CVE-2026-7246

CVE-2026-7246 affects Pallets Click up to version 8.3.2. The vulnerability is a command injection in the click.edit() function that allows an unprivileged attacker to pass arbitrary OS commands. This is a local attack with high impact on confidentiality, integrity, and availability as per the cit...

Click 命令注入漏洞

Click is a Python toolkit developed by Pallets for creating command-line interfaces. Versions of Click 8.3.2 and earlier have a command injection vulnerability. This vulnerability stems from the click.edit function, which allows for command injection, potentially enabling attackers to execute...

EUVD-2012-3316

Malware in sbrugna...

CVE-2020-25774

A vulnerability in the Trend Micro Apex One ServerMigrationTool component could allow an attacker to trigger an out-of-bounds red information disclosure which would disclose sensitive information to an unprivileged account. User interaction is required to exploit this vulnerability in that the...

CVE-2025-1542 Improper permission control in OXARI ServiceDesk

Improper permission control vulnerability in the OXARI ServiceDesk application could allow an attacker using a guest access or an unprivileged account to gain additional administrative permissions in the application.This issue affects OXARI ServiceDesk in versions before 2.0.324.0...

CVE-2022-32507

CVE-2022-32507 involves a vulnerability in certain Nuki Home Solutions devices where BLE commands that should require privileged access could be invoked by unprivileged accounts due to missing access controls across account types. Affected products: Nuki Smart Lock 3.0 prior to 3.3.5 and Nuki Sma...

PT-2024-11571 · Nuki · Nuki Smart Lock 2.0 +1

Name of the Vulnerable Software and Affected Versions: Nuki Smart Lock 3.0 versions 3.0 through 3.3.4 Nuki Smart Lock 2.0 versions 2.0 through 2.12.3 Description: An issue was discovered on certain Nuki Home Solutions devices, where some BLE commands could be called from unprivileged accounts,...

Threat Actors Exploit Multiple Vulnerabilities in Ivanti Connect Secure and Policy Secure Gateways

Actions to take today to mitigate cyber threats against Ivanti appliances: 1. Limit outbound internet connections from SSL VPN appliances to restrict access to required services. 2. Keep all operating systems and firmware up to date. 3. Limit SSL VPN connections to unprivileged accounts...

PT-2023-18954 · Sick · Sick Ftmg Air Flow Sensor

Name of the Vulnerable Software and Affected Versions: SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 Description: The issue is related to improper access control, allowing an unprivileged remote attacker to gain unauthorized access to dat...

SUSE CVE-2011-1946

gnomesu-pam-backend in libgnomesu 1.0.0 prints an error message but proceeds with the non-error code path upon failure of the setgid or setuid function, which allows local users to gain privileges by leveraging access to two unprivileged user accounts, and running many processes under one of thes...

pcs: improper authentication via PAM

A flaw was found in the Pacemaker configuration tool pcs. The pcs daemon allowed expired accounts and accounts with expired passwords to log in when using PAM authentication. Unprivileged, expired accounts with previously denied access could still log in...

Privilege Escalation

pcs is vulnerable to privilege escalation. The vulnerability exists due to unprivileged expired accounts being able to access the system with expired passwords to login when using PAM authentication...

Improper Authorization

Description Pacemakers daemon pcsd allows authentication via PAMs pamauthenticate. Unfortunately the authorization via pamacctmgmt has been omitted. Therefore unprivileged expired accounts that have been denied access can still login. Proof of Concept You can expire an account with chage -E0 Impa...

The vulnerability of the omp-appmanager module for mobile applications within the application software “Avora Center” is related to deficiencies in access control in the isolated environment. This vulnerability allows a malicious individual to perform installation or deletion of mobile applications.

The vulnerability of the omp-appmanager module for mobile applications, which is part of the “Avora Center” application software, relates to the provision of unprivileged accounts for the privileged API used for installing and removing applications. Exploiting this vulnerability could allow a...

CVE-2019-10127

A vulnerability was found in postgresql versions 11.x prior to 11.3. The Windows installer for BigSQL-supplied PostgreSQL does not lock down the ACL of the binary installation directory or the ACL of the data directory; it keeps the inherited ACL. In the default configuration, an attacker having...

Default configuration

A vulnerability was found in postgresql versions 11.x prior to 11.3. The Windows installer for BigSQL-supplied PostgreSQL does not lock down the ACL of the binary installation directory or the ACL of the data directory; it keeps the inherited ACL. In the default configuration, an attacker having...

eEye Retina audit script could execute untrusted programs as root

Overview eEye Retina audit scripts have the capability to run remote shell scripts in order to determine vulnerable applications. One audit script in particular audit ID 2499 uses find1 and execute -exec when assessing a vulnerability within Gauntlet Firewall. An attacker who can write an...