CVE-2024-42028

A Local privilege escalation vulnerability found in a Self-Hosted UniFi Network Server with UniFi Network Application Version 8.4.62 and earlier allows a malicious actor with a local operational system user to execute high privilege actions on UniFi Network Server...

CVE-2024-42028

A Local privilege escalation vulnerability found in a Self-Hosted UniFi Network Server with UniFi Network Application Version 8.4.62 and earlier allows a malicious actor with a local operational system user to execute high privilege actions on UniFi Network Server...

CVE-2024-42028

A Local privilege escalation vulnerability found in a Self-Hosted UniFi Network Server with UniFi Network Application Version 8.4.62 and earlier allows a malicious actor with a local operational system user to execute high privilege actions on UniFi Network Server...

CVE-2022-23862

A Local Privilege Escalation issue was discovered in Y Soft SAFEQ 6 Build 53. The SafeQ JMX service running on port 9696 is vulnerable to JMX MLet attacks. Because the service did not enforce authentication and was running under the "NT Authority\System" user, an attacker is able to use the...

CVE-2022-23862

A Local Privilege Escalation issue was discovered in Y Soft SAFEQ 6 Build 53. The SafeQ JMX service running on port 9696 is vulnerable to JMX MLet attacks. Because the service did not enforce authentication and was running under the "NT Authority\System" user, an attacker is able to use the...

CVE-2022-23862

A Local Privilege Escalation issue was discovered in Y Soft SAFEQ 6 Build 53. The SafeQ JMX service running on port 9696 is vulnerable to JMX MLet attacks. Because the service did not enforce authentication and was running under the "NT Authority\System" user, an attacker is able to use the...

CVE-2022-23862

CVE-2022-23862 affects Y Soft SAFEQ 6 Build 53. The SafeQ JMX service on port 9696 is vulnerable to JMX MLet attacks because authentication was not enforced and the service ran under NT AUTHORITY\System, enabling an attacker to execute arbitrary code and escalate to SYSTEM locally. Public PoC and...

system-user-zabbix-6.0.33-1.1 on GA media (moderate)

system-user-zabbix-6.0.33-1.1 on GA media Announcement ID: openSUSE-SU-2024:14356-1 Rating: moderate Cross-References: CVE-2024-36461 CVSS scores: CVE-2024-36461 SUSE : 9.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:H Affected Products: openSUSE Tumbleweed An update that solves one vulnerability...

OPENSUSE-SU-2024:14356-1 system-user-zabbix-6.0.33-1.1 on GA media

These are all security issues fixed in the system-user-zabbix-6.0.33-1.1 package on the GA media of openSUSE Tumbleweed...

Untrusted Query Object Evaluation in RPC API

During the sign in and sign up operations through the SurrealDB RPC API, an arbitrary object would be accepted in order to support a wide array of types and structures that could contain user credentials. This arbitrary object could potentially contain any SurrealDB value, including an object...

PT-2026-60942

Name of the Vulnerable Software and Affected Versions SurrealDB versions prior to 1.5.5 SurrealDB versions 2.0.0-beta through 2.0.0-beta.2 Description The RPC API accepts arbitrary objects in the signin and signup operations without recursively validating them for non-computed values. When a reco...

ContiNew Admin SQL注入漏洞

ContiNew Admin is ContiNew open source a continuous iterative optimization of the front-end and back-end separation of the middle and back-end management system framework. ContiNew Admin version 3.2.0 SQL injection vulnerability exists , the vulnerability stems from the file...

PT-2024-38837 · Unknown · Continew Admin

Name of the Vulnerable Software and Affected Versions: ContiNew Admin version 3.2.0 Description: A critical issue was found in ContiNew Admin, affecting the function top.continew.starter.extension.crud.controller.BaseControllerpage of the file /api/system/user?deptId=1&page=1&size=10. The...

Apache StreamPark: Unchecked maven build params could trigger remote command execution

In streampark, the project module integrates Maven's compilation capabilities. The input parameter validation is not strict, allowing attackers to insert commands for remote command execution, The prerequisite for a successful attack is that the user needs to log in to the streampark system and...

openSUSE Security Advisory (SUSE-SU-2024:2260-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2023-3288

A BOLA vulnerability in POST /providers allows a low privileged user to create a privileged user provider in the system. This results in privilege escalation...

CVE-2024-20891

Improper access control in launchFullscreenIntent of SystemUI prior to SMR Jul-2024 Release 1 allows local attackers to launch privileged activities...

PT-2024-18804 · Systemui · Systemui

Name of the Vulnerable Software and Affected Versions: SystemUI versions prior to SMR Jul-2024 Release 1 Description: The issue is related to improper access control in the launchFullscreenIntent of SystemUI, allowing local attackers to launch privileged activities. Recommendations: For versions...

CVE-2023-7270 Local Privilege Escalation via MSI installer

An issue was discovered in SoftMaker Office 2024 / NX before revision 1214 and SoftMaker FreeOffice 2014 before revision 1215. FreeOffice 2021 is also affected, but won't be fixed. The SoftMaker Office and FreeOffice MSI installer files were found to produce a visible conhost.exe window running a...

CVE-2023-7270 Local Privilege Escalation via MSI installer

An issue was discovered in SoftMaker Office 2024 / NX before revision 1214 and SoftMaker FreeOffice 2014 before revision 1215. FreeOffice 2021 is also affected, but won't be fixed. The SoftMaker Office and FreeOffice MSI installer files were found to produce a visible conhost.exe window running a...