PT-2019-3354

Name of the Vulnerable Software and Affected Versions Windows Remote Desktop Client affected versions not specified Description The issue exists due to insufficient input validation in the Remote Desktop Client of Windows operating systems. This allows a remote attacker to execute arbitrary code...

PT-2019-3353

Name of the Vulnerable Software and Affected Versions Windows Remote Desktop Client affected versions not specified Description The issue exists due to insufficient input validation in the Remote Desktop Client of Windows operating systems. This allows a remote attacker to execute arbitrary code...

PT-2019-3174

Name of the Vulnerable Software and Affected Versions Windows Remote Desktop Client affected versions not specified Description The issue exists due to insufficient input validation in the Remote Desktop Client of Windows operating systems. This allows a remote attacker to execute arbitrary code...

PT-2019-3173

Name of the Vulnerable Software and Affected Versions Windows Remote Desktop Client affected versions not specified Description The issue exists due to insufficient input validation in the Remote Desktop Client of Windows operating systems. This allows a remote attacker to execute arbitrary code...

KLA11552 Multiple vulnerabilities in Microsoft Windows

Multiple vulnerabilities were found in Microsoft Windows. Malicious users can exploit these vulnerabilities to cause denial of service, gain privileges, obtain sensitive information, spoof user interface, execute arbitrary code, bypass security restrictions. Below is a complete list of...

Nextcloud: Clear text storage of proxy parameters and passwords

Proxy settings of the Nextcloud desktop client were not stored in a save way, instead they where just base64 encoded stored in the nextcloud.cfg file...

Nextcloud: XSS in desktop client via invalid server address on login form

Team! I have found this vulnerability that in my time would be called "cross zone" but at the moment I don't know. The problem is found in the latest version of "nextcloud.exe" for your windows version. The problem occurs with the initial screen where you ask to connect to a website. Apparently...

Mail.ru: Code Injection in macOS Desktop Client

DYLD Environment Variables were not disabled In MacOS desktop ICQ client. Disabling DYLD Environment Variables is BCP for MacOS application to prevent code injection vector into local process...

CVE-2018-17170

Grouptime Teamwire Desktop Client 1.5.1 prior to 1.9.0 on Windows allows code injection via a template, leading to remote code execution. All backend versions prior to prod-2018-11-13-15-00-42 are affected...

Code injection

Grouptime Teamwire Desktop Client 1.5.1 prior to 1.9.0 on Windows allows code injection via a template, leading to remote code execution. All backend versions prior to prod-2018-11-13-15-00-42 are affected...

CVE-2018-17170

Grouptime Teamwire Desktop Client 1.5.1 prior to 1.9.0 on Windows allows code injection via a template, leading to remote code execution. All backend versions prior to prod-2018-11-13-15-00-42 are affected...

CVE-2018-17170

Grouptime Teamwire Desktop Client for Windows (version 1.5.1 before 1.9.0) is affected by a template-based code injection vulnerability that can lead to remote code execution. The issue affects all backend versions prior to prod-2018-11-13-15-00-42. Exploitation details are not provided in the su...

PT-2019-9403

Name of the Vulnerable Software and Affected Versions Grouptime Teamwire Desktop Client versions 1.5.1 through 1.9.0 Grouptime Teamwire backend versions prior to prod-2018-11-13-15-00-42 Description The issue allows code injection via a template, leading to remote code execution. Recommendations...

CVE-2018-17170: Improper Control of Generation of Code

Grouptime Teamwire Desktop Client 1.5.1 prior to 1.9.0 on Windows allows code injection via a template, leading to remote code execution. All backend versions prior to prod-2018-11-13-15-00-42 are affected...

CVE-2019-9486

STRATO HiDrive Desktop Client 5.0.1.0 for Windows suffers from a SYSTEM privilege escalation vulnerability through the HiDriveMaintenanceService service. This service establishes a NetNamedPipe endpoint that allows applications to connect and call publicly exposed methods. An attacker can inject...

Privilege escalation

STRATO HiDrive Desktop Client 5.0.1.0 for Windows suffers from a SYSTEM privilege escalation vulnerability through the HiDriveMaintenanceService service. This service establishes a NetNamedPipe endpoint that allows applications to connect and call publicly exposed methods. An attacker can inject...

CVE-2019-9486

STRATO HiDrive Desktop Client 5.0.1.0 for Windows is affected by a SYSTEM privilege-escalation vulnerability via the HiDriveMaintenanceService, which exposes a NetNamedPipe endpoint and allows code injection through insecure interprocess communication. The issue also affects Telekom MagentaCLOUD ...

PT-2019-19679

Name of the Vulnerable Software and Affected Versions STRATO HiDrive Desktop Client versions 5.0.1.0 Telekom MagentaCLOUD versions through 5.7.0.0 1&1 Online Storage versions through 6.1.0.0 Description The issue concerns a SYSTEM privilege escalation through the HiDriveMaintenanceService service...

CVE-2019-9486: Time-of-check Time-of-use (TOCTOU) Race Condition

STRATO HiDrive Desktop Client 5.0.1.0 for Windows suffers from a SYSTEM privilege escalation vulnerability through the HiDriveMaintenanceService service. This service establishes a NetNamedPipe endpoint that allows applications to connect and call publicly exposed methods. An attacker can inject...

The vulnerability of the seamless_process function in the RDP-client rdesktop library, related to integer overflow, allows an attacker to execute arbitrary code by causing a stack-based buffer overflow.

The vulnerability of the seamlessprocess function in the RDP client rdesktop is related to a numerical overflow that causes a buffer overflow based on a queue. Exploiting this vulnerability allows an attacker operating remotely to execute arbitrary code...