CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-26476
https://notcve.org/view.php?id=CVE-2024-26476
28 Feb 2024 — An issue in open-emr before v.7.0.2 allows a remote attacker to escalate privileges via a crafted script to the formid parameter in the ereq_form.php component. • https://github.com/c4v4r0n/Research/blob/main/openemr_BlindSSRF/README.md • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2024-22983
https://notcve.org/view.php?id=CVE-2024-22983
28 Feb 2024 — SQL injection vulnerability in Projectworlds Visitor Management System in PHP v.1.0 allows a remote attacker to escalate privileges via the name parameter in the myform.php endpoint. • https://github.com/keru6k/CVE-2024-22983 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-50380 – Apache Ambari: authenticated users could perform XXE to read arbitrary files on the server
https://notcve.org/view.php?id=CVE-2023-50380
27 Feb 2024 — In theory, it might be possible to use this to escalate privileges. ... In theory, it might be possible to use this to escalate privileges. • http://www.openwall.com/lists/oss-security/2024/02/27/6 • CWE-611: Improper Restriction of XML External Entity Reference •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-22543
https://notcve.org/view.php?id=CVE-2024-22543
27 Feb 2024 — An issue was discovered in Linksys Router E1700 1.0.04 (build 3), allows authenticated attackers to escalate privileges via a crafted GET request to the /goform/* URI or via the ExportSettings function. • https://mat4mee.notion.site/Leaked-SessionID-can-lead-to-authentication-bypass-on-the-Linksys-Router-E1700-f56f9c4b15e7443fa237bd1b101a18d2 • CWE-613: Insufficient Session Expiration •
CVSS: 6.9EPSS: 0%CPEs: 1EXPL: 0CVE-2023-49114 – Local Privilege Escalation via DLL Hijacking
https://notcve.org/view.php?id=CVE-2023-49114
26 Feb 2024 — Qognify VMS Client Viewer version 7.1 suffers from a local privilege escalation vulnerability via DLL hijacking. • http://seclists.org/fulldisclosure/2024/Mar/10 • CWE-427: Uncontrolled Search Path Element •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 1CVE-2024-24402
https://notcve.org/view.php?id=CVE-2024-24402
26 Feb 2024 — An issue in Nagios XI 2024R1.01 allows a remote attacker to escalate privileges via a crafted script to the /usr/local/nagios/bin/npcd component. • https://github.com/MAWK0235/CVE-2024-24402 •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2024-26148 – Querybook's Stored Cross-Site Scripting vulnerability allows Privilege Elevation
https://notcve.org/view.php?id=CVE-2024-26148
21 Feb 2024 — Querybook is a user interface for querying big data. Prior to version 3.31.1, there is a vulnerability in Querybook's rich text editor that enables users to input arbitrary URLs without undergoing necessary validation. This particular security flaw allows the use of `javascript:` protocol which can potentially trigger arbitrary client-side execution. The most extreme exploit of this flaw could occur when an admin user unknowingly clicks on a cross-site scripting URL, thereby unintentionally compromising adm... • https://github.com/pinterest/querybook/commit/bc620dabaaf13ff1dcb30af0b46a490403fb9908 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 0CVE-2024-22235
https://notcve.org/view.php?id=CVE-2024-22235
21 Feb 2024 — VMware Aria Operations contains a local privilege escalation vulnerability. A malicious actor with administrative access to the local system can escalate privileges to 'root'. ... VMware Aria Operations contains a local privilege escalation vulnerability. A malicious actor with administrative access to the local system can escalate privileges to 'root'. • https://www.vmware.com/security/advisories/VMSA-2024-0004.html •
CVSS: 7.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-0865 – Schneider Electric EcoStruxure IT Gateway Hard-Coded Credentials Local Privilege Escalation Vulnerability
https://notcve.org/view.php?id=CVE-2024-0865
21 Feb 2024 — This vulnerability allows local attackers to escalate privileges on affected installations of Schneider Electric EcoStruxure IT Gateway. ... An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of NETWORK SERVICE. CWE-798: Use of hard-coded credentials vulnerability exists that could cause local privilege escalation when logged in as a non-administrative user. • https://download.schneider-electric.com/files?p_Doc_Ref=SEVD-2024-044-03&p_enDocType=Security+and+Safety+Notice&p_File_Name=SEVD-2024-044-03.pdf • CWE-798: Use of Hard-coded Credentials •
CVSS: 7.8EPSS: 0%CPEs: 2EXPL: 0CVE-2024-1156 – NI FlexLogger RabbitMQ Incorrect Permission Assignment Local Privilege Escalation Vulnerability
https://notcve.org/view.php?id=CVE-2024-1156
20 Feb 2024 — This vulnerability allows local attackers to escalate privileges on affected installations of NI FlexLogger. ... An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. • https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/incorrect-permissions-for-shared-systemlink-elixir-based-service.html • CWE-276: Incorrect Default Permissions •