CWE:

	Tytuł	Data	Autor
Med.	Wondershare Dr Fone 12.9.6 Weak Permissions / Privilege Escalation	14.03.2023	Thurein Soe
High	CipherMail Community Virtual Appliance 4.6.2 Code Execution	10.06.2020	Core Security Technolo...
High	Opsview Monitor 5.x Command Execution	05.09.2018	Core Security Technolo...
High	Quest DR Series Disk Backup Software 4.0.3 Code Execution	01.06.2018	Core Security Technolo...
High	NetEx HyperIP 6.1.0 Post-Auth Command Execution	11.02.2018	Matt Bergin
High	TP-LINK TL-SC3171 Authentication Bypass	13.06.2013	Eliezer Varad Lopez, ...

---

Common Weakness Enumeration (CWE)

CVE

Szczegóły

Opis

2024-10-09

CVE-2024-7041

Updating...

An Insecure Direct Object Reference (IDOR) vulnerability exists in open-webui/open-webui version v0.3.8. The vulnerability occurs in the API endpoint `http://0.0.0.0:3000/api/v1/memories/{id}/update`, where the decentralization design is flawed, allowing attackers to edit other users' memories without proper authorization.

2024-10-08

CVE-2024-43583

Updating...

Winlogon Elevation of Privilege Vulnerability

2024-09-23

CVE-2024-8903

Updating...

Local active protection service settings manipulation due to unnecessary privileges assignment. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows, macOS) before build 38565.

2024-09-17

	CVE-2024-8767	Updating...	Sensitive data disclosure and manipulation due to unnecessary privileges assignment. The following products are affected: Acronis Backup plugin for cPanel & WHM (Linux) before build 619, Acronis Backup extension for Plesk (Linux) before build 555, Acronis Backup plugin for DirectAdmin (Linux) before build 147.
	CVE-2024-7387	Updating...	A flaw was found in openshift/builder. This vulnerability allows command injection via path traversal, where a malicious user can execute arbitrary commands on the OpenShift node running the builder container. When using the �??Docker�?� strategy, executable files inside the privileged build container can be overridden using the `spec.source.secrets.secret.destinationDir` attribute of the `BuildConfig` definition. An attacker running code in a privileged container could escalate their permissions on the node running the container.

2024-09-10

CVE-2024-35783

Updating...

A vulnerability has been identified in SIMATIC BATCH V9.1 (All versions), SIMATIC Information Server 2020 (All versions), SIMATIC Information Server 2022 (All versions), SIMATIC PCS 7 V9.1 (All versions), SIMATIC Process Historian 2020 (All versions), SIMATIC Process Historian 2022 (All versions), SIMATIC WinCC Runtime Professional V18 (All versions), SIMATIC WinCC Runtime Professional V19 (All versions), SIMATIC WinCC V7.4 (All versions), SIMATIC WinCC V7.5 (All versions < V7.5 SP2 Update 18), SIMATIC WinCC V8.0 (All versions < V8.0 Update 5). The affected products run their DB server with elevated privileges which could allow an authenticated attacker to execute arbitrary OS commands with administrative privileges.

2024-08-29

CVE-2024-5622

Updating...

An untrusted search path vulnerability in the AprolConfigureCCServices of B&R APROL <= R 4.2.-07P3 and <= R 4.4-00P3 may allow an authenticated local attacker to execute arbitrary code with elevated privileges.

2024-08-13

CVE-2024-36398

Updating...

A vulnerability has been identified in SINEC NMS (All versions < V3.0). The affected application executes a subset of its services as `NT AUTHORITY\SYSTEM`. This could allow a local attacker to execute operating system commands with elevated privileges.

2024-07-09

CVE-2024-35154

Updating...

IBM WebSphere Application Server 8.5 and 9.0 could allow a remote authenticated attacker, who has authorized access to the administrative console, to execute arbitrary code. Using specially crafted input, the attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 292641.

2024-07-02

CVE-2024-32853

Updating...

Dell PowerScale OneFS versions 8.2.2.x through 9.7.0.2 contain an execution with unnecessary privileges vulnerability. A local low privileged attacker could potentially exploit this vulnerability, leading to escalation of privileges.

 

---

Copyright 2024, cxsecurity.com