Microsoft Outlook 2013 RT SP1/2013 SP1/2016/2019 Remote Privilege Escalation
A vulnerability was found in Microsoft Outlook 2013 SP1/2013 RT SP1/2016/2019 (Groupware Software). It has been declared as problematic. Applying
Microsoft Windows 7 SP1 up to Server 2019 Print Spooler Local Privilege Escalation
A vulnerability classified as critical was found in Microsoft Windows (Operating System). Affected by this vulnerability is an unknown part
Microsoft Windows 10 20H2 up to Server 2019 Kernel Remote Privilege Escalation
A vulnerability classified as critical has been found in Microsoft Windows 10 1809 up to Server 2019 (Operating System). Affected
Cisco SD-WAN Software Privilege Escalation Vulnerability
Cisco has released free software updates that address the vulnerability described in this advisory. Customers may only install and expect support for software versions and feature sets for which they have purchased a license. By installing, downloading, accessing, or otherwise using such software upgrades, customers agree to follow the terms of the Cisco software license:https://www.cisco.com/c/en/us/products/end-user-license-agreement.html
Additionally, customers may only download software for which they have a valid license, procured from Cisco directly, or through a Cisco authorized reseller or partner. In most cases this will be a maintenance upgrade to software that was previously purchased. Free security software updates do not entitle customers to a new software license, additional software feature sets, or major revision upgrades.
When considering software upgrades, customers are advised to regularly consult the advisories for Cisco products, which are available from the Cisco Security Advisories page, to determine exposure and a complete upgrade solution.
In all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) or their contracted maintenance providers.
Customers Without Service Contracts
Customers who purchase directly from Cisco but do not hold a Cisco service contract and customers who make purchases through third-party vendors but are unsuccessful in obtaining fixed software through their point of sale should obtain upgrades by contacting the Cisco TAC: https://www.cisco.com/c/en/us/support/web/tsd-cisco-worldwide-contacts.html
Customers should have the product serial number available and be prepared to provide the URL of this advisory as evidence of entitlement to a free upgrade.
Fixed Releases
Customers are advised to upgrade to an appropriate fixed software release as indicated in the following table(s):
Cisco SD-WAN Software Release
First Fixed Release
18.4 and earlier
Not vulnerable
19.2
Not vulnerable
20.1
Not vulnerable
20.3
Not vulnerable
20.4
20.4.2
20.5
20.5.1
Cisco DNA Spaces Connector Privilege Escalation Vulnerabilities
When considering software upgrades, customers are advised to regularly consult the advisories for Cisco products, which are available from the Cisco Security Advisories page, to determine exposure and a complete upgrade solution.
In all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) or their contracted maintenance providers.
Fixed Releases
At the time of publication, Cisco DNA Spaces Connector releases 2.3.1 and later contained the fix for these vulnerabilities.
See the Details section in the bug ID(s) at the top of this advisory for the most complete and current information.
MacOS Local Privilege Escalation Exploitable through Cisco AnyConnect Secure Mobility Client
THIS DOCUMENT IS PROVIDED ON AN “AS IS” BASIS AND DOES NOT IMPLY ANY KIND OF GUARANTEE OR WARRANTY, INCLUDING THE WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR USE. YOUR USE OF THE INFORMATION ON THE DOCUMENT OR MATERIALS LINKED FROM THE DOCUMENT IS AT YOUR OWN RISK. CISCO RESERVES THE RIGHT TO CHANGE OR UPDATE THIS DOCUMENT AT ANY TIME.A standalone copy or paraphrase of the text of this document that omits the distribution URL is an uncontrolled copy and may lack important information or contain factual errors. The information in this document is intended for end users of Cisco products.
Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers Local Privilege Escalation Vulnerability
When considering software upgrades, customers are advised to regularly consult the advisories for Cisco products, which are available from the Cisco Security Advisories page, to determine exposure and a complete upgrade solution.
In all cases, customers should ensure that the devices to be upgraded contain sufficient memory and confirm that current hardware and software configurations will continue to be supported properly by the new release. If the information is not clear, customers are advised to contact the Cisco Technical Assistance Center (TAC) or their contracted maintenance providers.
Fixed Releases
At the time of publication, Cisco Small Business RV Series Routers firmware releases 1.0.03.21 and later contained the fix for this vulnerability.
See the Details section in the bug ID(s) at the top of this advisory for the most complete and current information.
To download the firmware from the Software Center on Cisco.com, do the following:
Click Browse all.
Choose Routers > Small Business Routers > Small Business RV Series Routers.
Choose the appropriate router.
