8 matches found
CVE-2019-9745
作者：Arn Vollebregt 引言 创造力是渗透测试的核心，这也让我们的工作充满趣味。然而，一个常见的陷阱是倾向于“过度设计”攻击场景，并只专注于 bug（错误条件）。而 flaws（非预期行为）同样可能存在，并带来同等严重的破坏性后果。本文通过一个案例研究来证明针对此类 flaws 进行渗透测试的重要性，同时也为采用 SDLC（安全开发生命周期）流程提供了有力论据。 本文是漏洞 CVE-2019-9745 的 负责任披露（RD）工作的一部分，并与厂商 CloudCTI 密切合作撰写。文章首先对漏洞进行高层概览，再深入技术细节。在演示漏洞利用之后，给出结论并总结了经验教训。 概要...
EUVD-2019-19108
Malware in sbrugna...
CVE-2019-9745
CloudCTI HIP Integrator Recognition Configuration Tool allows privilege escalation via its EXQUISE integration. This tool communicates with a service Recognition Update Client Service via an insecure communication channel Named Pipe. The data JSON sent via this channel is used to import data from...
CloudCTI HIP Integrator Recognition Configuration Tool Elevation of Privilege Vulnerability
CloudCTI HIP Integrator Recognition Configuration Tool is an integrator recognition configuration tool from CloudCTI, Netherlands. A security vulnerability exists in the CloudCTI HIP Integrator Recognition Configuration Tool that originates from an elevated privilege process that can execute...
CVE-2019-9745
CloudCTI HIP Integrator Recognition Configuration Tool allows privilege escalation via its EXQUISE integration. This tool communicates with a service Recognition Update Client Service via an insecure communication channel Named Pipe. The data JSON sent via this channel is used to import data from...
CVE-2019-9745
CVE-2019-9745 affects the CloudCTI HIP Integrator Recognition Configuration Tool. The vulnerability arises in the EXQUISE integration: a lower-privileged user can craft the data sent over an insecure Named Pipe (RUCS20151029) to the Recognition Update Client Service (running as NT AUTHORITY\SYSTE...
CVE-2019-9745
CloudCTI HIP Integrator Recognition Configuration Tool allows privilege escalation via its EXQUISE integration. This tool communicates with a service Recognition Update Client Service via an insecure communication channel Named Pipe. The data JSON sent via this channel is used to import data from...
