CVE Vulnerability Catalog

A double free bug in packet_set_ring() in net/packet/af_packet.c can be exploited by a local user through crafted syscalls to escalate privileges or deny service. We recommend upgrading kernel past the effected versions or rebuilding past ec6af094ea28f0f2dda1a6a33b14cd57e36a9755

A vulnerability in Oracle Access Manager (component: OpenSSO Agent) in versions 11.1.2.3.0, 12.2.1.3.0, and 12.2.1.4.0 allows an unauthenticated attacker with network access via HTTP to compromise Oracle Access Manager. CVSS 3.1 Base Score 9.8.

NUUO NVRmini2 through 3.11 allows an unauthenticated attacker to upload an encrypted TAR archive, which can be abused to add arbitrary users because of the lack of handle_import_user.php authentication. When combined with another flaw (CVE-2011-5325), it is possible to overwrite arbitrary files under the web root and achieve code execution as root.

After the initial setup process, some steps of setup.php are reachable not only by super-administrators but also by unauthenticated users. A malicious actor can pass step checks and potentially change the configuration of the Zabbix Frontend.

When SAML SSO authentication is enabled (non-default), session data can be modified by a malicious actor because the user login stored in the session was not verified. An unauthenticated attacker may exploit this to escalate privileges and gain admin access to Zabbix Frontend.

Windows User Profile Service Elevation of Privilege Vulnerability.

Win32k Elevation of Privilege Vulnerability.

An improper check or handling of exceptional conditions in the NPU driver allows arbitrary memory write and code execution.

The Serv-U web login screen for LDAP authentication allowed characters that were not sufficiently sanitized. SolarWinds has updated the input mechanism to perform additional validation and sanitization.

A download of code without integrity check vulnerability in the "execute restore src-vis" command of FortiOS before 7.0.3 may allow a local authenticated attacker to download arbitrary files on the device via specially crafted update packages.

Acclaim USAHERDS through 7.4.0.1 uses hard-coded credentials. This means that passwords or keys are embedded in the software, making it easier for an attacker to gain unauthorized access.

Konsola VMware Workspace ONE UEM w wersjach 20.0.8 przed 20.0.8.37, 20.11.0 przed 20.11.0.40, 21.2.0 przed 21.2.0.27 oraz 21.5.0 przed 21.5.0.37 zawiera podatność SSRF. Problem ten może umożliwić złośliwemu aktorowi z dostępem do sieci UEM wysyłanie swoich żądań bez uwierzytelnienia oraz uzyskanie dostępu do wrażliwych informacji.

In ep_loop_check_proc of eventpoll.c, there is a possible way to corrupt memory due to a use after free. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.

In unix_scm_to_skb of af_unix.c, there is a possible use-after-free bug due to a race condition. This could lead to local escalation of privilege with System execution privileges needed.

A spoofing vulnerability in AppX installer for Microsoft Windows. An attacker could craft a malicious attachment for phishing campaigns and convince the user to open it. Users with fewer user rights could be less impacted than those with administrative rights. As of December 27, 2023, Microsoft updated the installer to disable the ms-appinstaller protocol by default.

A vulnerability in the Windows Common Log File System (CLFS) driver allows elevation of privilege. An attacker could exploit this flaw to gain higher privileges on the system.

The fix for CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. Attackers with control over Thread Context Map (MDC) input data when using a non-default Pattern Layout with Context Lookup (e.g., $${ctx:loginId}) or Thread Context Map pattern (%X, %mdc, %MDC) can craft malicious input using a JNDI Lookup pattern, leading to information leak and remote code execution in some environments and local code execution in all environments.

An issue has been discovered in GitLab CE/EE affecting all versions starting from 10.5 before 14.3.6, all versions starting from 14.4 before 14.4.4, all versions starting from 14.5 before 14.5.2. Unauthorized external users could perform Server Side Requests via the CI Lint API.

Zoho ManageEngine Desktop Central is vulnerable to authentication bypass, leading to remote code execution on the server, as exploited in the wild in December 2021. For Enterprise builds 10.1.2127.17 and earlier, upgrade to 10.1.2127.18; for Enterprise builds 10.1.2128.0 through 10.1.2137.2, upgrade to 10.1.2137.3; for MSP builds 10.1.2127.17 and earlier, upgrade to 10.1.2127.18; for MSP builds 10.1.2128.0 through 10.1.2137.2, upgrade to 10.1.2137.3.

Podatność w Apache Log4j2 (w wersjach od 2.0-beta9 do 2.15.0, z wyjątkiem wydań zabezpieczeń 2.12.2, 2.12.3 i 2.3.1) pozwala atakującym na wykonanie dowolnego kodu poprzez kontrolowane przez nich wiadomości logów i parametry, gdy włączona jest substytucja wyszukiwania wiadomości. Od wersji 2.15.0 to zachowanie zostało domyślnie wyłączone, a w wersji 2.16.0 całkowicie usunięte.