CVSS: 8.4EPSS: 1%CPEs: 3EXPL: 7CVE-2023-6246 – Glibc: heap-based buffer overflow in __vsyslog_internal()
https://notcve.org/view.php?id=CVE-2023-6246
This issue occurs when the openlog function was not called, or called with the ident argument set to NULL, and the program name (the basename of argv[0]) is bigger than 1024 bytes, resulting in an application crash or local privilege escalation. • https://github.com/elpe-pinillo/CVE-2023-6246 http://packetstormsecurity.com/files/176931/glibc-qsort-Out-Of-Bounds-Read-Write.html http://packetstormsecurity.com/files/176932/glibc-syslog-Heap-Based-Buffer-Overflow.html http://seclists.org/fulldisclosure/2024/Feb/3 http://seclists.org/fulldisclosure/2024/Feb/5 https://access.redhat.com/security/cve/CVE-2023-6246 https://bugzilla.redhat.com/show_bug.cgi?id=2249053 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject& • CWE-122: Heap-based Buffer Overflow CWE-787: Out-of-bounds Write •
CVSS: 7.8EPSS: 0%CPEs: 12EXPL: 9CVE-2024-1086 – Linux Kernel Use-After-Free Vulnerability
https://notcve.org/view.php?id=CVE-2024-1086
A use-after-free vulnerability in the Linux kernel's netfilter: nf_tables component can be exploited to achieve local privilege escalation. The nft_verdict_init() function allows positive values as drop error within the hook verdict, and hence the nf_hook_slow() function can cause a double free vulnerability when NF_DROP is issued with a drop error which resembles NF_ACCEPT. We recommend upgrading past commit f342de4e2f33e0e39165d8639387aa6c19dff660. Una vulnerabilidad de use after free en el componente netfilter: nf_tables del kernel de Linux puede explotarse para lograr una escalada de privilegios local. ... The nf_tables component can be exploited to achieve local privilege escalation. Linux kernel contains a use-after-free vulnerability in the netfilter: nf_tables component that allows an attacker to achieve local privilege escalation. • https://github.com/Notselwyn/CVE-2024-1086 https://github.com/feely666/CVE-2024-1086 https://github.com/CCIEVoice2009/CVE-2024-1086 https://github.com/pl0xe/CVE-2024-1086 https://github.com/xzx482/CVE-2024-1086 https://github.com/kevcooper/CVE-2024-1086-checker http://www.openwall.com/lists/oss-security/2024/04/10/22 http://www.openwall.com/lists/oss-security/2024/04/10/23 http://www.openwall.com/lists/oss-security/2024/04/14/1 http://www.openwall.co • CWE-416: Use After Free •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 1CVE-2024-22938
https://notcve.org/view.php?id=CVE-2024-22938
Insecure Permissions vulnerability in BossCMS v.1.3.0 allows a local attacker to execute arbitrary code and escalate privileges via the init function in admin.class.php component. La vulnerabilidad de permisos inseguros en BossCMS v.1.3.0 permite a un atacante local ejecutar código arbitrario y escalar privilegios a través de la función init en el componente admin.class.php. • https://github.com/n0Sleeper/bosscmsVuln https://github.com/n0Sleeper/bosscmsVuln/issues/1 https://www.bosscms.net • CWE-863: Incorrect Authorization •
CVSS: 7.8EPSS: 0%CPEs: 6EXPL: 1CVE-2024-23940
https://notcve.org/view.php?id=CVE-2024-23940
Trend Micro uiAirSupport, included in the Trend Micro Security 2023 family of consumer products, version 6.0.2092 and below is vulnerable to a DLL hijacking/proxying vulnerability, which if exploited could allow an attacker to impersonate and modify a library to execute code on the system and ultimately escalate privileges on an affected system. • https://helpcenter.trendmicro.com/en-us/article/tmka-12134 https://helpcenter.trendmicro.com/ja-jp/article/tmka-12132 https://medium.com/@s1kr10s/av-when-a-friend-becomes-an-enemy-55f41aba42b1 • CWE-427: Uncontrolled Search Path Element •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 1CVE-2023-48202
https://notcve.org/view.php?id=CVE-2023-48202
Cross-Site Scripting (XSS) vulnerability in Sunlight CMS 8.0.1 allows an authenticated low-privileged user to escalate privileges via a crafted SVG file in the File Manager component. • https://mechaneus.github.io/CVE-2023-48202.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •