Total
1220 CVE
| CVE | Vendors | Products | Updated | CVSS v2 | CVSS v3 |
|---|---|---|---|---|---|
| CVE-2018-4049 | 1 Gog | 1 Galaxy | 2022-06-07 | 7.2 HIGH | 7.8 HIGH |
| An exploitable local privilege elevation vulnerability exists in the file system permissions of GOG Galaxy's “Games” directory, version 1.2.48.36 (Windows 64-bit Installer). An attacker can overwrite executables of installed games to exploit this vulnerability and execute arbitrary code with elevated privileges. | |||||
| CVE-2018-4050 | 1 Gog | 1 Galaxy | 2022-06-07 | 7.2 HIGH | 7.8 HIGH |
| An exploitable local privilege escalation vulnerability exists in the privileged helper tool of GOG Galaxy's Games, version 1.2.47 for macOS. An attacker can globally adjust folder permissions leading to execution of arbitrary code with elevated privileges. | |||||
| CVE-2018-4028 | 1 Anker-in | 2 Roav Dashcam A1, Roav Dashcam A1 Firmware | 2022-06-07 | 7.8 HIGH | 7.5 HIGH |
| An exploitable firmware update vulnerability exists in the NT9665X Chipset firmware running on the Anker Roav A1 Dashcam, version RoavA1SWV1.9. The HTTP server could allow an attacker to overwrite the root directory of the server, resulting in a denial of service. An attacker can send an HTTP POST request to trigger this vulnerability. | |||||
| CVE-2021-33586 | 1 Inspircd | 1 Inspircd | 2022-06-03 | 4.0 MEDIUM | 4.3 MEDIUM |
| InspIRCd 3.8.0 through 3.9.x before 3.10.0 allows any user (able to connect to the server) to access recently deallocated memory, aka the "malformed PONG" issue. | |||||
| CVE-2014-10402 | 1 Perl | 1 Dbi | 2022-06-02 | 3.6 LOW | 6.1 MEDIUM |
| An issue was discovered in the DBI module through 1.643 for Perl. DBD::File drivers can open files from folders other than those specifically passed via the f_dir attribute in the data source name (DSN). NOTE: this issue exists because of an incomplete fix for CVE-2014-10401. | |||||
| CVE-2021-44167 | 1 Fortinet | 1 Forticlient | 2022-05-19 | 5.0 MEDIUM | 7.5 HIGH |
| An incorrect permission assignment for critical resource vulnerability [CWE-732] in FortiClient for Linux version 6.0.8 and below, 6.2.9 and below, 6.4.7 and below, 7.0.2 and below may allow an unauthenticated attacker to access sensitive information in log files and directories via symbolic links. | |||||
| CVE-2022-26340 | 1 F5 | 12 Big-ip Access Policy Manager, Big-ip Advanced Firewall Manager, Big-ip Analytics and 9 more | 2022-05-13 | 4.0 MEDIUM | 4.9 MEDIUM |
| On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, and F5 BIG-IQ Centralized Management all versions of 8.x and 7.x, an authenticated, high-privileged attacker with no bash access may be able to access Certificate and Key files using Secure Copy (SCP) protocol from a remote system. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated | |||||
| CVE-2022-29263 | 1 F5 | 2 Access Policy Manager Clients, Big-ip Access Policy Manager | 2022-05-12 | 4.6 MEDIUM | 7.8 HIGH |
| On F5 BIG-IP APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, as well as F5 BIG-IP APM Clients 7.x versions prior to 7.2.1.5, the BIG-IP Edge Client Component Installer Service does not use best practice while saving temporary files. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated | |||||
| CVE-2021-0064 | 1 Intel | 24 7265, 7265 Firmware, Ac 3165 and 21 more | 2022-05-03 | 4.6 MEDIUM | 7.8 HIGH |
| Insecure inherited permissions in the Intel(R) PROSet/Wireless WiFi software installer for Windows 10 before version 22.40 may allow an authenticated user to potentially enable escalation of privilege via local access. | |||||
| CVE-2021-0077 | 1 Intel | 1 Vtune Profiler | 2022-05-03 | 4.6 MEDIUM | 7.8 HIGH |
