Author: Cyberthreat Blog

Synology Photo Station before 6.3-2958 allows local users to gain privileges by leveraging setuid execution of a “synophoto_dsm_user –copy-no-ea” command.

Privilege escalation in Lenovo Customer Care Software Development Kit (CCSDK) versions earlier than 2.0.16.3 allows local users to execute code with elevated privileges.

Remote code execution in Lenovo Updates (not Lenovo System Update) allows man-in-the-middle attackers to execute arbitrary code.

SolarWinds Log & Event Manager (LEM) before 6.3.1 Hotfix 4 allows an authenticated user to browse the server’s filesystem and read the contents of arbitrary files contained within.

SolarWinds Log & Event Manager (LEM) before 6.3.1 Hotfix 4 allows an authenticated user to execute arbitrary commands.