CVE-2020-7358

In AppSpider installer versions prior to 7.2.126, the AppSpider installer calls an executable which can be placed in the appropriate directory by an attacker with access to the local machine. This would prevent the installer from distinguishing between a valid executable called during an...

CVE-2020-7358

In AppSpider installer versions prior to 7.2.126, the AppSpider installer calls an executable which can be placed in the appropriate directory by an attacker with access to the local machine. This would prevent the installer from distinguishing between a valid executable called during an...

Code injection

In AppSpider installer versions prior to 7.2.126, the AppSpider installer calls an executable which can be placed in the appropriate directory by an attacker with access to the local machine. This would prevent the installer from distinguishing between a valid executable called during an...

CVE-2020-7358

The CVE-2020-7358 entry relates to the AppSpider Installer. Affected software: AppSpider installer versions prior to 7.2.126. Vulnerable component: the installer launches an executable, which can be placed in the installation directory by a user with local access. Root cause: the installer cannot...

PT-2020-19572

Name of the Vulnerable Software and Affected Versions AppSpider versions prior to 7.2.126 Description The issue arises when the AppSpider installer calls an executable that can be replaced by an attacker with access to the local machine, potentially allowing the execution of arbitrary code. This ...

CVE-2020-7530

A CWE-285 Improper Authorization vulnerability exists in SCADAPack 7x Remote Connect V3.6.3.574 and prior which allows improper access to executable code folders...

CVE-2020-7530

A CWE-285 Improper Authorization vulnerability exists in SCADAPack 7x Remote Connect V3.6.3.574 and prior which allows improper access to executable code folders...

CVE-2020-7530

A CWE-285 Improper Authorization vulnerability exists in SCADAPack 7x Remote Connect V3.6.3.574 and prior which allows improper access to executable code folders...

CVE-2020-7530: Improper Authorization

A CWE-285 Improper Authorization vulnerability exists in SCADAPack 7x Remote Connect V3.6.3.574 and prior which allows improper access to executable code folders...

File Upload Vulnerability in Smart-MDS Multimedia Command and Dispatch System of Yixin Technology

The Smart-MDS multimedia command and dispatch system has a powerful convergence access function, providing a unified scheduling management platform with multi-service convergence, access to mainstream audio and video communication systems and other functions. There is a file upload vulnerability ...

McAfee Endpoint Security Access Control Error Vulnerability (CNVD-2020-52035)

McAfee Endpoint Security ENS is the United States McAfee McAfee company's set of framework for providing intelligent collaboration and advanced threat defense. The framework supports the entire threat defense lifecycle of real-time communications control and actionable threat forensics and so on...

exploits

This is an exploit repository containing various tools and scripts for exploiting vulnerabilities in different software products. The primary target of the exploit is the Zoho Meeting application, specifically the "aeagent.exe" process, which has a known vulnerability that allows remote code...

CVE-2020-0790

A local elevation of privilege vulnerability exists in how splwow64.exe handles certain calls. An attacker who successfully exploited the vulnerability could elevate privileges on an affected system from low-integrity to medium-integrity. This vulnerability by itself does not allow arbitrary code...

Siemens License Management Utility (LMU) Elevation of Privilege Vulnerability

License Management Utility LMU is a unified license management system for Siemens Building Automation products such as Desigo CC and ABT. An elevation of privilege vulnerability exists in Siemens License Management Utility LMU. This allows a locally authenticated attacker to execute arbitrary...

NEC ExpressCluster ApplyConfig XML External Entity Processing Information Disclosure Vulnerability

This vulnerability allows remote attackers to disclose sensitive information on affected installations of NEC ExpressCluster. Authentication is not required to exploit this vulnerability. The specific flaw exists within the clpwebmc executable. Due to the improper restriction of XML External Enti...

CVE-2020-23834

Insecure Service File Permissions in the bd service in Real Time Logic BarracudaDrive v6.5 allow local attackers to escalate privileges to admin by replacing the %SYSTEMDRIVE%\bd\bd.exe file. When the computer next starts, the new bd.exe will be run as LocalSystem...

Malicious Package in bb-builder

All versions of bb-builder contained malicious code. The package ran an executable targeting Windows and uploaded information to a remote server. Recommendation Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that...

CVE-2019-10679

Thomson Reuters Eikon 4.0.42144 allows all local users to modify the service executable file because of weak %PROGRAMFILESX86%\Thomson Reuters\Eikon permissions...

CVE-2019-10679

Thomson Reuters Eikon 4.0.42144 allows all local users to modify the service executable file because of weak %PROGRAMFILESX86%\Thomson Reuters\Eikon permissions...

CVE-2020-7381

In Rapid7 Nexpose installer versions prior to 6.6.40, the Nexpose installer calls an executable which can be placed in the appropriate directory by an attacker with access to the local machine. This would prevent the installer from distinguishing between a valid executable called during a Securit...