Jorge Escabias

Tanium Client is subject to a denial of service condition. The vulnerability allows for a denial of service.

Tanium Threat Response contains an information disclosure issue. The vulnerability allows for the potential exposure of information.

Tanium Threat Response contains an information disclosure issue. The vulnerability allows for the potential exposure of information.

Tanium Threat Response contains an information disclosure issue.

An improper input validation issue exists in Tanium Appliance.

A vulnerability in the CLI of multiple Cisco Unified Communications products could allow an authenticated, local attacker to execute arbitrary commands on the underlying operating system of an affected device as the root user. This issue is due to improper validation of user-supplied command arguments. An attacker could exploit this by executing crafted commands on the CLI of an affected device, allowing them to execute arbitrary commands on the underlying operating system as the root user. The attacker must have valid administrative credentials to exploit this vulnerability.

The issue concerns hardcoded credentials in NETSCOUT nGeniusONE that can be obtained from JAR files.

The issue concerns a Sensitive File Accessible Without Proper Authentication to an endpoint. No information is provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited.

The issue allows for Arbitrary File Creation by authenticated users.

The issue is related to a weak sudo configuration.

The issue allows local users to leverage Insecure Permissions for the nGeniusCLI File, potentially leading to unauthorized access or modifications.

The issue is related to a Broken Authorization Schema for the report module. This means that there is a flaw in how authorization is handled, potentially allowing unauthorized access to certain features or data within the report module.

The issue allows technical information disclosure via a stack trace.

The issue is related to Stored Cross-Site Scripting (XSS) that can be triggered via a certain POST parameter. This allows an attacker to inject malicious scripts into the application.

A vulnerability in the system file permission handling could allow an authenticated, local attacker to overwrite critical system files, causing a DoS condition. The attacker must have valid administrative credentials to exploit this issue. This vulnerability is due to a race condition with handling system files, which an attacker could exploit by performing specific operations on the file system, potentially leading to the device being in an inconsistent state.

A vulnerability in the implementation of internal system processes could allow an authenticated, local attacker to access sensitive information on an affected device. The attacker must have valid administrative credentials to exploit this issue. This vulnerability is due to insufficient masking of sensitive information displayed through system CLI commands. An attacker could exploit this by using reconnaissance techniques at the device CLI, potentially accessing sensitive information that could be used for additional attacks.

A vulnerability in the CLI could allow an authenticated, local attacker to execute arbitrary commands as root on the underlying operating system of an affected device. The attacker must have valid administrative credentials to exploit this issue. This is due to insufficient validation of arguments passed to specific CLI commands, allowing an attacker to execute arbitrary commands with the privileges of root by including crafted input as the argument of an affected CLI command.

A stored XSS attack can be performed by an authenticated, remote attacker on the web UI of the system. The issue arises from improper input validation in the web UI, allowing an attacker with valid administrative credentials to inject malicious code into specific pages. This could lead to the execution of arbitrary script code in the context of the web UI or access to sensitive, browser-based information.