CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-36538
https://notcve.org/view.php?id=CVE-2024-36538
24 Jul 2024 — Insecure permissions in chaos-mesh v2.6.3 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token. • https://gist.github.com/HouqiyuA/f06d1fa07b5287b862c1e0b288f301e5 • CWE-278: Insecure Preserved Inherited Permissions •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2024-36539
https://notcve.org/view.php?id=CVE-2024-36539
24 Jul 2024 — Insecure permissions in contour v1.28.3 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token. • https://github.com/Abdurahmon3236/CVE-2024-36539 • CWE-277: Insecure Inherited Permissions •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-36540
https://notcve.org/view.php?id=CVE-2024-36540
24 Jul 2024 — Insecure permissions in external-secrets v0.9.16 allows attackers to access sensitive data and escalate privileges by obtaining the service account's token. • https://gist.github.com/HouqiyuA/a4834f3c8450f9d89e2bc4d5c4beef6a •
CVSS: 8.0EPSS: 0%CPEs: 1EXPL: 0CVE-2024-1575
https://notcve.org/view.php?id=CVE-2024-1575
23 Jul 2024 — The improper privilege management vulnerability in the Zyxel WBE660S firmware version 6.70(ACGG.3) and earlier versions could allow an authenticated user to escalate privileges and download the configuration files on a vulnerable device. • https://www.zyxel.com/global/en/support/security-advisories/zyxel-security-advisory-for-improper-privilege-management-vulnerability-in-aps-07-23-2024 • CWE-269: Improper Privilege Management •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2024-6121 – NI SystemLink Server Ships Out of Date Redis Version
https://notcve.org/view.php?id=CVE-2024-6121
22 Jul 2024 — This vulnerability allows local attackers to escalate privileges on affected installations of NI FlexLogger. ... An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. • https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/ni-systemlink-server-ships-out-of-date-redis-version.html • CWE-1395: Dependency on Vulnerable Third-Party Component •
CVSS: 8.8EPSS: 0%CPEs: 4EXPL: 0CVE-2024-6908 – Admin Can Escalate Privileges to SuperAdmin Using Manual PUT Request
https://notcve.org/view.php?id=CVE-2024-6908
19 Jul 2024 — Improper privilege management in Yugabyte Platform allows authenticated admin users to escalate privileges to SuperAdmin via a crafted PUT HTTP request, potentially leading to unauthorized access to sensitive system functions and data. • https://github.com/yugabyte/yugabyte-db/commit/03b193de40b79329439bb9968a7d27a1cc57d662 • CWE-269: Improper Privilege Management •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-41602
https://notcve.org/view.php?id=CVE-2024-41602
19 Jul 2024 — Cross Site Request Forgery vulnerability in Spina CMS v.2.18.0 and before allows a remote attacker to escalate privileges via a crafted URL Vulnerabilidad de falsificación de solicitudes entre sitios en Spina CMS v.2.18.0 y anteriores permite a un atacante remoto escalar privilegios a través de una URL manipulada • https://github.com/topsky979/Security-Collections/tree/main/CVE-2024-41602 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-30473
https://notcve.org/view.php?id=CVE-2024-30473
18 Jul 2024 — Dell ECS, versions prior to 3.8.1, contain a privilege elevation vulnerability in user management. • https://www.dell.com/support/kbdoc/en-us/000227051/dsa-2024-239-security-update-dell-ecs-3-8-1-1-for-multiple-security-vulnerabilities • CWE-269: Improper Privilege Management •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-34013
https://notcve.org/view.php?id=CVE-2024-34013
18 Jul 2024 — Local privilege escalation due to OS command injection vulnerability. • https://security-advisory.acronis.com/advisories/SEC-7035 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 2.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-21164 – Oracle VirtualBox EHCI USB Controller Out-Of-Bounds Read Information Disclosure Vulnerability
https://notcve.org/view.php?id=CVE-2024-21164
16 Jul 2024 — An attacker can leverage this in conjunction with other vulnerabilities to escalate privileges and execute arbitrary code in the context of the hypervisor. • https://www.oracle.com/security-alerts/cpujul2024.html •