CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-25153 – ITarian - Local privilege escalation in Endpoint Manager agent on Windows
https://notcve.org/view.php?id=CVE-2022-25153
The ITarian Endpoint Manage Communication Client, prior to version 6.43.41148.21120, is compiled using insecure OpenSSL settings. Due to this setting, a malicious actor with low privileges access to a system can escalate his privileges to SYSTEM abusing an insecure openssl.conf lookup. El cliente de comunicación de ITarian Endpoint Manage, versiones anteriores a 6.43.41148.21120, es compilado usando una configuración no segura de OpenSSL. Debido a esta configuración, un actor malicioso con acceso de bajos privilegios a un sistema puede escalar sus privilegios a SYSTEM abusando de una búsqueda no segura de openssl.conf • https://csirt.divd.nl/CVE-2022-25153 https://csirt.divd.nl/DIVD-2021-00037 • CWE-275: Permission Issues •
CVSS: 8.8EPSS: 0%CPEs: 22EXPL: 6CVE-2022-32250 – Linux Kernel nf_tables_expr_destroy Use-After-Free Privilege Escalation Vulnerability
https://notcve.org/view.php?id=CVE-2022-32250
net/netfilter/nf_tables_api.c in the Linux kernel through 5.18.1 allows a local user (able to create user/net namespaces) to escalate privileges to root because an incorrect NFT_STATEFUL_EXPR check leads to a use-after-free. ... This vulnerability allows local attackers to escalate privileges on affected installations of Linux Kernel. ... An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of root. • https://github.com/theori-io/CVE-2022-32250-exploit https://github.com/ysanatomic/CVE-2022-32250-LPE https://github.com/Kristal-g/CVE-2022-32250 http://www.openwall.com/lists/oss-security/2022/06/03/1 http://www.openwall.com/lists/oss-security/2022/06/04/1 http://www.openwall.com/lists/oss-security/2022/06/20/1 http://www.openwall.com/lists/oss-security/2022/07/03/5 http://www.openwall.com/lists/oss-security/2022/07/03/6 http://www.ope • CWE-416: Use After Free •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-29483 – e-Design - Multiple vulnerabilities
https://notcve.org/view.php?id=CVE-2022-29483
Una vulnerabilidad de Permisos Predeterminados Incorrectos en ABB e-Design permite a un atacante instalar software malicioso que es ejecutado con permisos SYSTEM, violando la confidencialidad, la integridad y la disponibilidad de la máquina de destino This vulnerability allows local attackers to escalate privileges on affected installations of ABB e-Design. ... An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. • https://search.abb.com/library/Download.aspx?DocumentID=2%20CMT%200%200%206%200%208%206&LanguageCode=en&DocumentPartId=&Action=Launch • CWE-276: Incorrect Default Permissions •
CVSS: 7.3EPSS: 0%CPEs: 2EXPL: 0CVE-2022-30702 – Trend Micro Internet Security Out-Of-Bounds Read Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2022-30702
An attacker can leverage this in conjunction with other vulnerabilities to escalate privileges and execute arbitrary code in the context of SYSTEM. • https://helpcenter.trendmicro.com/en-us/article/tmka-11022 https://www.zerodayinitiative.com/advisories/ZDI-22-800 • CWE-125: Out-of-bounds Read •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2022-26773 – Apple iTunes Incorrect Permission Assignment Privilege Escalation Vulnerability
https://notcve.org/view.php?id=CVE-2022-26773
Una aplicación puede ser capaz de eliminar archivos para los que no presenta permiso This vulnerability allows local attackers to escalate privileges on affected installations of Apple iTunes. ... An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. • https://support.apple.com/en-us/HT213259 •