Rich Mirch

Local users can obtain root access and execute arbitrary code by exploiting the inclusion of functionality from an untrusted control sphere. The issue occurs when the `--chroot` (or `-R`) option is used, allowing an attacker to place a malicious `nsswitch.conf` configuration file within a user-controlled directory. This bypasses the permissions typically enforced by the sudoers file. This flaw has been reported as actively exploited in the wild.

Sudo, a program designed to provide limited super user privileges, contains a vulnerability due to incorrect handling of the host (-h or --host) option. This flaw allows a local user to potentially escalate privileges by bypassing host restrictions when using the sudo command or sudoedit. The vulnerability stems from the host option not being restricted to listing privileges only, enabling execution of commands on unintended machines. This issue has existed for over 12 years.

The `process crash()` function within the data/apport component of the Apport crash reporting tool may create crash files with incorrect group ownership. This could lead to the exposure of crash information to groups beyond those with intended access. This issue was discovered during the investigation of another issue.

Name of the Vulnerable Software and Affected Versions: Microsoft Defender for Endpoint (affected versions not specified) Description: The issue concerns an elevation of privilege in Microsoft Defender for Endpoint. No specific details about the technical aspects of the issue, such as API endpoints, vulnerable parameters, or function names, are provided. There is also no information available about the estimated number of potentially affected devices worldwide or any real-world incidents where this issue was exploited. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Microsoft Defender for Endpoint (affected versions not specified) Description: The issue allows an authorized attacker to elevate privileges locally through external control of file name or path. The vulnerability exists in the `grab java version()` function. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

An issue was discovered in the Kaseya Unitrends Backup Appliance, where multiple functions in the bpserverd daemon were vulnerable to arbitrary remote code execution as root. The vulnerability was caused by untrusted input being passed to system calls.

An issue was discovered in the Samba file sharing service, allowing anonymous read/write access.

An issue was discovered where the privileged vaultServer could be leveraged to create arbitrary writable files, leading to privilege escalation.

An issue was discovered in the Kaseya Unitrends Backup Appliance where the `wguest` account could execute commands by injecting into PostgreSQL trigger functions, allowing privilege escalation from the `wguest` user to the `postgres` user.

An issue was discovered in the software where the apache user could read arbitrary files, such as /etc/shadow, by abusing an insecure Sudo rule.

An issue was discovered in the Kaseya Unitrends Backup Appliance, where a world writable file allowed local users to execute arbitrary code as the user apache, leading to privilege escalation.

An issue was discovered in the Kaseya Unitrends Backup Appliance where the password for the PostgreSQL `wguest` account is weak.

An issue was discovered in the software, involving two unauthenticated SQL injection vulnerabilities. These vulnerabilities allow arbitrary SQL queries to be injected and executed under the postgres superuser account, leading to remote code execution and full access to the postgres user account.

The issue allows a local user to execute arbitrary code and conduct DLL hijacking attacks.

The issue exists due to insufficient checking of a shared resource's state, leading to a race condition vulnerability. This vulnerability can be exploited by a local limited Windows user to execute programs with SYSTEM privileges, but only during a GlobalProtect app upgrade.

The issue is related to insufficient access control in VMware products, allowing for local privilege escalation. Exploitation of this issue may enable an attacker to elevate their privileges to root level on the system. The vulnerability is due to a Time-of-check Time-of-use (TOCTOU) issue in the service opener.

The issue is due to improper use of setuid binaries, which may allow attackers with normal user privileges to escalate their privileges to root on the system where the software is installed. Successful exploitation of this issue can lead to privilege escalation.

The issue allows an unprivileged user to set certain OpenVPN parameters, potentially loading a malicious library into the OpenVPN process memory. This can lead to limited local privilege escalation. When a VPN connection is initiated using a TLS/SSL client profile, the privileges are dropped, and the library will be loaded, resulting in arbitrary code execution as a user with limited privileges.

The issue allows local users to gain privileges by creating a Trojan horse file, specifically `%SYSTEMDRIVE% ode modules.binwmic.exe`.

The issue is related to the pg ctlcluster script in postgresql-common, which failed to drop privileges when creating temporary directories for sockets and statistics. This could lead to local privilege escalation. An attacker could exploit this issue to access confidential data, compromise its integrity, and cause a denial of service.