SA-2023-07-26-CVE-2023-28129

SECURITY ADVISORY 07-26-2023 Product Affected: Ivanti Desktop and Server Management A vulnerability was recently discovered in DSM 2022.1 Service Update 1. This vulnerability is remediated in DSM 2022.2 Service Update 3. Vulnerability Information CVE | CVSS | Summary | Product Affected...

UI Desktop 安全漏洞

UI Desktop is a desktop management software from the UI community. A security vulnerability exists in UI Desktop versions prior to 0.62.3, which stems from a local boost vulnerability that can be exploited by an attacker to submit arbitrary commands as SYSTEM...

Cross-site Scripting Vulnerability in JP1/IT Desktop Management 2

Overview A Cross-site Scripting vulnerability was found in JP1/IT Desktop Management 2. Impact Regarding the impact of the vulnerability, please refer to the vendor advisory. Solution Please refer to the 'Vendor Information' section for the official countermeasure and take appropriate action...

ZOHO ManageEngine Desktop Central Licensing Issue Vulnerability

ZOHO ManageEngine Desktop Central DC is a desktop management solution from ZOHO, Inc. The solution includes software distribution, patch management, system configuration, remote control and other functional modules to support the entire lifecycle of desktop and server management...

ZOHO ManageEngine Desktop Centra Remote Code Execution Vulnerability

ZOHO ManageEngine Desktop Central DC is a desktop management solution from ZOHO, Inc. The solution includes software distribution, patch management, system configuration, remote control, and other functional modules to support the entire lifecycle of desktop and server management. properly...

US Cyber Command Links 'MuddyWater' Hacking Group to Iranian Intelligence

The U.S. Cyber Command USCYBERCOM on Wednesday officially confirmed MuddyWater's ties to the Iranian intelligence apparatus, while simultaneously detailing the various tools and tactics adopted by the espionage actor to burrow into victim networks. "MuddyWater has been seen using a variety of...

Quest KACE Desktop Authority Deserialized Code Execution Vulnerability

Quest KACE Desktop Authority is a desktop management software from Quest, Inc. A deserialized code execution vulnerability exists in Quest KACE Desktop Authority, which can be exploited by remote attackers to submit ad hoc requests that can execute arbitrary code in the application context...

Quest KACE Desktop Authority Cross-Site Scripting Vulnerability

Quest KACE Desktop Authority is a desktop management software from Quest, Inc. A cross-site scripting vulnerability exists in Quest KACE Desktop Authority, which can be exploited by remote attackers to submit special requests that can cause untrusted HTML to reach jQuery's jQuery. htmlPrefilter...

Quest KACE Desktop Authority Code Issue Vulnerability

Quest KACE Desktop Authority is a desktop management software from Quest Inc. A code issue vulnerability exists in Quest KACE Desktop Authority, which can be exploited by attackers to remotely execute code...

Quest KACE Desktop Authority 代码问题漏洞

Quest KACE Desktop Authority is a desktop management software from Quest Inc. A code issue vulnerability exists in Quest KACE Desktop Authority, which can be exploited by attackers to remotely execute code...

CVE-2021-29644

Hitachi JP1/IT Desktop Management 2 Agent 9 through 12 contains a remote code execution vulnerability because of an Integer Overflow. An attacker with network access to port 31016 may exploit this issue to execute code with unrestricted privileges on the underlying OS...

CVE-2021-29645

Hitachi JP1/IT Desktop Management 2 Agent 9 through 12 calls the SendMessageTimeoutW API with arbitrary arguments via a local pipe, leading to a local privilege escalation vulnerability. An attacker who exploits this issue could execute arbitrary code on the local system...

CVE-2021-29644

Hitachi JP1/IT Desktop Management 2 Agent 9 through 12 contains a remote code execution vulnerability because of an Integer Overflow. An attacker with network access to port 31016 may exploit this issue to execute code with unrestricted privileges on the underlying OS...

CVE-2021-29645

Hitachi JP1/IT Desktop Management 2 Agent 9 through 12 calls the SendMessageTimeoutW API with arbitrary arguments via a local pipe, leading to a local privilege escalation vulnerability. An attacker who exploits this issue could execute arbitrary code on the local system...

Privilege escalation

Hitachi JP1/IT Desktop Management 2 Agent 9 through 12 calls the SendMessageTimeoutW API with arbitrary arguments via a local pipe, leading to a local privilege escalation vulnerability. An attacker who exploits this issue could execute arbitrary code on the local system...

CVE-2021-29645

Hitachi JP1/IT Desktop Management 2 Agent 9–12 is affected. The issue arises from the SendMessageTimeoutW API being invoked with arbitrary arguments via a local pipe, enabling local privilege escalation and potential arbitrary code execution on the host. The CVE entry documents a local attack vec...

CVE-2021-29645

Hitachi JP1/IT Desktop Management 2 Agent 9 through 12 calls the SendMessageTimeoutW API with arbitrary arguments via a local pipe, leading to a local privilege escalation vulnerability. An attacker who exploits this issue could execute arbitrary code on the local system...

CVE-2021-29644

Hitachi JP1/IT Desktop Management 2 Agent 9 through 12 contains a remote code execution vulnerability because of an Integer Overflow. An attacker with network access to port 31016 may exploit this issue to execute code with unrestricted privileges on the underlying OS...

CVE-2021-29644

CVE-2021-29644 affects Hitachi JP1/IT Desktop Management 2 Agent 9–12. The vulnerability is a remote code execution caused by an Integer Overflow in the agent, exploitable by an attacker who can reach network port 31016, potentially gaining unrestricted privileges on the OS. Connected sources (Re...

CVE-2021-29645: Undefined Security Weakness

Hitachi JP1/IT Desktop Management 2 Agent 9 through 12 calls the SendMessageTimeoutW API with arbitrary arguments via a local pipe, leading to a local privilege escalation vulnerability. An attacker who exploits this issue could execute arbitrary code on the local system...