Choose Small Business Router Firmware.
Choose a release from the left pane of the product page.
Privilege escalation vulnerability in MicroK8s allows a low privilege user with local access to obtain root access to the host by provisioning a privileged container. Fixed in MicroK8s 1.15.3.
Overview : Privilege escalation vulnerability in MicroK8s allows a low privilege user with local access to obtain root access to
Data Center Security Privilege Escalation
Overview : Symantec Data Center Security Manager Component, prior to 6.8.2 (aka 6.8 MP2), may be susceptible to a privilege
Elasticsearch versions from 6.7.0 to 6.8.7 and 7.0.0 to 7.6.1 contain a privilege escalation flaw if an attacker is able to create API keys.
Overview : Elasticsearch versions from 6.7.0 to 6.8.7 and 7.0.0 to 7.6.1 contain a privilege escalation flaw if an attacker
Local Privilege Escalation can occur in PHOENIX CONTACT PORTICO SERVER through 3.0.7 when installed to run as a service.
[vc_row][vc_column][vc_column_text] Overview : Local Privilege Escalation can occur in PHOENIX CONTACT PORTICO SERVER through 3.0.7 when installed to run as
Insecure, default path permissions in PHOENIX CONTACT PC WORX SRT through 1.14 allow for local privilege escalation.
Overview : Insecure, default path permissions in PHOENIX CONTACT PC WORX SRT through 1.14 allow for local privilege escalation. CVE-2020-10939
Local Privilege Escalation in OpenBSD’s dynamic loader
Overview : OpenBSD through 6.6 allows local users to escalate to root because a check for LD_LIBRARY_PATH in setuid programs
Linux vserver 2.6 before 2.6.17 suffers from privilege escalation in remount code.
Overview : linux vserver priviledge escalation in remount code Affected Product(s) : linux vserver 2.6 before 2.6.17 Vulnerability Details :
IBM Security Guardium vulnerable to a privilege escalation
Overview : IBM Security Guardium has addressed the following vulnerability. Affected Product(s) : IBM Security Guardium 9.0 – 9.5 IBM
Exim Privilege Escalation Vulnerability
Exim was found to be prone to a privilege escalation vulnerability. An attacker can make use of this vulnerability to
Privilege Escalation Vulnerability Found in Symantec Messaging Gateway
Privilege escalation issue found in Symantec Messaging Gateway CVE-2019-12751 Updates are available in Symantec Official Website Bugtraq ID: 108925
Adobe Dreamweaver found with Local Privilege Escalation Vulnerability
Adobe Dreamweaver is found to be prone to local privilege escalation vulnerability. An attacker can utilise this issue to gain
CVE-2024-9473 : PALO ALTO GLOBALPROTECT APP UP TO 5.1/6.1/6.2.4/6.3 ON WINDOWS REPAIR UNNECESSARY PRIVILEGES
Description A privilege escalation vulnerability in the Palo Alto Networks GlobalProtect app on Windows allows a locally authenticated non-administrative Windows
CVE-2024-3057 : PURESTORAGE FLASHARRAY UP TO 6.6.5 PRIVILEGES MANAGEMENT
Description A flaw exists whereby a user can make a specific call to a FlashArray endpoint allowing privilege escalation. References
CVE-2024-43403 : KANISTERIO KANISTER UP TO 0.110.0 CREATE/PATCH/UDPATE PRIVILEGES MANAGEMENT
Description Kanister is a data protection workflow management tool. The kanister has a deployment called default-kanister-operator, which is bound with
CVE-2024-42365 : ASTERISK PBX CONFIGURATION FILE /ETC/ASTERISK/ PRIVILEGE DEFINED WITH UNSAFE ACTIONS
Description Asterisk is an open source private branch exchange (PBX) and telephony toolkit. Prior to asterisk versions 18.24.2, 20.9.2, and
CVE-2024-38770 : REVMAKX BACKUP AND STAGING WP TIME CAPSULE PLUGIN UP TO 1.22.20 ON WORDPRESS PRIVILEGES MANAGEMENT
Description Improper Privilege Management vulnerability in Revmakx Backup and Staging by WP Time Capsule allows Privilege Escalation, Authentication Bypass. This
CVE-2024-39633 : IDEABOX POWERPACK FOR BEAVER BUILDER PLUGIN UP TO 2.33.0 ON WORDPRESS PRIVILEGES MANAGEMENT
Description Improper Privilege Management vulnerability in IdeaBox PowerPack for Beaver Builder allows Privilege Escalation.This issue affects PowerPack for Beaver Builder: