SNMP through 5.7.3 allows Escalation of Privileges because of UNIX symbolic link (symlink) following.

Net-SNMP through 5.7.3 allows Escalation of Privileges because of UNIX symbolic link symlink following. Products Confirmed Not Affected No Brocade Fibre Channel products are affected by this vulnerability Solution While Brocade Fabric OS is not vulnerable to this exploit, a security scan may repo...

Ubuntu 20.04 LTS : Linux kernel (HWE) vulnerabilities (USN-6040-1)

The remote Ubuntu 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-6040-1 advisory. It was discovered that the Traffic-Control Index TCINDEX implementation in the Linux kernel contained a use-after-free vulnerability. A local attacker...

Rails Web Console Detected

Rails has several gems, including a native one allowing access to a ruby console through the application. Badly configured, this console is accessible without authorization to any user, which allows to execute arbitrary code remotely. No source data...

The vulnerability of the McAfee Security Scan Plus (MSS+) antivirus software, related to deficiencies in access control, allows a perpetrator to execute a LotL attack (a type of Living off the Land attack).

The vulnerability of the McAfee Security Scan Plus MSS+ antivirus software is related to deficiencies in access control. Exploiting this vulnerability could allow a hacker to execute a LotL attack a type of Living off the Land attack...

CVE-2022-37025

An improper privilege management vulnerability in McAfee Security Scan Plus MSS+ before 4.1.262.1 could allow a local user to modify a configuration file and perform a LOLBin Living off the land attack. This could result in the user gaining elevated permissions and being able to execute arbitrary...

CVE-2022-37025

An improper privilege management vulnerability in McAfee Security Scan Plus MSS+ before 4.1.262.1 could allow a local user to modify a configuration file and perform a LOLBin Living off the land attack. This could result in the user gaining elevated permissions and being able to execute arbitrary...

CVE-2022-37025

An improper privilege management vulnerability in McAfee Security Scan Plus MSS+ before 4.1.262.1 could allow a local user to modify a configuration file and perform a LOLBin Living off the land attack. This could result in the user gaining elevated permissions and being able to execute arbitrary...

Privilege escalation

An improper privilege management vulnerability in McAfee Security Scan Plus MSS+ before 4.1.262.1 could allow a local user to modify a configuration file and perform a LOLBin Living off the land attack. This could result in the user gaining elevated permissions and being able to execute arbitrary...

CVE-2022-37025

An improper privilege management vulnerability in McAfee Security Scan Plus MSS+ before 4.1.262.1 could allow a local user to modify a configuration file and perform a LOLBin Living off the land attack. This could result in the user gaining elevated permissions and being able to execute arbitrary...

CVE-2022-37025

CVE-2022-37025 affects McAfee Security Scan Plus (MSS+) prior to 4.1.262.1. The vulnerability is described as improper privilege management that could let a local user modify a configuration file and perform a LOLBin (Living off the Land) attack, enabling elevated permissions and potential arbitr...

McAfee Security Scan Plus 安全漏洞

McAfee Security Scan Plus MSS+ is a tool from McAfee, Inc. that protects computers from spyware and viruses. A security vulnerability exists in versions of McAfee Security Scan Plus MSS+ prior to 4.1.262.1, which stems from a faulty privilege management that could allow a local user to modify...

PT-2022-4406 · Mcafee · Mcafee Security Scan Plus

Name of the Vulnerable Software and Affected Versions: McAfee Security Scan Plus versions prior to 4.1.262.1 Description: The issue is related to improper privilege management, which could allow a local user to modify a configuration file. This modification can lead to a Living off the Land LOLBi...

AD Starter Scan - Non-Expiring Account Password

Binary data adsiaccountpwd.nbin...

Brocade Fabric OS 资源管理错误漏洞

Brocade Fabric OS FOS is an embedded operating system used in switches and routers and other devices from Brocade, U.S.A. A security vulnerability exists in Brocade Fabric OS that could be exploited by an attacker to trigger a fatal error via a security scan of Brocade Fabric OS to trigger a Deni...

BSA-2021-1496

Security Advisory ID : BSA-2021-1496 Component : config and secnotify processes Revision : 1.0 Running security scans against the SAN switch can cause config and secnotify processes within the firmware before Brocade Fabric OS v9.0.0, v8.2.2d and v8.2.1e to consume all memory leading to denial of...

MustGather: Security Vulnerability issues for API Connect & DataPower Gateways

Problem This document describes the MustGather process for opening a security vulnerability case with IBM Support. How to report a security vulnerability with IBM Support: Before you report a security vulnerability issue with IBM Support, please take the following steps: 1. Test the vulnerability...

XXE in PHPSpreadsheet due to encoding issue

securityScan in PHPOffice PhpSpreadsheet through 1.5.0 allows a bypass of protection mechanisms for XXE via UTF-7 encoding in a .xlsx file...