Microsoft Windows CVE-2015-1644 Remote Privilege Escalation Vulnerability

Description Microsoft Windows is prone to a remote privilege-escalation vulnerability. An attacker can exploit this issue to gain admin privileges on a targeted system. Technologies Affected Avaya CallPilot 4.0 Avaya CallPilot 4.0.1 Avaya CallPilot 5.0 Avaya CallPilot 5.0.1 Avaya CallPilot 5.1.0...

DosDevices Impersonation Process Creation Elevation of Privilege

The fix for CVE-2015-1644 doesn’t take into account process creation scenarios. If a process is created by a system service while impersonating another user their per-user drive mappings will still be used which could lead to EoP. Recent assessments: busterb at May 09, 2019 5:57pm UTC reported: N...

Microsoft Windows MS-DOS Device Name Elevation of Privilege (MS15-038; CVE-2015-1644)

An elevation of privilege vulnerability exists in Microsoft Windows. The vulnerability is caused when Microsoft Windows fails to properly validate and enforce impersonation levels. A remote attacker can exploit this issue by logging on to the system and running a specially crafted application...

Symantec LiveUpdate Administrator Security Bypass (CVE-2014-1644)

A security policy bypass vulnerability exists in Symantec LiveUpdate Administrator. The vulnerability is due to a failure to validate temporary passwords when processing a user account password reset. A remote unauthenticated attacker could exploit this vulnerability by sending a malicious reques...

SEC Consult SA-20140328-0 :: Multiple vulnerabilities in Symantec LiveUpdate Administrator

SEC Consult Vulnerability Lab Security Advisory 20140328-0 ======================================================================= title: Multiple critical vulnerabilities product: Symantec LiveUpdate Administrator vulnerable version: = 2.3.2.99 fixed version: 2.3.2.110 impact: critical CVE numbe...

Symantec LiveUpdate Administrator未授权访问漏洞

Bugtraq ID:66399 CVE ID:CVE-2014-1644 Symantec LiveUpdate Administrator是一款Symantec产品升级管理程序。 Symantec LiveUpdate Administrator管理GUI对登录/密码功能提供不正确的保护，允许攻击者在知道目标用户email地址的情况下，利用重置密码功能重置用户密码，未授权进行访问。 0 Symantec LiveUpdate Administrator 2.x Symantec LiveUpdate Administrator 2.3.2.110已经修复该漏洞，建议用户下载更新：...

CVE-2014-1644

CVE-2014-1644 affects Symantec LiveUpdate Administrator (LUA) 2.x pre-2.3.2.110. The root cause is a flawed forgotten-password flow in the management GUI (/lua/forcepasswd.do) that allows unauthenticated password resets when the attacker knows the target email address, enabling potential full acc...

CVE-2013-4824

Unspecified vulnerability in HP Intelligent Management Center iMC and HP IMC Service Operation Management Software Module allows remote attackers to bypass authentication via unknown vectors, aka ZDI-CAN-1644...

Ubuntu Update for linux USN-1644-1

Ubuntu Update for Linux kernel vulnerabilities USN-1644-1 OpenVAS Vulnerability Test $Id: gbubuntuUSN16441.nasl 7960 2017-12-01 06:58:16Z santu $ Ubuntu Update for linux USN-1644-1 Authors: System Generated Check Copyright: Copyright c 2012 Greenbone Networks GmbH, http://www.greenbone.net This...

CVE-2012-1644

The CVE-2012-1644 entry concerns the Drupal Organic Groups (OG) Vocabulary module. Affected component: OG Vocab 6.x-1.x before 6.x-1.2. Root cause: the module does not sufficiently enforce access controls on vocabularies, allowing remote authenticated users with certain administrator permissions ...

Debian Security Advisory DSA 2384-1 (cacti)

The remote host is missing an update to cacti announced via advisory DSA 2384-1. OpenVAS Vulnerability Test $Id: deb23841.nasl 6612 2017-07-07 12:08:03Z cfischer $ Description: Auto-generated from advisory DSA 2384-1 cacti Authors: Thomas Reinke Copyright: Copyright c 2012 E-Soft Inc...

[SECURITY] [DSA 2384-1] cacti security update

------------------------------------------------------------------------- Debian Security Advisory DSA-2384-1 [email protected] http://www.debian.org/security/ Luk Claes January 09, 2012 http://www.debian.org/security/faq -...

[SECURITY] [DSA 2384-1] cacti security update

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2384-1 [email protected] http://www.debian.org/security/ Luk Claes January 09, 2012 http://www.debian.org/security/faq -...

CVE-2010-1644

CVE-2010-1644 corresponds to multiple XSS vulnerabilities in Cacti prior to 0.8.7f (affecting host.php parameters: hostname, description; and data_sources.php host_id). The exposed product is Cacti, used in HPC solutions and other deployments. Impact is remote script/HTML injection leading to ses...

Cacti < 0.8.7f Multiple Input Validation Vulnerabilities

According to its self-reported version number, the Cacti application running on the remote web server is prior to version 0.8.7f. It is, therefore, potentially affected by the following vulnerabilities : - A vulnerability exists in 'templatesexport.php' due to improper validation of input to the...

Sorinara Streaming Audio Player Stack Overflow Vulnerability

Sorinara Streaming Audio Player is prone to a stack overflow vulnerability. SPDX-FileCopyrightText: 2009 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2009-1644

Sorinara Streaming Audio Player 0.9 is affected by a stack-based overflow in a crafted .pla file, enabling remote arbitrary-code execution. The vulnerability is triggered via specially crafted input, with a CVSSv2 base score of 9.3 (HIGH) and a network attack vector, no authentication required, a...

CVE-2009-1644

creationtimestamp| type| source ---|---|--- 2009-05-07 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/8640 2009-05-07 00:00:00+00:00| confirmed| https://www.exploit-db.com/exploits/8625...

Debian DSA-1644-1 : mplayer - integer overflow

Felipe Andres Manzano discovered that mplayer, a multimedia player, is vulnerable to several integer overflows in the Real video stream demuxing code. These flaws could allow an attacker to cause a denial of service a crash or potentially execution of arbitrary code by supplying a maliciously...

CVE-2007-1644

The CVE-2007-1644 entry concerns the dynamic DNS update mechanism in the Microsoft Windows DNS Server. The issue is that the DNS server’s dynamic update process does not properly authenticate clients in certain deployments/configurations, enabling a remote attacker to modify DNS records for a web...