CVE-2022-3699

A privilege escalation vulnerability was reported in the Lenovo HardwareScanPlugin prior to version 1.3.1.2 and Lenovo Diagnostics prior to version 4.45 that could allow a local user to execute code with elevated privileges...

CVE-2023-3699

creationtimestamp| type| source ---|---|--- 2023-08-22 22:25:07+00:00| seen| https://t.me/cibsecurity/69006 2024-01-03 20:33:04+00:00| seen| https://t.me/arpsyndicate/2355...

CVE-2023-3699 An Improper Privilege Management vulnerability was found on the ADM

An Improper Privilege Management vulnerability was found in ASUSTOR Data Master ADM allows an unprivileged local users to modify the storage devices configuration. Affected products and versions include: ADM 4.0.6.RIS1, 4.1.0 and below as well as ADM 4.2.2.RI61 and below...

CVE-2023-3699

CVE-2023-3699 affects ASUSTOR Data Master (ADM) on ASUSTOR NAS. The issue is an improper privilege management that allows an unprivileged local user to modify the storage devices configuration. Affected ADM versions: 4.0.6.RIS1 and below; 4.1.0 and below; 4.2.2.RI61 and below. Impact is the abili...

CVE-2023-3699 An Improper Privilege Management vulnerability was found on the ADM

An Improper Privilege Management vulnerability was found in ASUSTOR Data Master ADM allows an unprivileged local users to modify the storage devices configuration. Affected products and versions include: ADM 4.0.6.RIS1, 4.1.0 and below as well as ADM 4.2.2.RI61 and below...

SUSE CVE-2008-3699

The MagnatuneBrowser::listDownloadComplete function in magnatunebrowser/magnatunebrowser.cpp in Amarok before 1.4.10 allows local users to overwrite arbitrary files via a symlink attack on the albuminfo.xml temporary file...

Metasploit Weekly Wrap-Up

Taking a stroll down memory lane Tomcat Init Script Privilege Escalation Do you remember the issue with Tomcat init script that was originally discovered by Dawid Golunski back in 2016 that led to privilege escalation? This week's Metasploit release includes an exploit module for CVE-2016-1240 by...

Lenovo Diagnostics Driver Memory Access

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Lenovo Diagnostics Driver IOCTL memmove', 'Description' = %q Incorrect access control for the Lenovo Diagnostics Driver allows a low-privileged...

Lenovo Diagnostics Driver Memory Access Exploit

This Metasploit module demonstrates how an incorrect access control for the Lenovo Diagnostics Driver allows a low-privileged user the ability to issue device IOCTLs to perform arbitrary physical/virtual memory reads and writes. This module requires Metasploit: https://metasploit.com/download...

CVE-2022-3699

creationtimestamp| type| source ---|---|--- 2022-11-09 18:17:38+00:00| seen| https://t.me/proxybar/1159 2022-11-09 21:34:51+00:00| published-proof-of-concept| https://t.me/breachdetector/139197 2022-11-10 20:37:43+00:00| published-proof-of-concept| https://t.me/CyberSecurityTechnologies/7141...

Lenovo Diagnostics Driver IOCTL memmove

Incorrect access control for the Lenovo Diagnostics Driver allows a low-privileged user the ability to issue device IOCTLs to perform arbitrary physical/virtual memory read/write. Module Options msf use exploit/windows/local/cve/20223699lenovodiagnosticsdriver msf...

Oracle Linux 8 : .NET / Core / 3.1 (ELSA-2020-3699)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2020-3699 advisory. 3.1.108-2.0.1.el82 - Update patch to support 8.2 [email protected] - support OL release scheme [email protected] 3.1.108-2 - Rebuild t...

RHEL 8 : .NET Core 3.1 (RHSA-2020:3699)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2020:3699 advisory. .NET Core is a managed-software framework. It implements a subset of the .NET framework APIs and several new APIs, and it includes a CLR...

CVE-2020-3699

Possible out of bound access while processing assoc response from host due to improper length check before copying into buffer in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon...

CVE-2020-3699

CVE-2020-3699 affects Qualcomm/Snapdragon components (e.g., Snapdragon Auto, Compute, Electronics Connectivity, IOT, Wearables; various Qualcomm/QCS/SXR devices) with a root cause of an out-of-bounds access due to an improper length check when processing an assoc response. The vulnerability is de...

CVE-2020-3699

Possible out of bound access while processing assoc response from host due to improper length check before copying into buffer in Snapdragon Auto, Snapdragon Compute, Snapdragon Consumer Electronics Connectivity, Snapdragon Consumer IOT, Snapdragon Industrial IOT, Snapdragon Mobile, Snapdragon...

CVE-2019-3699

UNIX Symbolic Link Symlink Following vulnerability in the packaging of privoxy on openSUSE Leap 15.1, Factory allows local attackers to escalate from user privoxy to root. This issue affects: openSUSE Leap 15.1 privoxy version 3.0.28-lp151.1.1 and prior versions. openSUSE Factory privoxy version...

CVE-2019-3699 Local privilege escalation from user privoxy to root

UNIX Symbolic Link Symlink Following vulnerability in the packaging of privoxy on openSUSE Leap 15.1, Factory allows local attackers to escalate from user privoxy to root. This issue affects: openSUSE Leap 15.1 privoxy version 3.0.28-lp151.1.1 and prior versions. openSUSE Factory privoxy version...

CVE-2019-3699

CVE-2019-3699 is a local privilege escalation in privoxy packaging on openSUSE Leap 15.1 and openSUSE Factory. The issue arises from UNIX Symbolic Link (symlink) handling during packaging, allowing a non-privileged user (privoxy) to escalate to root. Affected versions include openSUSE Leap 15.1 p...

CVE-2014-3699

CVE-2014-3699 affects the Linux configuration/update tool eDeploy . The vulnerability is a deserialization flaw: untrusted data deserialized via Python’s cPickle , leading to remote code execution. Public references in the documents consistently describe an RCE impact without detailing specific e...