Local privilege escalation via insecure folder permissions

Incorrect permission assignment allows local privilege escalation to SYSTEM on affected releases of the Illumio VEN for Windows. Code execution as NT AUTHORITY\LOCAL SERVICE on the Windows host is required to exploit this vulnerability. The flaw exists within the VEN installer, which grants LOCAL SERVICE full access to the VEN data and installation folders, whose configuration and state files are read and trusted by the SYSTEM-privileged illumio-ven-ctl component. An attacker can leverage this vulnerability to modify the VEN configuration so that illumio-ven-ctl executes an injected command in the context of the SYSTEM account.

Universal-modder before e88f687 Cross-Site WebSocket Command Execution via HostLink

Universal-modder before commit e88f6876745427321eb755ebc98276063a962d8a contains a missing WebSocket Origin validation vulnerability in the HostLink class of its passthrough example mods that allows remote attackers to execute Minecraft commands. Any web page open in the player's browser can connect cross-site to the unauthenticated loopback WebSocket and send cmd messages that WorldBridge.command() runs with operator authority.

Map-OS 5.0.0 to before 5.2.2 Privilege Escalation via /api/v1/usuarios

Map-OS 5.0.0 to before 5.2.2 contains a privilege escalation vulnerability in the REST users API that allows non-administrator operators holding the cUsuario permission to bypass permission-delegation and super-administrator protections. Attackers can send POST, PUT, or DELETE requests to /api/v1/usuarios to assign the Administrador group, reset the super administrator password, or delete higher-privileged users.

Pipelines-as-code: openshift-pipelines-operator-rh: pipelines-as-code: repository users can trigger namespace edit-equivalent execution via auto-provisioned pipeline serviceaccount

A flaw was found in OpenShift Pipelines-as-Code (PAC). PAC does not verify whether the creator of a Repository custom resource has permission to create PipelineRuns. A namespace user with only Repository and Secret create/delete permissions can cause PAC to execute attacker-controlled PipelineRuns as the auto-provisioned pipeline ServiceAccount, which carries ClusterRole/edit by default. This results in namespace-scoped privilege escalation, enabling Secret read, resource creation/modification/deletion, and potential supply chain injection in CI/CD namespaces.

youlai-boot through 2.21.1 Missing Authorization in Role Menu Assignment Allows Privilege Escalation

youlai-boot through 2.21.1 contains a missing authorization vulnerability that allows authenticated users to assign arbitrary menu and button permissions to roles via PUT /api/v1/roles/{roleId}/menus. Low-privileged users such as the GUEST test account can grant all permissions to their own role, refreshing the Redis permission cache to gain administrator-equivalent access.

.NET Denial of Service Vulnerability

Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.

.NET Remote Code Execution Vulnerability

Deserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network.

.NET Remote Code Execution Vulnerability

Improperly implemented security check for standard in .NET allows an unauthorized attacker to execute code over a network.

.NET and Visual Studio Remote Code Execution Vulnerability

Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network.

.NET Remote Code Execution Vulnerability

Out-of-bounds write in .NET allows an unauthorized attacker to execute code over a network.

.NET Framework Remote Code Execution Vulnerability

Out-of-bounds write in .NET Framework allows an unauthorized attacker to execute code over a network.

.NET Framework Remote Code Execution Vulnerability

Deserialization of untrusted data in .NET Framework allows an unauthorized attacker to execute code over a network.

.NET Denial of Service Vulnerability

Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.

.NET Elevation of Privilege Vulnerability

Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.

.NET Elevation of Privilege Vulnerability

Improper link resolution before file access ('link following') in .NET allows an authorized attacker to elevate privileges locally.

.NET Security Feature Bypass Vulnerability

Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security feature over a network.

.NET Denial of Service Vulnerability

Uncontrolled recursion in .NET allows an unauthorized attacker to deny service over a network.

.NET and Visual Studio Elevation of Privilege Vulnerability

Access of resource using incompatible type ('type confusion') in .NET and Visual Studio allows an unauthorized attacker to elevate privileges over a network.

Windows Partition Management Driver Elevation of Privilege Vulnerability

Out-of-bounds read in Windows Partition Management Driver allows an authorized attacker to elevate privileges locally.

Vulnerability in the Siebel Apps - Life Sciences product of Oracle Siebel CRM (component: eDetailing). Supported versions that are affected are 17.0-26.9. Easily exploitable vulnerability allows low privileged attacker with network access via SQL to compromise Siebel Apps - Life Sciences. Successful attacks of this vulnerability can result in takeover of Siebel Apps - Life Sciences. CVSS 3.1 Base Score 8.8 (Confidentiality, Integrity and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).