Last Week’s Security news: Exploits for ForgeRock, vSphere, Apache Tomcat, new Print Spooler vuln, Kaseya Patch and REvil, SolarWinds, Schneider Electric, Bulletins

Hello guys! The fourth episode of Last Week’s Security news, July 12 – July 18. I would like to start with some new public exploits. I think these 4 are the most interesting. If you remember, 2 weeks ago I mentioned the ForgeRock Access Manager and OpenAM vulnerability CVE-2021-35464. Now there i...

CVE-2021-35449

The Lexmark Universal Print Driver version 2.15.1.0 and below, G2 driver 2.7.1.0 and below, G3 driver 3.2.0.0 and below, and G4 driver 4.2.1.0 and below are affected by a privilege escalation vulnerability. A standard low priviliged user can use the driver to execute a DLL of their choosing durin...

CVE-2021-35449

The Lexmark Universal Print Driver version 2.15.1.0 and below, G2 driver 2.7.1.0 and below, G3 driver 3.2.0.0 and below, and G4 driver 4.2.1.0 and below are affected by a privilege escalation vulnerability. A standard low priviliged user can use the driver to execute a DLL of their choosing durin...

Privilege escalation

The Lexmark Universal Print Driver version 2.15.1.0 and below, G2 driver 2.7.1.0 and below, G3 driver 3.2.0.0 and below, and G4 driver 4.2.1.0 and below are affected by a privilege escalation vulnerability. A standard low priviliged user can use the driver to execute a DLL of their choosing durin...

CVE-2021-35449

The Lexmark Universal Print Driver version 2.15.1.0 and below, G2 driver 2.7.1.0 and below, G3 driver 3.2.0.0 and below, and G4 driver 4.2.1.0 and below are affected by a privilege escalation vulnerability. A standard low priviliged user can use the driver to execute a DLL of their choosing durin...

CVE-2021-35449

CVE-2021-35449 affects Lexmark Universal Print Driver (versions 2.15.1.0 and earlier) and associated G2/G3/G4 drivers. The vulnerability enables local privilege escalation: a low-privilege user can cause the driver to load a DLL of their choosing during the add printer process, escalating to SYST...

Microsoft Windows Print Spooler Remote Code Execution Vulnerability (CNVD-2022-10026)

Microsoft Windows Print Spooler is a print backend processor component of Microsoft Corporation USA.A remote code execution vulnerability exists in Microsoft Windows Print Spooler, which can be exploited by attackers to run arbitrary code with SYSTEM privileges...

Lexmark Universal Print Driver 安全漏洞

Lexmark Universal Print Driver is a printer driver from Lexmark USA. A security vulnerability exists in Lexmark Universal Print Driver that originates from a standard low-privilege user being able to use the driver to execute a DLL of their choice during the add printer process, resulting in...

PT-2021-4737 · Microsoft · Windows Print Spooler +1

Name of the Vulnerable Software and Affected Versions: Windows Print Spooler affected versions not specified Description: The issue is related to errors in the representation of information by the user interface of the Windows Print Spooler in Windows operating systems. This can allow a remote...

Weren’t you warned about reactivating the Print Spooler?

THREAT LEVEL: Red. For a detailed advisory, download the pdf file here. After almost 10 days of releasing an advisory by the Hive Pro Threat Research team, a new vulnerability has been found in Windows Print Spooler. This is a privilege escalation flaw that allows attackers to run arbitrary code...

Microsoft Windows Print Spooler Point and Print allows installation of arbitrary queue-specific files

Overview Microsoft Windows allows for non-admin users to be able to install printer drivers via Point and Print. Printers installed via this technique also install queue-specific files, which can be arbitrary libraries to be loaded by the privileged Windows Print Spooler process. Description...

CVE-2021-34481

A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged file operations. An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could then install programs; view, change, or...

CVE-2021-34481

A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged file operations. An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could then install programs; view, change, or...

Remote code execution

A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged file operations. An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could then install programs; view, change, or...

CVE-2021-34481

A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged file operations. An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could then install programs; view, change, or...

CVE-2021-34481 Windows Print Spooler Remote Code Execution Vulnerability

...

CVE-2021-34481

CVE-2021-34481 is a Windows Print Spooler remote code execution vulnerability. A low-privilege user could stage and install vulnerable printer drivers into the driver store and then escalate to SYSTEM by exploiting the spooler’s driver-install path. Affected scope includes Windows 8.1 and newer; ...

Microsoft: Unpatched Bug in Windows Print Spooler

Microsoft has warned of yet another vulnerability that’s been discovered in its Windows Print Spooler that can allow attackers to elevate privilege to gain full user rights to a system. The advisory comes on the heels of patching two other remote code-execution RCE bugs found in the print service...

Microsoft Warns of New Unpatched Windows Print Spooler Vulnerability

Microsoft on Thursday shared fresh guidance on yet another vulnerability affecting the Windows Print Spooler service, stating that it's working to address it in an upcoming security update. Tracked as CVE-2021-34481 CVSS score: 7.8, the issue concerns a local privilege escalation flaw that could ...

Windows Print Spooler Remote Code Execution Vulnerability

A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged file operations. An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could then install programs; view, change, or...