Salt Bugs Allow Full RCE as Root on Cloud Servers

The open-source Salt management framework contains high-severity security vulnerabilities that allow full remote code execution as root on servers in data centers and cloud environments. And in-the-wild attacks are expected imminently. According to F-Secure researchers, the framework, authored by...

Intel Binary Configuration Tool Code Issue Vulnerability

Intel Binary Configuration Tool is an Intel utility program for changing configuration settings embedded in Intel FSP Firmware Support Package binaries. A security vulnerability exists in the installer in the Intel Binary Configuration Tool for Windows-based platforms. The vulnerability can be...

CVE-2020-0598

Uncontrolled search path in the installer for the IntelR Binary Configuration Tool for Windows, all versions, may allow an authenticated user to potentially enable escalation of privilege via local access...

CVE-2020-0598

The CVE-2020-0598 entry concerns the Intel Binary Configuration Tool for Windows. The issue is an Uncontrolled search path in the installer across all versions, which may allow an authenticated user to escalate privileges via local access. This is supported by the Intel advisory (Intel‑SA‑00359),...

Intel® Binary Configuration Tool for Windows* Advisory

Summary: A potential security vulnerability in the Intel® Binary Configuration Tool for Windows may allow escalation of privilege. Intel is not releasing updates to mitigate this potential vulnerability and has issued a Product Discontinuation Notice for the Intel® Binary Configuration Tool for...

rConfig Network Device Configuration Tool Command Injection (CVE-2019-19509)

A command injection vulnerability exists in rConfig Network Device Configuration Tool. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...

CVE-2020-9044

XXE vulnerability exists in the Metasys family of product Web Services which has the potential to facilitate DoS attacks or harvesting of ASCII server files. This affects Johnson Controls' Metasys Application and Data Server ADS, ADS-Lite versions 10.1 and prior; Metasys Extended Application and...

CVE-2020-7251

Improper access control vulnerability in Configuration Tool in McAfee Mcafee Endpoint Security ENS Prior to 10.6.1 February 2020 Update allows local users to disable security features via unauthorised use of the configuration tool from older versions of ENS...

Improper access control

Improper access control vulnerability in Configuration Tool in McAfee Mcafee Endpoint Security ENS Prior to 10.6.1 February 2020 Update allows local users to disable security features via unauthorised use of the configuration tool from older versions of ENS...

CVE-2020-7251 ESConfig Tool able to edit configuration for newer version

Improper access control vulnerability in Configuration Tool in McAfee Mcafee Endpoint Security ENS Prior to 10.6.1 February 2020 Update allows local users to disable security features via unauthorised use of the configuration tool from older versions of ENS...

CVE-2020-7251

The CVE-2020-7251 issue affects McAfee Endpoint Security (ENS) for Windows specifically its Configuration Tool. The root cause is improper access control in the Configuration Tool prior to ENS 10.6.1 (February 2020 Update), enabling local users to disable security features via unauthorized use of...

User Name and Password Fields are Missing when Configuring a Newly Installed License Server

The License Server Configuration Tool Window does not have the option to enter the username and password for License Administration Console, after the License Server 11.10 is installed. Background Aftersuccessfully installing License Server 11.10, a License Server Configuration Window appears. Th...

eDeploy Code Issue Vulnerability

eDeploy is a configuration and update tool for Linux systems. A security vulnerability exists in eDeploy. An attacker could exploit the vulnerability to execute code...

eDeploy Competitive Conditions Issue Vulnerability

eDeploy is a configuration and update tool for Linux systems. A Competing Conditions Issue vulnerability exists in eDeploy, which arises from improper handling of concurrent access when concurrent code requires mutually exclusive access to shared resources during operation of a networked system o...

McAfee Endpoint Security for Windows 10.5.x < 10.5.5 October 2019 Update / 10.6.x < 10.6.1 February 2020 Update / 10.7.x < 10.7.0 February 2020 Update Multiple Vulnerabilities (SB10299)

The version of the McAfee Endpoint Security ENS for Windows installed on the remote Windows host is 10.5.x prior to 10.5.5 October 2019 Update, 10.6.x prior to 10.6.1 February 2020 Update, or 10.7.x prior to 10.7.0 February 2020 Update. It is, therefore, affected by multiple vulnerabilities: - Co...

CVE-2019-9745

CloudCTI HIP Integrator Recognition Configuration Tool allows privilege escalation via its EXQUISE integration. This tool communicates with a service Recognition Update Client Service via an insecure communication channel Named Pipe. The data JSON sent via this channel is used to import data from...

CVE-2019-9745

CVE-2019-9745 affects the CloudCTI HIP Integrator Recognition Configuration Tool. The vulnerability arises in the EXQUISE integration: a lower-privileged user can craft the data sent over an insecure Named Pipe (RUCS20151029) to the Recognition Update Client Service (running as NT AUTHORITY\SYSTE...

Exploit for Improper Privilege Management in Cloudcti Hip_Integrator_Recognition_Configuration_Tool

Author: Arn Vollebregt Introduction Creativity is at the c...

Siemens Industrial Products Local Privilege Escalation Vulnerability (Update I)

1. EXECUTIVE SUMMARY CVSS v3 6.4 ATTENTION: Exploitable locally Vendor: Siemens Equipment: Industrial Products Vulnerability: Improper privilege management 2. UPDATE INFORMATION This updated advisory is a follow-up to the updated advisory titled ICSA-16-313-02 Siemens Industrial Products Local...

McAfee Endpoint Security Configuration tool Access Control Error Vulnerability

McAfee Endpoint Security ENS is the United States McAfee McAfee company's set of intelligent collaboration and advanced threat defense framework. The framework supports the entire threat defense lifecycle of real-time communications control and actionable threat forensics , etc. Configuration too...