EUVD-2023-45854

Malicious code in bioql PyPI...

EUVD-2023-28503

Malicious code in bioql PyPI...

CVE-2025-59016 Information Disclosure via File Abstraction Layer

Error messages containing sensitive information in the File Abstraction Layer in TYPO3 CMS versions 9.0.0-9.5.54, 10.0.0-10.4.53, 11.0.0-11.5.47, 12.0.0-12.4.36, and 13.0.0-13.4.17 allow backend users to disclose full file paths via failed low-level file-system operations...

firefox: thunderbird: Privilege escalation in Firefox Updater

A flaw was found in Firefox. The Mozilla Foundation's Security Advisory describes the following issue: Mozilla Firefox's update mechanism allowed a medium-integrity user process to interfere with the SYSTEM-level updater by manipulating the file-locking behavior. By injecting code into the...

CVE-2021-26280

Locally installed application can bypass the permission check and perform system operations that require permission...

Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability

...

CVE-2021-26280

Locally installed application can bypass the permission check and perform system operations that require permission...

CVE-2021-26280

CVE-2021-26280 (Vivo Permission manager module) is a locally exploitable vulnerability where a locally installed app can bypass permission checks and perform system operations that require permissions. The entry is supported by multiple sources (NVD, Red Hat, CVE listing) indicating a local attac...

CVE-2021-26280 Permission bypass vulnerability in permission manager module

Locally installed application can bypass the permission check and perform system operations that require permission...

CVE-2021-26280 Permission bypass vulnerability in permission manager module

Locally installed application can bypass the permission check and perform system operations that require permission...

vivo Permission manager module 安全漏洞

The vivo Permission manager module is a cell phone permission management module from the Chinese company Vivo. A security vulnerability exists in vivo Permission manager module, which originates from a locally installed application that can bypass permission checking and perform system operations...

CVE-2024-3980

Hitachi Energy CVE-2024-3980 affects MicroSCADA Pro/X SYS600 (and related MACH GWS components per ICS/CISA notes). The vulnerability arises from inadequate input validation that lets an authenticated user influence file paths/file names used in filesystem operations, enabling access or modificati...

Education in Secure Software Development

The Linux Foundation and OpenSSF released a report on the state of education in secure software development. …many developers lack the essential knowledge and skills to effectively implement secure software development. Survey findings outlined in the report show nearly one-third of all...

GHSA-23RX-C3G5-HV9W Deno permission escalation vulnerability via open of privileged files with missing `--deny` flag

The Deno sandbox may be unexpectedly weakened by allowing file read/write access to privileged files in various locations on Unix and Windows platforms. For example, reading /proc/self/environ may provide access equivalent to --allow-env, and writing /proc/self/mem may provide access equivalent t...

Deno permission escalation vulnerability via open of privileged files with missing `--deny` flag

The Deno sandbox may be unexpectedly weakened by allowing file read/write access to privileged files in various locations on Unix and Windows platforms. For example, reading /proc/self/environ may provide access equivalent to --allow-env, and writing /proc/self/mem may provide access equivalent t...

CVE-2023-48388

Multisuns EasyLog web+ has a vulnerability of using hard-coded credentials. An remote attacker can exploit this vulnerability to access the system to perform arbitrary system operations or disrupt service...

CVE-2023-48390

Multisuns EasyLog web+ has a code injection vulnerability. An unauthenticated remote attacker can exploit this vulnerability to inject code and access the system to perform arbitrary system operations or disrupt service...

Code injection

Multisuns EasyLog web+ has a code injection vulnerability. An unauthenticated remote attacker can exploit this vulnerability to inject code and access the system to perform arbitrary system operations or disrupt service...

Hardcoded credentials

Multisuns EasyLog web+ has a vulnerability of using hard-coded credentials. An remote attacker can exploit this vulnerability to access the system to perform arbitrary system operations or disrupt service...

CVE-2023-48390 Multisuns EasyLog web+ - Command Injection

Multisuns EasyLog web+ has a code injection vulnerability. An unauthenticated remote attacker can exploit this vulnerability to inject code and access the system to perform arbitrary system operations or disrupt service...