CVSS: 7.8EPSS: 0%CPEs: 3EXPL: 0CVE-2021-28645 – Trend Micro Apex One Incorrect Permission Assignment Privilege Escalation Vulnerability
https://notcve.org/view.php?id=CVE-2021-28645
12 Apr 2021 — An incorrect permission assignment vulnerability in Trend Micro Apex One, Apex One as a Service and OfficeScan XG SP1 could allow a local attacker to escalate privileges on affected installations. ... Nota: un atacante primero debe obtener la habilidad de ejecutar código poco privilegiado en el sistema de destino para explotar esta vulnerabilidad This vulnerability allows local attackers to escalate privileges on affected installations of Trend Micro Apex One. ... An attacker can leverag... • https://success.trendmicro.com/solution/000286019 • CWE-732: Incorrect Permission Assignment for Critical Resource •
CVSS: 9.3EPSS: 0%CPEs: 1EXPL: 1CVE-2020-13532
https://notcve.org/view.php?id=CVE-2020-13532
09 Apr 2021 — In the default configuration, the Syncfusion Dashboard Service service binary can be replaced by attackers to escalate privileges to NT SYSTEM. • https://talosintelligence.com/vulnerability_reports/TALOS-2020-1146 • CWE-276: Incorrect Default Permissions •
CVSS: 9.3EPSS: 0%CPEs: 1EXPL: 1CVE-2020-13533
https://notcve.org/view.php?id=CVE-2020-13533
09 Apr 2021 — IIn the default configuration, the following registry keys, which reference binaries with weak permissions, can be abused by attackers to effectively ‘backdoor’ the installation files and escalate privileges when a new user logs in and uses the application. • https://talosintelligence.com/vulnerability_reports/TALOS-2020-1146 • CWE-276: Incorrect Default Permissions •
CVSS: 7.0EPSS: 0%CPEs: 2EXPL: 1CVE-2021-29221
https://notcve.org/view.php?id=CVE-2021-29221
09 Apr 2021 — A local privilege escalation vulnerability was discovered in Erlang/OTP prior to version 23.2.3. • https://deepsurface.com/deepsurface-security-advisory-local-privilege-escalation-in-erlang-on-windows-cve-2021-29221 • CWE-426: Untrusted Search Path •
CVSS: 9.0EPSS: 0%CPEs: 1EXPL: 1CVE-2021-30462
https://notcve.org/view.php?id=CVE-2021-30462
08 Apr 2021 — VestaCP through 0.9.8-24 allows the admin user to escalate privileges to root because the Sudo configuration does not require a password to run /usr/local/vesta/bin scripts. • https://ssd-disclosure.com/ssd-advisory-vestacp-lpe-vulnerabilities • CWE-306: Missing Authentication for Critical Function •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 1CVE-2021-30463
https://notcve.org/view.php?id=CVE-2021-30463
08 Apr 2021 — VestaCP through 0.9.8-24 allows attackers to gain privileges by creating symlinks to files for which they lack permissions. After reading the RKEY value from user.conf under the /usr/local/vesta/data/users/admin directory, the admin password can be changed via a /reset/?action=confirm&user=admin&code= URI. This occurs because chmod is used unsafely. VestaCP versiones hasta 0.9.8-24, permite a atacantes alcanzar privilegios al crear enlaces simbólicos en archivos para los que carecen de permisos. • https://ssd-disclosure.com/ssd-advisory-vestacp-lpe-vulnerabilities • CWE-59: Improper Link Resolution Before File Access ('Link Following') •
CVSS: 7.8EPSS: 0%CPEs: 26EXPL: 0CVE-2021-29154 – kernel: Local privilege escalation due to incorrect BPF JIT branch displacement computation
https://notcve.org/view.php?id=CVE-2021-29154
08 Apr 2021 — BPF JIT compilers in the Linux kernel through 5.11.12 have incorrect computation of branch displacements, allowing them to execute arbitrary code within the kernel context. This affects arch/x86/net/bpf_jit_comp.c and arch/x86/net/bpf_jit_comp32.c. Los compiladores BPF JIT en el kernel de Linux hasta la versión 5.11.12 tienen un cálculo incorrecto de los desplazamientos de rama, lo que les permite ejecutar código arbitrario dentro del contexto del kernel. Esto afecta a arch/x86/net/bpf_jit_comp.c y arch/x86... • http://packetstormsecurity.com/files/162434/Kernel-Live-Patch-Security-Notice-LSN-0076-1.html • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2021-20334 – Local privilege escalation in MongoDB Compass for Windows
https://notcve.org/view.php?id=CVE-2021-20334
06 Apr 2021 — A malicious 3rd party with local access to the Windows machine where MongoDB Compass is installed can execute arbitrary software with the privileges of the user who is running MongoDB Compass. This issue affects: MongoDB Inc. MongoDB Compass 1.x version 1.3.0 on Windows and later versions; 1.x versions prior to 1.25.0 on Windows. Un tercero malicioso con acceso local a la máquina de Windows donde MongoDB Compass está instalado puede ejecutar software arbitrario con los privilegios del usuario que está ejecu... • https://jira.mongodb.org/browse/COMPASS-4510 • CWE-269: Improper Privilege Management •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2021-27277 – SolarWinds Orion Virtual Infrastructure Monitor OneTimeJobSchedulerEventsService Deserialization of Untrusted Data Privilege Escalation Vulnerability
https://notcve.org/view.php?id=CVE-2021-27277
30 Mar 2021 — This vulnerability allows local attackers to escalate privileges on affected installations of SolarWinds Orion Virtual Infrastructure Monitor 2020.2. ... An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. ... Era ZDI-CAN-11955 This vulnerability allows local attackers to escalate privileges
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2021-27448
https://notcve.org/view.php?id=CVE-2021-27448
25 Mar 2021 — A miscommunication in the file system allows adversaries with access to the MU320E to escalate privileges on the MU320E (all firmware versions prior to v04A00.1). • https://us-cert.cisa.gov/ics/advisories/icsa-21-082-02 • CWE-250: Execution with Unnecessary Privileges CWE-269: Improper Privilege Management •