PT-2019-15851

Name of the Vulnerable Software and Affected Versions TinyWall versions prior to 2.1.13 Description The issue arises from the unsafe usage of .NET deserialization in Named Pipe message processing, allowing a local attacker to escalate privileges to NT AUTHORITYSYSTEM. Recommendations For versions...

CVE-2019-19470: Deserialization of Untrusted Data

Unsafe usage of .NET deserialization in Named Pipe message processing allows privilege escalation to NT AUTHORITY\SYSTEM for a local attacker. Affected product is TinyWall, all versions up to and including 2.1.12. Fixed in version 2.1.13...

CVE-2019-18297

A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server All versions. An attacker with local access to the MS3000 Server and low privileges could gain root privileges by sending specifically crafted packets to a named pipe. Please note that an attacker needs to have local access...

Design/Logic Flaw

A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server All versions. An attacker with local access to the MS3000 Server and low privileges could gain root privileges by sending specifically crafted packets to a named pipe. Please note that an attacker needs to have local access...

CVE-2019-18297

CVE-2019-18297 affects Siemens SPPA-T3000 MS3000 Migration Server (all versions). An attacker with local access and low privileges can gain root privileges by sending specially crafted packets to a named pipe. The vulnerability requires local access to exploit; no public exploits are noted in the...

PT-2019-15317

Name of the Vulnerable Software and Affected Versions SPPA-T3000 MS3000 Migration Server All versions Description A vulnerability has been identified that allows an attacker with local access to the MS3000 Server and low privileges to gain root privileges by sending specifically crafted packets t...

CVE-2019-18297: Heap-based Buffer Overflow

A vulnerability has been identified in SPPA-T3000 MS3000 Migration Server All versions. An attacker with local access to the MS3000 Server and low privileges could gain root privileges by sending specifically crafted packets to a named pipe. Please note that an attacker needs to have local access...

Siemens SPPA-T3000 MS3000 Migration Server Heap Buffer Overflow Vulnerability (CNVD-2019-45417)

SPPA-T3000 is a distributed control system mainly used in thermal power plants and large-scale renewable energy power plants.MS3000 Migration Server is one of the migration servers. A heap buffer overflow vulnerability exists in the Siemens SPPA-T3000 MS3000 Migration Server. An attacker with loc...

PT-2019-5769

Name of the Vulnerable Software and Affected Versions Samba versions 4.x.x before 4.9.17 Samba versions 4.10.x before 4.10.11 Samba versions 4.11.x before 4.11.3 Description The issue is related to the dnsserver RPC pipe in Samba, which provides administrative facilities to modify DNS records and...

CVE-2019-14861: Incorrect Default Permissions

All Samba versions 4.x.x before 4.9.17, 4.10.x before 4.10.11 and 4.11.x before 4.11.3 have an issue, where the poorly named dnsserver RPC pipe provides administrative facilities to modify DNS records and zones. Samba, when acting as an AD DC, stores DNS records in LDAP. In AD, the default...

[SECURITY] Fedora 31 Update: hunspell-1.7.0-4.fc31

Hunspell is a spell checker and morphological analyzer library and program designed for languages with rich morphology and complex word compounding or character encoding. Hunspell interfaces: Ispell-like terminal interface usi ng Curses library, Ispell pipe interface, LibreOffice UNO module...

CVE-2019-18631

The Windows component of Centrify Authentication and Privilege Elevation Services 3.4.0, 3.4.1, 3.4.2, 3.4.3, 3.5.0, 3.5.1 18.8, 3.5.2 18.11, and 3.6.0 19.6 does not properly handle an unspecified exception during use of partially trusted assemblies to serialize input data, which allows attackers...

CVE-2019-18631

The Windows component of Centrify Authentication and Privilege Elevation Services 3.4.0, 3.4.1, 3.4.2, 3.4.3, 3.5.0, 3.5.1 18.8, 3.5.2 18.11, and 3.6.0 19.6 does not properly handle an unspecified exception during use of partially trusted assemblies to serialize input data, which allows attackers...

CVE-2019-18631: Deserialization of Untrusted Data

The Windows component of Centrify Authentication and Privilege Elevation Services 3.4.0, 3.4.1, 3.4.2, 3.4.3, 3.5.0, 3.5.1 18.8, 3.5.2 18.11, and 3.6.0 19.6 does not properly handle an unspecified exception during use of partially trusted assemblies to serialize input data, which allows attackers...

CVE-2019-9745

CloudCTI HIP Integrator Recognition Configuration Tool allows privilege escalation via its EXQUISE integration. This tool communicates with a service Recognition Update Client Service via an insecure communication channel Named Pipe. The data JSON sent via this channel is used to import data from...

Design/Logic Flaw

CloudCTI HIP Integrator Recognition Configuration Tool allows privilege escalation via its EXQUISE integration. This tool communicates with a service Recognition Update Client Service via an insecure communication channel Named Pipe. The data JSON sent via this channel is used to import data from...

CVE-2019-9745

CloudCTI HIP Integrator Recognition Configuration Tool allows privilege escalation via its EXQUISE integration. This tool communicates with a service Recognition Update Client Service via an insecure communication channel Named Pipe. The data JSON sent via this channel is used to import data from...

CVE-2019-9745

CVE-2019-9745 affects the CloudCTI HIP Integrator Recognition Configuration Tool. The vulnerability arises in the EXQUISE integration: a lower-privileged user can craft the data sent over an insecure Named Pipe (RUCS20151029) to the Recognition Update Client Service (running as NT AUTHORITY\SYSTE...

PT-2019-19837

Name of the Vulnerable Software and Affected Versions CloudCTI HIP Integrator Recognition Configuration Tool affected versions not specified Description The issue concerns a privilege escalation vulnerability. It involves the CloudCTI HIP Integrator Recognition Configuration Tool, which uses an...

CVE-2019-9745: Improper Privilege Management

CloudCTI HIP Integrator Recognition Configuration Tool allows privilege escalation via its EXQUISE integration. This tool communicates with a service Recognition Update Client Service via an insecure communication channel Named Pipe. The data JSON sent via this channel is used to import data from...