Security Vulnerabilities, CVEs, (Gain Privilege)
CVE-2023-50919
Public exploit
An issue was discovered on GL.iNet devices before version 4.5.0. There is an NGINX authentication bypass via Lua string pattern matching. This affects A1300 4.4.6, AX1800 4.4.6, AXT1800 4.4.6, MT3000 4.4.6, MT2500 4.4.6, MT6000 4.5.0, MT1300 4.3.7, MT300N-V2 4.3.7, AR750S 4.3.7, AR750 4.3.7, AR300M 4.3.7, and B1300 4.3.7.
Max CVSS
9.8
EPSS Score
0.11%
Published
2024-01-12
Updated
2024-01-24
CVE-2023-46805
Known exploited
Public exploit
An authentication bypass vulnerability in the web component of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure allows a remote attacker to access restricted resources by bypassing control checks.
Max CVSS
8.2
EPSS Score
96.43%
Published
2024-01-12
Updated
2024-01-22
CISA KEV Added
2024-01-10
CVE-2023-36874
Known exploited
Public exploit
Windows Error Reporting Service Elevation of Privilege Vulnerability
Max CVSS
7.8
EPSS Score
0.15%
Published
2023-07-11
Updated
2023-09-27
CISA KEV Added
2023-07-11
CVE-2023-34124
Public exploit
The authentication mechanism in SonicWall GMS and Analytics Web Services had insufficient checks, allowing authentication bypass. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.
Max CVSS
9.8
EPSS Score
1.54%
Published
2023-07-13
Updated
2023-09-08
CVE-2023-32479
Public exploit
Dell Encryption, Dell Endpoint Security Suite Enterprise, and Dell Security Management Server versions prior to 11.9.0 contain privilege escalation vulnerability due to improper ACL of the non-default installation directory. A local malicious user could potentially exploit this vulnerability by replacing binaries in installed directory and taking reverse shell of the system leading to Privilege Escalation.
Max CVSS
7.8
EPSS Score
0.04%
Published
2024-02-06
Updated
2024-02-13
CVE-2023-28503
Public exploit
Rocket Software UniData versions prior to 8.2.4 build 3003 and UniVerse versions prior to 11.3.5 build 1001 or 12.2.1 build 2002 suffer from an authentication bypass vulnerability, where a special username with a deterministic password can be leveraged to bypass authentication checks and execute OS commands as the root user.
Max CVSS
9.8
EPSS Score
1.34%
Published
2023-03-29
Updated
2023-04-12
CVE-2023-28252
Known exploited
Public exploit
Used for ransomware
Windows Common Log File System Driver Elevation of Privilege Vulnerability
Max CVSS
7.8
EPSS Score
2.55%
Published
2023-04-11
Updated
2023-09-14
CISA KEV Added
2023-04-11
CVE-2023-28121
Public exploit
An issue in WooCommerce Payments plugin for WordPress (versions 5.6.1 and lower) allows an unauthenticated attacker to send requests on behalf of an elevated user, like administrator. This allows a remote, unauthenticated attacker to gain admin access on a site that has the affected version of the plugin activated.
Max CVSS
9.8
EPSS Score
93.81%
Published
2023-04-12
Updated
2023-12-18
CVE-2023-27350
Known exploited
Public exploit
Used for ransomware
This vulnerability allows remote attackers to bypass authentication on affected installations of PaperCut NG 22.0.5 (Build 63914). Authentication is not required to exploit this vulnerability. The specific flaw exists within the SetupCompleted class. The issue results from improper access control. An attacker can leverage this vulnerability to bypass authentication and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-18987.
Max CVSS
9.8
EPSS Score
97.20%
Published
2023-04-20
Updated
2023-06-07
CISA KEV Added
2023-04-21
CVE-2023-26360
Known exploited
Public exploit
Adobe ColdFusion versions 2018 Update 15 (and earlier) and 2021 Update 5 (and earlier) are affected by an Improper Access Control vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue does not require user interaction.
Max CVSS
9.8
EPSS Score
96.36%
Published
2023-03-23
Updated
2023-05-01
CISA KEV Added
2023-03-15
CVE-2023-22809
Public exploit
In Sudo before 1.9.12p2, the sudoedit (aka -e) feature mishandles extra arguments passed in the user-provided environment variables (SUDO_EDITOR, VISUAL, and EDITOR), allowing a local attacker to append arbitrary entries to the list of files to process. This can lead to privilege escalation. Affected versions are 1.8.0 through 1.9.12.p1. The problem exists because a user-specified editor may contain a "--" argument that defeats a protection mechanism, e.g., an EDITOR='vim -- /path/to/extra/file' value.
Max CVSS
7.8
EPSS Score
0.05%
Published
2023-01-18
Updated
2023-11-17
CVE-2023-21768
Public exploit
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
Max CVSS
7.8
EPSS Score
0.40%
Published
2023-01-10
Updated
2023-04-27
CVE-2023-7028
Public exploit
An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.3 prior to 16.3.7, 16.4 prior to 16.4.5, 16.5 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which user account password reset emails could be delivered to an unverified email address.
