Stefan Grönke

This issue allows appliance compromise at boot time.

This issue allows a high-privileged authenticated PAM user to achieve remote command execution on the affected PAM system by uploading a specially crafted upgrade file.

A specific authentication strategy allows learning the ids of PAM users associated with certain authentication types.

The issue allows an unauthenticated attacker to access information in the PAM database.

An improper input validation allows an unauthenticated attacker to alter PAM logs by sending a specially crafted HTTP request. There is no information provided about the estimated number of potentially affected devices worldwide or details about real-world incidents where this issue was exploited.

An improper session validation allows an unauthenticated attacker to cause certain request notifications to be executed in the context of an incorrect user by spoofing the client IP address.

A malicious actor can fix the session of a Symantec Privileged Access Management user by tricking the user into clicking a specially crafted link to the PAM server. This issue is related to cross-site request forgery. The exploitation of this issue may allow a remote attacker to hijack a user's session.

The issue is related to improper input validation in the CSRF filter, which results in unsanitized user input being written to the application logs. No information is provided about the estimated number of potentially affected devices or real-world incidents where this issue was exploited.

The issue occurs when the pgAdmin server HTTP API validates the path a user selects to external PostgreSQL utilities such as pg dump and pg restore. This allows an authenticated user to run arbitrary commands on the server due to insufficient input validation. Approximately 5,294 results are affected, according to ZoomEyeDork.

A vulnerability exists in the way that iTerm2 integrates with tmux's control mode, which may allow an attacker to execute arbitrary commands by providing malicious output to the terminal. This may allow an attacker to execute arbitrary commands on their victim's computer by providing malicious output to the terminal. It could be exploited using command-line utilities that print attacker-controlled content.