PT-2025-10856

Name of the Vulnerable Software and Affected Versions: Percona PMM Server OVA versions prior to 3.0.0-1.ova Description: An issue was discovered in Percona PMM Server OVA where the default service account credentials can lead to SSH access, use of Sudo to root, and sensitive data exposure...

CVE-2024-11467

Omnissa Horizon Client for macOS contains a Local privilege escalation LPE Vulnerability due to a logic flaw. Successful exploitation of this issue may allow attackers with user privileges to escalate their privileges to root on the system where the Horizon Client for macOS is installed...

CVE-2024-51240: Insufficiently Protected Credentials

An issue in the luci-mod-rpc package in OpenWRT Luci LTS allows for privilege escalation from an admin account to root via the JSON-RPC-API, which is exposed by the luci-mod-rpc package...

CVE-2024-22029 tomcat packaging allows for escalation to root from tomcat user

Insecure permissions in the packaging of tomcat allow local users that win a race during package installation to escalate to root...

CentOS 7 : kpatch-patch (RHSA-2021:2727)

The remote CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2021:2727 advisory. - In the Linux kernel before 5.12.4, net/bluetooth/hcievent.c has a use-after-free when destroying an hcichan, aka CID-5c4c8c954409. This leads to...

CVE-2024-43199: Incorrect Permission Assignment for Critical Resource

Nagios NDOUtils before 2.1.4 allows privilege escalation from nagios to root because certain executable files are owned by the nagios user...

CVE-2024-36821

Insecure permissions in Linksys Velop WiFi 5 WHW01v1 1.1.13.202617 allows attackers to escalate privileges from Guest to root...

Linksys Velop WiFi Security Breach

Linksys Velop WiFi is a router from Linksys USA. A security vulnerability exists in Linksys Velop WiFi version 5 WHW01v1 1.1.13.202617, which originated from a vulnerability that allows an attacker to elevate privileges from Guest to root via directory traversal...

CVE-2024-36821: Incorrect Permission Assignment for Critical Resource

Insecure permissions in Linksys Velop WiFi 5 WHW01v1 1.1.13.202617 allows attackers to escalate privileges from Guest to root...

PT-2024-27170 · Linksys · Linksys Velop Wifi 5

Name of the Vulnerable Software and Affected Versions: Linksys Velop WiFi 5 WHW01v1 version 1.1.13.202617 Description: The issue is related to insecure permissions, allowing attackers to escalate privileges from Guest to root. Recommendations: For version 1.1.13.202617, at the moment, there is no...

CVE-2024-20360

A vulnerability in the web-based management interface of Cisco Firepower Management Center FMC Software could allow an authenticated, remote attacker to conduct SQL injection attacks on an affected system. This vulnerability exists because the web-based management interface does not adequately...

CVE-2023-6917

performancecopilot/pcp is vulnerable to Creation of Temporary File With Insecure Permissions. The vulnerability is due to the mixed privilege levels utilized by systemd services associated with the package. While certain services operate within the confines of limited user/group privileges, other...

SUSE CVE-2022-31253

A Untrusted Search Path vulnerability in openldap2 of openSUSE Factory allows local attackers with control of the ldap user or group to change ownership of arbitrary directory entries to this user/group, leading to escalation to root. This issue affects: openSUSE Factory openldap2 versions prior ...

CVE-2022-31254

A Incorrect Default Permissions vulnerability in rmt-server-regsharing service of SUSE Linux Enterprise Server for SAP 15, SUSE Linux Enterprise Server for SAP 15-SP1, SUSE Manager Server 4.1; openSUSE Leap 15.3, openSUSE Leap 15.4 allows local attackers with access to the rmt user to escalate to...

Design/Logic Flaw

A Incorrect Default Permissions vulnerability in rmt-server-regsharing service of SUSE Linux Enterprise Server for SAP 15, SUSE Linux Enterprise Server for SAP 15-SP1, SUSE Manager Server 4.1; openSUSE Leap 15.3, openSUSE Leap 15.4 allows local attackers with access to the rmt user to escalate to...

CVE-2022-31254 rmt-server-pubcloud allows to escalate from user _rmt to root

A Incorrect Default Permissions vulnerability in rmt-server-regsharing service of SUSE Linux Enterprise Server for SAP 15, SUSE Linux Enterprise Server for SAP 15-SP1, SUSE Manager Server 4.1; openSUSE Leap 15.3, openSUSE Leap 15.4 allows local attackers with access to the rmt user to escalate to...

CVE-2022-31253

A Untrusted Search Path vulnerability in openldap2 of openSUSE Factory allows local attackers with control of the ldap user or group to change ownership of arbitrary directory entries to this user/group, leading to escalation to root. This issue affects: openSUSE Factory openldap2 versions prior ...

CVE-2022-31251

A Incorrect Default Permissions vulnerability in the packaging of the slurm testsuite of openSUSE Factory allows local attackers with control over the slurm user to escalate to root. This issue affects: openSUSE Factory slurm versions prior to 22.05.2-3.3...

NewStart CGSL CORE 5.04 / MAIN 5.04 : kernel Multiple Vulnerabilities (NS-SA-2022-0009)

The remote NewStart CGSL host, running version CORE 5.04 / MAIN 5.04, has kernel packages installed that are affected by multiple vulnerabilities: - In drivers/target/targetcorexcopy.c in the Linux kernel before 5.10.7, insufficient identifier checking in the LIO SCSI target code can be used by...

Ubuntu 18.04 LTS : Cron vulnerabilities (USN-5259-2)

The remote Ubuntu 18.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5259-2 advisory. USN-5259-1 fixed several vulnerabilities in Cron. This update provides the corresponding update for Ubuntu 18.04 LTS. Tenable has extracted the preceding...