Max CVSS
10.0
EPSS Score
80.72%
Published
2024-01-12
Updated
2024-03-04
CVE-2023-6538
Public exploit
SMU versions prior to 14.8.7825.01 are susceptible to unintended information disclosure, through URL manipulation. Authenticated users in Storage, Server or combined Server+Storage administrative roles are able to access SMU configuration backup, that would normally be barred to those specific administrative roles.
Max CVSS
7.6
EPSS Score
0.74%
Published
2023-12-11
Updated
2023-12-14
CVE-2023-5808
Public exploit
SMU versions prior to 14.8.7825.01 are susceptible to unintended information disclosure, through URL manipulation. Authenticated users in a Storage administrative role are able to access HNAS configuration backup and diagnostic data, that would normally be barred to that specific administrative role.
Max CVSS
7.6
EPSS Score
0.05%
Published
2023-12-05
Updated
2023-12-12
CVE-2023-0872
Public exploit
The Horizon REST API includes a users endpoint in OpenMNS Horizon 31.0.8 and versions earlier than 32.0.2 on multiple platforms is vulnerable to elevation of privilege. The solution is to upgrade to Meridian 2023.1.6, 2022.1.19, 2021.1.30, 2020.1.38 or Horizon 32.0.2 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet.
OpenNMS thanks Erik Wynter for reporting this issue.
Max CVSS
8.2
EPSS Score
0.04%
Published
2023-08-14
Updated
2023-08-21
CVE-2022-41040
Known exploited
Public exploit
Used for ransomware
Microsoft Exchange Server Elevation of Privilege Vulnerability
Max CVSS
8.8
EPSS Score
96.59%
Published
2022-10-03
Updated
2023-12-20
CISA KEV Added
2022-09-30
CVE-2022-37393
Public exploit
Zimbra's sudo configuration permits the zimbra user to execute the zmslapd binary as root with arbitrary parameters. As part of its intended functionality, zmslapd can load a user-defined configuration file, which includes plugins in the form of .so files, which also execute as root.
Max CVSS
7.8
EPSS Score
0.11%
Published
2022-08-16
Updated
2022-08-18
CVE-2022-37042
Known exploited
Public exploit
Zimbra Collaboration Suite (ZCS) 8.8.15 and 9.0 has mboximport functionality that receives a ZIP archive and extracts files from it. By bypassing authentication (i.e., not having an authtoken), an attacker can upload arbitrary files to the system, leading to directory traversal and remote code execution. NOTE: this issue exists because of an incomplete fix for CVE-2022-27925.
Max CVSS
9.8
EPSS Score
97.54%
Published
2022-08-12
Updated
2022-10-28
CISA KEV Added
2022-08-11
CVE-2022-31660
Public exploit
VMware Workspace ONE Access, Identity Manager and vRealize Automation contains a privilege escalation vulnerability. A malicious actor with local access can escalate privileges to 'root'.
Max CVSS
7.8
EPSS Score
0.12%
Published
2022-08-05
Updated
2022-08-11
CVE-2022-30526
Public exploit
A privilege escalation vulnerability was identified in the CLI command of Zyxel USG FLEX 100(W) firmware versions 4.50 through 5.30, USG FLEX 200 firmware versions 4.50 through 5.30, USG FLEX 500 firmware versions 4.50 through 5.30, USG FLEX 700 firmware versions 4.50 through 5.30, USG FLEX 50(W) firmware versions 4.16 through 5.30, USG20(W)-VPN firmware versions 4.16 through 5.30, ATP series firmware versions 4.32 through 5.30, VPN series firmware versions 4.30 through 5.30, USG/ZyWALL series firmware versions 4.09 through 4.72, which could allow a local attacker to execute some OS commands with root privileges in some directories on a vulnerable device.
Max CVSS
7.8
EPSS Score
0.12%
Published
2022-07-19
Updated
2022-12-13
CVE-2022-26923
Known exploited
Public exploit
Active Directory Domain Services Elevation of Privilege Vulnerability
Max CVSS
9.0
EPSS Score
7.92%
Published
2022-05-10
Updated
2023-12-21
CISA KEV Added
2022-08-18
CVE-2022-26904
Known exploited
Public exploit
Windows User Profile Service Elevation of Privilege Vulnerability
Max CVSS
7.0
EPSS Score
0.10%
Published
2022-04-15
Updated
2023-06-29
CISA KEV Added
2022-04-25
CVE-2022-22960
Known exploited
Public exploit
VMware Workspace ONE Access, Identity Manager and vRealize Automation contain a privilege escalation vulnerability due to improper permissions in support scripts. A malicious actor with local access can escalate privileges to 'root'.
Max CVSS
7.8
EPSS Score
0.08%
Published
2022-04-13
Updated
2023-04-19
CISA KEV Added
2022-04-15
CVE-2022-22956
Public exploit
VMware Workspace ONE Access has two authentication bypass vulnerabilities (CVE-2022-22955 & CVE-2022-22956) in the OAuth2 ACS framework. A malicious actor may bypass the authentication mechanism and execute any operation due to exposed endpoints in the authentication framework.
Max CVSS
9.8
EPSS Score
0.21%
Published
2022-04-13
Updated
2023-04-19
10570 vulnerabilities found
1
2
3
4
5
6 ......
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423