| Insecure inherited permissions in the installer for the Intel(R) VTune(TM) Profiler before version 2021.1.1 may allow an authenticated user to potentially enable escalation of privilege via local access. | |||||
| CVE-2021-44512 | 1 Tmate | 1 Tmate-ssh-server | 2022-05-03 | 4.4 MEDIUM | 7.0 HIGH |
| World-writable permissions on the /tmp/tmate/sessions directory in tmate-ssh-server 2.3.0 allow a local attacker to compromise the integrity of session handling, or obtain the read-write session ID from a read-only session symlink in this directory. | |||||
| CVE-2021-21494 | 1 Mk-auth | 1 Mk-auth | 2022-05-03 | 3.5 LOW | 4.8 MEDIUM |
| MK-AUTH through 19.01 K4.9 allows XSS via the admin/logs_ajax.php tipo parameter. An attacker can leverage this to read the centralmka2 (session token) cookie, which is not set to HTTPOnly. | |||||
| CVE-2021-32577 | 1 Acronis | 1 True Image | 2022-05-03 | 4.6 MEDIUM | 7.8 HIGH |
| Acronis True Image prior to 2021 Update 5 for Windows allowed local privilege escalation due to insecure folder permissions. | |||||
| CVE-2021-38590 | 1 Cpanel | 1 Cpanel | 2022-05-03 | 2.1 LOW | 5.5 MEDIUM |
| In cPanel before 96.0.8, weak permissions on web stats can lead to information disclosure (SEC-584). | |||||
| CVE-2021-0105 | 1 Intel | 10 Ac 9461, Ac 9461 Firmware, Ac 9462 and 7 more | 2022-05-03 | 4.1 MEDIUM | 7.3 HIGH |
| Insecure inherited permissions in some Intel(R) ProSet/Wireless WiFi drivers may allow an authenticated user to potentially enable information disclosure and denial of service via adjacent access. | |||||
| CVE-2021-38085 | 1 Canon | 2 Pixma Tr150, Pixma Tr150 Firmware | 2022-05-03 | 7.2 HIGH | 7.8 HIGH |
| The Canon TR150 print driver through 3.71.2.10 is vulnerable to a privilege escalation issue. During the add printer process, a local attacker can overwrite CNMurGE.dll and, if timed properly, the overwritten DLL will be loaded into a SYSTEM process resulting in escalation of privileges. This occurs because the driver drops a world-writable DLL into a CanonBJ %PROGRAMDATA% location that gets loaded by printisolationhost (a system process). | |||||
| CVE-2022-24872 | 1 Shopware | 1 Shopware | 2022-05-03 | 5.5 MEDIUM | 8.1 HIGH |
| Shopware is an open commerce platform based on Symfony Framework and Vue. Permissions set to sales channel context by admin-api are still usable within normal user session. Users are advised to update to the current version 6.4.10.1. For older versions of 6.1, 6.2, and 6.3, corresponding security measures are also available via a plugin. There are no known workarounds for this issue. | |||||
| CVE-2019-7656 | 1 Wowza | 1 Streaming Engine | 2022-05-03 | 7.2 HIGH | 7.8 HIGH |
| A privilege escalation vulnerability in Wowza Streaming Engine 4.8.0 and earlier allows any unprivileged Linux user to escalate privileges to root. The installer sets too relaxed permissions on /usr/local/WowzaStreamingEngine/bin/* core program files. By injecting a payload into one of those files, it will run with the same privileges as the Wowza server, root. For example, /usr/local/WowzaStreamingEngine/bin/tune.sh could be replaced with a Trojan horse. This issue was resolved in Wowza Streaming Engine 4.8.5. | |||||
| CVE-2020-10513 | 1 Icatchinc | 1 Dvr Interface | 2022-05-03 | 4.0 MEDIUM | 6.5 MEDIUM |
| The file management interface of iCatch DVR firmware before 20200103 contains broken access control which allows the attacker to remotely manipulate arbitrary file. | |||||
| CVE-2020-0559 | 2 Intel, Microsoft | 78 Ac 3165 Firmware, Ac 3168 Firmware, Ac 7265 Firmware and 75 more | 2022-04-28 | 4.6 MEDIUM | 7.8 HIGH |
| Insecure inherited permissions in some Intel(R) PROSet/Wireless WiFi products on Windows* 7 and 8.1 before version 21.40.5.1 may allow an authenticated user to potentially enable escalation of privilege via local access. | |||||