CVE-2024-7245

HIGH Year: 2024
CVSS v3 Score
7.0
High
Weakness Type
CWE-732
View all →

Vulnerability Description

Panda Security Dome VPN Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Panda Security Dome. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Hydra Sdk Windows Service. The issue lies in the lack of proper permissions set on a folder created by the service. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-23429.

Related Vulnerabilities

CVE-2017-16933

HIGH
CVSS:7.0(High)

etc/initsystem/prepare-dirs in Icinga 2.x through 2.8.1 has a chown call for a filename in a user-writable directory, which allows local users to gain privileges by leveraging access to the $ICINGA2_U...

CWE-7322017

CVE-2017-18348

HIGH
CVSS:7.0(High)

Splunk Enterprise 6.6.x, when configured to run as root but drop privileges to a specific non-root account, allows local users to gain privileges by leveraging access to that non-root account to modif...

CWE-7322017

CVE-2018-0982

HIGH
CVSS:7.0(High)

An elevation of privilege vulnerability exists in the way that the Windows Kernel API enforces permissions, aka "Windows Elevation of Privilege Vulnerability." This affects Windows Server 2016, Window...

CWE-7322018

CVE-2018-1036

HIGH
CVSS:7.0(High)

An elevation of privilege vulnerability exists when NTFS improperly checks access, aka "NTFS Elevation of Privilege Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Wind...

CWE-7322018

CVE-2018-1141

HIGH
CVSS:7.0(High)

When installing Nessus to a directory outside of the default location, Nessus versions prior to 7.0.3 did not enforce secure permissions for sub-directories. This could allow for local privilege escal...

CWE-7322018

CVE-2018-19374

HIGH
CVSS:7.0(High)

Zoho ManageEngine ADManager Plus 6.6 Build 6657 allows local users to gain privileges (after a reboot) by placing a Trojan horse file into the permissive bin directory.

CWE-7322018