127 matches found
N-able PassPortal Log Information Disclosure Vulnerability
N-able PassPortal is a cloud-based, integrated, automated password protection solution from N-able. A log information disclosure vulnerability exists in N-able PassPortal versions prior to 3.29.2 that originates from inserting sensitive information into log files...
CVE-2023-47131
The CVE-2023-47131 issue affects the N-able PassPortal Chrome extension and is caused by the extension inserting sensitive information into log files in versions prior to 3.29.2. The impact is sensitive data disclosed via logs (as stated across Red Hat, NVD, CVE lists). Remediation is to upgrade ...
CVE-2023-47132
An issue discovered in N-able N-central before 2023.6 and earlier allows attackers to gain escalated privileges via API calls...
N-able N-central Web Interface Detection
Binary data nablencentraldetect.nbin...
MuddyWater Returns with a New Spear-Phishing Campaign
Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary MuddyWater, the Iranian nation-state actor, has been identified in a new spearphishing campaign targeting two Israeli entities and deploying a legitimate remote administration tool known as N-able Advanc...
Iran's MuddyWater Targets Israel in New Spear-Phishing Cyber Campaign
The Iranian nation-state actor known as MuddyWater has been linked to a new spear-phishing campaign targeting two Israeli entities to ultimately deploy a legitimate remote administration tool from N-able called Advanced Monitoring Agent. Cybersecurity firm Deep Instinct, which disclosed details o...
N-Able's Take Control Agent Vulnerability Exposes Windows Systems to Privilege Escalation
A high-severity security flaw has been disclosed in N-Able's Take Control Agent that could be exploited by a local unprivileged attacker to gain SYSTEM privileges. Tracked as CVE-2023-27470 CVSS score: 8.8, the issue relates to a Time-of-Check to Time-of-Use TOCTOU race condition vulnerability,...
Race condition
BASupSrvcUpdater.exe in N-able Take Control Agent through 7.0.41.1141 before 7.0.43 has a TOCTOU Race Condition via a pseudo-symlink at %PROGRAMDATA%\GetSupportServiceN-Central\PushUpdates, leading to arbitrary file deletion...
CVE-2023-27470
BASupSrvcUpdater.exe in N-able Take Control Agent through 7.0.41.1141 before 7.0.43 has a TOCTOU Race Condition via a pseudo-symlink at %PROGRAMDATA%\GetSupportServiceN-Central\PushUpdates, leading to arbitrary file deletion...
CVE-2023-27470: Time-of-check Time-of-use (TOCTOU) Race Condition
BASupSrvcUpdater.exe in N-able Take Control Agent through 7.0.41.1141 before 7.0.43 has a TOCTOU Race Condition via a pseudo-symlink at %PROGRAMDATA%\GetSupportServiceN-Central\PushUpdates, leading to arbitrary file deletion...
CVE-2023-27470
CVE-2023-27470 affects BASupSrvcUpdater.exe in N-able Take Control Agent up to version 7.0.41.1141 (before 7.0.43). The issue is a TOCTOU race condition via a pseudo-symlink in the directory %PROGRAMDATA%\GetSupportService_N-Central\PushUpdates, which can lead to arbitrary file deletion on Window...
CVE-2023-30297
An issue found in N-able Technologies N-central Server before 2023.4 allows a local attacker to execute arbitrary code via the monitoring function of the server...
Code injection
An issue found in N-able Technologies N-central Server before 2023.4 allows a local attacker to execute arbitrary code via the monitoring function of the server...
CVE-2023-30297: Undefined Security Weakness
An issue found in N-able Technologies N-central Server before 2023.4 allows a local attacker to execute arbitrary code via the monitoring function of the server...
CVE-2023-30297
The CVE-2023-30297 entry concerns N-able Technologies N-central Server prior to version 2023.4. The issue allows a local attacker to execute arbitrary code through the server’s monitoring function. The root cause is a vulnerability in the monitoring feature that enables code execution with low pr...
CVE-2023-30297
An issue found in N-able Technologies N-central Server before 2023.4 allows a local attacker to execute arbitrary code via the monitoring function of the server...
N-able Technologies N-central Server Security Vulnerability
N-able Technologies N-central Server is a comprehensive Remote Monitoring and Management RMM solution from US-based N-able Technologies. A security vulnerability exists in N-able Technologies N-central Server prior to version 2023.4, which originates from the execution of arbitrary code via the...
CVE-2023-30297
An issue found in N-able Technologies N-central Server before 2023.4 allows a local attacker to execute arbitrary code via the monitoring function of the server...
PT-2023-22625 · Alt N Technologies · N-Central Server
Name of the Vulnerable Software and Affected Versions: N-able Technologies N-central Server versions prior to 2023.4 Description: The issue allows a local attacker to execute arbitrary code via the monitoring function of the server. Recommendations: For versions prior to 2023.4, update to version...
