CVE-2020-15261: Unquoted Search Path or Element

On Windows the Veyon Service before version 4.4.2 contains an unquoted service path vulnerability, allowing locally authenticated users with administrative privileges to run malicious executables with LocalSystem privileges. Since Veyon users both students and teachers usually don't have...

CVE-2020-23834

Insecure Service File Permissions in the bd service in Real Time Logic BarracudaDrive v6.5 allow local attackers to escalate privileges to admin by replacing the %SYSTEMDRIVE%\bd\bd.exe file. When the computer next starts, the new bd.exe will be run as LocalSystem...

CVE-2020-23834

Insecure Service File Permissions in the bd service in Real Time Logic BarracudaDrive v6.5 allow local attackers to escalate privileges to admin by replacing the %SYSTEMDRIVE%\bd\bd.exe file. When the computer next starts, the new bd.exe will be run as LocalSystem...

CVE-2020-23834: Incorrect Permission Assignment for Critical Resource

Insecure Service File Permissions in the bd service in Real Time Logic BarracudaDrive v6.5 allow local attackers to escalate privileges to admin by replacing the %SYSTEMDRIVE%\bd\bd.exe file. When the computer next starts, the new bd.exe will be run as LocalSystem...

CVE-2020-15351

IDrive before 6.7.3.19 on Windows installs by default to %PROGRAMFILESX86%\IDriveWindows with weak folder permissions granting any user modify permission i.e., NT AUTHORITY\Authenticated Users:OICIM to the contents of the directory and its sub-folders. In addition, the program installs a service...

CVE-2020-15351

IDrive before 6.7.3.19 on Windows installs by default to %PROGRAMFILESX86%\IDriveWindows with weak folder permissions granting any user modify permission i.e., NT AUTHORITY\Authenticated Users:OICIM to the contents of the directory and its sub-folders. In addition, the program installs a service...

CVE-2020-15351

IDrive prior to 6.7.3.19 on Windows installs to %PROGRAMFILES(X86)%\IDriveWindows with weak folder permissions (Authenticated Users: modify) and runs a LocalSystem service (IDriveService). This enables a local user to escalate to SYSTEM by replacing the service binary with a malicious one. Affect...

10-Strike Bandwidth Monitor 3.9 Unquoted Service Path

10-Strike Bandwidth Monitor version 3.9 services Svc10StrikeBandMontitor Exploit Title: Bandwidth Monitor 3.9 - Unquoted Services Paths Exploit Author: Bobby Cooke Date: 2020-07-15 Vendor Site: https://www.10-strike.com/ Software Download:...

10-Strike Bandwidth Monitor 3.9 Unquoted Service Path

Exploit Title: Bandwidth Monitor 3.9 - Unquoted Services Paths Exploit Author: Bobby Cooke Date: 2020-07-15 Vendor Site: https://www.10-strike.com/ Software Download: https://www.10-strike.com/bandwidth-monitor/bandwidth-monitor.exe Tested On: Windows 10 - Pro 1909 x86 Version: version 3.9...

10-Strike Bandwidth Monitor 3.9 Unquoted Service Path Vulnerability

10-Strike Bandwidth Monitor version 3.9 services Svc10StrikeBandMontitor, Svc10StrikeBMWD, and Svc10StrikeBMAgent suffer from unquoted service path vulnerabilities. Exploit Title: Bandwidth Monitor 3.9 - Unquoted Services Paths Exploit Author: Bobby Cooke Vendor Site: https://www.10-strike.com/...

Bandwidth Monitor 3.9 - 'Svc10StrikeBandMontitor' Unquoted Service Path

Exploit Title: Bandwidth Monitor 3.9 - 'Svc10StrikeBandMontitor' Unquoted Service Path Exploit Author: Bobby Cooke Date: 2020-07-15 Vendor Site: https://www.10-strike.com/ Software Download: https://www.10-strike.com/bandwidth-monitor/bandwidth-monitor.exe Tested On: Windows 10 - Pro 1909 x86...

Oracle Database 11g Release 2 - 'OracleDBConsoleorcl' Unquoted Service Path

Exploit Title: Oracle Database 11g Release 2 - 'OracleDBConsoleorcl' Unquoted Service Path Discovery by: Nguyen Khang - SunCSR Discovery Date: 2020-05-03 Vendor Homepage: https://www.oracle.com/ Software Link: https://www.oracle.com/database/technologies/112010-win64soft.html Tested Version: 11g...

10-Strike Network Inventory Explorer - srvInventoryWebServer Unquoted Service Path

10-Strike Network Inventory Explorer - srvInventoryWebServer Unquoted Service Path Exploit Title: 10-Strike Network Inventory Explorer - 'srvInventoryWebServer' Unquoted Service Path Date: 2020-03-24 Author: Felipe Winsnes Vendor Homepage: https://www.10-strike.com/ Software Link:...

Veyon 4.3.4 - VeyonService Unquoted Service Path

Veyon 4.3.4 - VeyonService Unquoted Service Path Exploit Title: Veyon 4.3.4 - 'VeyonService' Unquoted Service Path Discovery by: Víctor García Discovery Date: 2020-03-23 Vendor Homepage: https://veyon.io/ Software Link:...

Veyon 4.3.4 Unquoted Service Path

Exploit Title: Veyon 4.3.4 - 'VeyonService' Unquoted Service Path Discovery by: Víctor García Discovery Date: 2020-03-23 Vendor Homepage: https://veyon.io/ Software Link: https://github.com/veyon/veyon/releases/download/v4.3.4/veyon-4.3.4.0-win64-setup.exe Tested Version: 4.3.4 Vulnerability Type...

ASUS AXSP 1.02.00 Unquoted Service Path

Exploit Title: ASUS AXSP 1.02.00 - 'asComSvc' Unquoted Service Path Discovery by: Roberto Piña Discovery Date: 2020-03-10 Vendor Homepage: https://www.asus.com/ Software Link...

ASUS AXSP 1.02.00 - (asComSvc) Unquoted Service Path Vulnerability

Exploit Title: ASUS AXSP 1.02.00 - 'asComSvc' Unquoted Service Path Discovery by: Roberto Piña Vendor Homepage: https://www.asus.com/ Software Link :https://dlcdnets.asus.com/pub/ASUS/misc/utils/AISuite3Win10H97M-ProV10102.zip?ga=2.170180192.1334401606.1583873755-790266082.1583873755 Tested...

Microsoft Windows and Windows Server Elevation of Privilege Vulnerability (CNVD-2020-19010)

Microsoft Windows and Microsoft Windows Server are both products of Microsoft Corporation.Microsoft Windows is an operating system for personal devices.Microsoft Windows Server is a server operating system. An elevation of privilege vulnerability exists in Microsoft Windows and Windows Server,...

ASUS GiftBox Desktop 1.1.1.127 - ASUSGiftBoxDesktop Unquoted Service Path

ASUS GiftBox Desktop 1.1.1.127 - ASUSGiftBoxDesktop Unquoted Service Path Exploit Title: ASUS GiftBox Desktop 1.1.1.127 - 'ASUSGiftBoxDesktop' Unquoted Service Path Discovery by: Oscar Flores Discovery Date: 2020-03-05 Vendor Homepage: https://www.asus.com/ Software Link :...

Deep Instinct Windows Agent 1.2.29.0 - (DeepMgmtService) Unquoted Service Path Vulnerability

Exploit Title: Deep Instinct Windows Agent 1.2.29.0 - 'DeepMgmtService' Unquoted Service Path Discovery by: Oscar Flores Vendor Homepage: https://www.deepinstinct.com/ Software Links :...