blogresponder

3 exploits Active since Jan 2017
CVE-2016-9795 NOMISEC HIGH WRITEUP
Broadcom CA Workload Automation AE - Improper Input Validation
The casrvc program in CA Common Services, as used in CA Client Automation 12.8, 12.9, and 14.0; CA SystemEDGE 5.8.2 and 5.9; CA Systems Performance for Infrastructure Managers 12.8 and 12.9; CA Universal Job Management Agent 11.2; CA Virtual Assurance for Infrastructure Managers 12.8 and 12.9; CA Workload Automation AE 11, 11.3, 11.3.5, and 11.3.6 on AIX, HP-UX, Linux, and Solaris allows local users to modify arbitrary files and consequently gain root privileges via vectors related to insufficient validation.
CVSS 7.8
CVE-2019-17043 WRITEUP HIGH WORKING POC
BMC Patrol Agent 9.0.10i - Privilege Escalation via Weak SUID Binary Permissions
An issue was discovered in BMC Patrol Agent 9.0.10i. Weak execution permissions on the best1collect.exe SUID binary could allow an attacker to elevate his/her privileges to the ones of the "patrol" user by specially crafting a shared library .so file that will be loaded during execution.
CVSS 7.8
CVE-2019-17044 WRITEUP HIGH WORKING POC
BMC Patrol Agent 9.0.10i - Local Privilege Escalation via SUID Binary Shared Library Injection
An issue was discovered in BMC Patrol Agent 9.0.10i. Weak execution permissions on the PatrolAgent SUID binary could allow an attacker with "patrol" privileges to elevate his/her privileges to the ones of the "root" user by specially crafting a shared library .so file that will be loaded during execution.
CVSS 7.8