CVE-2019-13356

In Total Defense Anti-virus 9.0.0.773, insecure access control for the directory %PROGRAMDATA%\TotalDefense\Consumer\ISS\9\bd\TDUpdate2\ used by AMRT.exe allows local attackers to hijack bdcore.dll, which leads to privilege escalation when the AMRT service loads the DLL...

CVE-2019-13356

In Total Defense Anti-virus 9.0.0.773, an insecure access-control issue in the directory %PROGRAMDATA%\TotalDefense\Consumer\ISS\9\bd\TDUpdate2\ used by AMRT.exe allows a local attacker to hijack bdcore.dll and escalate privileges when the AMRT service loads the DLL. The core issue is improper ac...

CVE-2019-13357

In Total Defense Anti-virus 9.0.0.773, resource acquisition from the untrusted search path C:\ used by caschelp.exe allows local attackers to hijack ccGUIFrm.dll, which leads to code execution. SYSTEM-level code execution can be achieved when the ccSchedulerSVC service runs the affected executabl...

CVE-2019-13357

Total Defense Anti-virus 9.0.0.773 is affected. The issue arises from resource acquisition from an untrusted search path (C:) used by caschelp.exe, allowing hijacking of ccGUIFrm.dll and resulting in code execution. SYSTEM-level code execution is possible when the ccSchedulerSVC service runs the ...

Trusted Path Elevation of Privilege Vulnerability in Micropoint Baihui Intelligent Defense Software Enterprise Edition

Micropoint Baihui Intelligent Defense Software Enterprise Edition is a new generation of network antivirus products developed by Micropoint Baihui for enterprise network virus protection and management characteristics. The enterprise version of Micropoint Intelligent Defense Software has a truste...

U.S. Dept Of Defense: Unauthenticated arbitrary file upload on the https://█████/ (█████.mil)

The vulnerability involved an unauthenticated arbitrary file upload on the https://█████/ █████.mil website. An unsafe upload endpoint at https://██████/upload.php was identified, where a test file was successfully uploaded. The uploaded file could be accessed at the internal path...

U.S. Dept Of Defense: Unauthenticated arbitrary file upload on the https://█████/ (█████████)

The vulnerability involves an unauthenticated arbitrary file upload on the https://█████/ █████████ website. A test file was successfully uploaded to the /upload.php endpoint, and the uploaded file was accessible at the /delete.me path. This vulnerability could have led to consequences such as...

Elevation of Privilege Vulnerability in Micropoint Baihui Intelligent Defense Software Personal Edition

Micropoint Baihui Beijing Information Security Technology Co., Ltd. is mainly engaged in the research, development, production and sales of network information security products. There is an elevation of privilege vulnerability in the Personal Edition of Micropoint Baihui Intelligent Defense...

U.S. Dept Of Defense: [CVE-2018-0296] Cisco VPN path traversal on the https://████████/ (█████████.mil)

The Cisco VPN vulnerability CVE-2018-0296 was discovered in an instance of https://████/ ██████.mil. The vulnerability allowed for path traversal, which could have been used to disclose sensitive information such as VPN sessions and files. The issue was addressed by updating to a patched version ...

U.S. Dept Of Defense: Arbitrary File Reading leads to RCE in the Pulse Secure SSL VPN on the https://██████ (███)

The Pulse Secure SSL VPN was found to be vulnerable to multiple issues, including pre-authentication arbitrary file reading CVE-2019-11510 and post-authentication command injection CVE-2019-11539. These vulnerabilities were discovered and disclosed by security researcher Orange Tsai. The...

U.S. Dept Of Defense: [CVE-2018-0296] Cisco VPN path traversal on the https://████████/ (no hostname)

The Cisco VPN was vulnerable to a path traversal vulnerability CVE-2018-0296 that allowed an unauthenticated attacker to disclose sensitive information such as VPN sessions and user files...

U.S. Dept Of Defense: [CVE-2018-0296] Cisco VPN path traversal on the https://███████/ (██████)

The Cisco VPN was found to be vulnerable to a path traversal vulnerability CVE-2018-0296. The vulnerability allowed an unauthenticated attacker to access sensitive information such as VPN sessions and files...

U.S. Dept Of Defense: [CVE-2018-0296] Cisco VPN path traversal on the https://███████/ (████.███.mil)

The CVE-2018-0296 vulnerability was discovered in a Cisco VPN system. It allowed an unauthenticated attacker to perform path traversal and disclose sensitive information such as VPN sessions and user files. The issue was addressed by updating to a patched version that returned a 404 "File not...

U.S. Dept Of Defense: Arbitrary File Reading leads to RCE in the Pulse Secure SSL VPN on the https://████

Description Hello. Some time ago, researcher Orange Tsai from DEVCORE team had a talk on Defcon/BlackHat regarding Pulse Secure SSL VPN vulnerabilities fixed on 2019/4/25: CVE-2019-11510 - Pre-auth Arbitrary File Reading CVE-2019-11542 - Post-auth Stack Buffer Overflow CVE-2019-11539 - Post-auth...

U.S. Dept Of Defense: [CVE-2018-0296] Cisco VPN path traversal on the https://██████████

The Cisco VPN vulnerability CVE-2018-0296 was discovered in a previously unidentified instance in the DOD network. The vulnerability allowed path traversal, which could have been exploited to disclose sensitive information such as VPN sessions and files. The issue was addressed by updating to a...

U.S. Dept Of Defense: [CVE-2018-0296] Cisco VPN path traversal on the https://1████████ (https://████████.███.████████/)

The Cisco VPN vulnerability CVE-2018-0296 was discovered, which allowed an unauthenticated attacker to perform path traversal and disclose sensitive information such as VPN sessions and files. The issue was addressed by updating to a patched version, which returned a 404 "File not found" error...

The vulnerability of the component responsible for checking the protocols of Microprogrammable Network Interface Cards from Cisco Firepower Threat Defense allows attackers to circumvent existing access control policies.

The vulnerability of the component responsible for processing SSL/TLS messages in Cisco Firepower Threat Defense microprogramming systems arises from errors in their processing of these messages. Exploiting this vulnerability allows a malicious actor to bypass existing access control policies by...

The vulnerability of the application configuration mechanism of Cisco Firepower Threat Defense software allows attackers to gain access to protected information.

The vulnerability of the application configuration mechanism of Cisco Firepower Threat Defense microprogramming network interfaces arises due to errors in application identification. Exploiting this vulnerability can allow a malicious actor, operating remotely, to gain access to protected...

U.S. Dept Of Defense: PII leakage due to scrceenshot of health records

Summary: Document shows a screenshot of a medical record for a soldier Description: One of the slides describes the CIV and PAD DSN along with some information relating to the soldier such as their name, the information appears to be old but could be still be an issue if they're in service Impact...

3S-Smart Software Solutions GmbH CODESYS Control V3 Online User Management

1. EXECUTIVE SUMMARY CVSS v3 8.8 ATTENTION: Exploitable remotely/low skill level to exploit Vendor: 3S-Smart Software Solutions GmbH Equipment: CODESYS Control V3 online user management Vulnerability: Incorrect Permission Assignment for Critical Resource 2. RISK EVALUATION Successful exploitation...