Improper access control

The signature-update functionality in Windows Defender on Microsoft Windows 7 and Windows Server 2008 R2 relies on an incorrect pathname, which allows local users to gain privileges via a Trojan horse application in the %SYSTEMDRIVE% top-level directory, aka "Microsoft Windows 7 Defender Improper...

CVE-2013-3154

The signature-update functionality in Windows Defender on Microsoft Windows 7 and Windows Server 2008 R2 relies on an incorrect pathname, which allows local users to gain privileges via a Trojan horse application in the %SYSTEMDRIVE% top-level directory, aka "Microsoft Windows 7 Defender Improper...

CVE-2013-3154

CVE-2013-3154 affects Windows Defender on Windows 7 and Windows Server 2008 R2. The issue is caused by an incorrect pathname used by the signature-update functionality, enabling local users to gain privileges via a Trojan horse in the %SYSTEMDRIVE% top-level directory. A successful exploit allows...

Microsoft Windows Defender Privilege Elevation Vulnerability (2847927)

This host is missing an important security update according to Microsoft Bulletin MS13-058. OpenVAS Vulnerability Test $Id: secpodms13-058.nasl 5339 2017-02-18 16:28:22Z cfi $ Microsoft Windows Defender Privilege Elevation Vulnerability 2847927 Authors: Antu Sanadi Copyright: Copyright c 2013...

Microsoft Windows Journal Remote Code Execution Vulnerabilities (2848295)

This host is missing a critical security update according to Microsoft Bulletin MS13-054. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Microsoft DirectShow Remote Code Execution Vulnerability (2845187)

This host is missing a critical security update according to Microsoft Bulletin MS13-056. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

MS13-057: Vulnerability in Windows Media Format Runtime Could Allow Remote Code Execution (2847883)

The remote Windows host is potentially affected by a vulnerability that could allow remote code execution if a user opens a malicious media file. Successful exploitation of this vulnerability could allow an attacker to gain the same user rights as the local user. C Tenable Network Security, Inc...

MS13-056: Vulnerability in Microsoft DirectShow Could Allow Remote Code Execution (2845187)

The remote Windows host is potentially affected by a vulnerability that could allow remote code execution if a user opens a malicious image file. Successful exploitation of this vulnerability could allow an attacker to gain the same user rights as the local user. C Tenable Network Security, Inc...

Microsoft Windows Defender CVE-2013-3154 Local Privilege Escalation Vulnerability

Description Microsoft Windows Defender is prone to a local privilege-escalation vulnerability. An attacker can exploit this issue to execute arbitrary code within the context of the LocalSystem account. Successfully exploiting this issue will result in the complete compromise of affected computer...

MS13-054: Description of the security update for Windows DirectWrite: July 9, 2013

None None...

Microsoft Update to Improve Cryptography and Digital Certificate Handling (2854544)

This host is missing an important security update according to Microsoft Security Advisory 2854544. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

JVN#63901692: Internet Explorer vulnerable to information disclosure

Internet Explorer contains an issue in handling XML files, which may result in information disclosure. Impact If a user opens a specially crafted XML file as a local file, other local files may be disclosed. Solution Upgrade the software Users of Windows 7 and later, Windows Server 2008 R2 and...

Top Server OPC Improper Input Validation Vulnerability

OVERVIEW Adam Crain of Automatak and independent researcher Chris Sistrunk have identified an improper input validation vulnerability in the Software Toolbox TOP Server DNP Master OPC product. Software Toolbox has produced a new version that mitigates this vulnerability. The researchers have test...

Microsoft Windows ActiveX Control Multiple Vulnerabilities (2820197)

This script will list all the vulnerable activex controls installed on the remote windows machine with references and cause. OpenVAS Vulnerability Test $Id: gbmswindowsactivexcontrolmultvulnmay13.nasl 7172 2017-09-18 11:07:34Z cfischer $ Microsoft Windows ActiveX Control Multiple Vulnerabilities...

Microsoft Lync Remote Code Execution Vulnerability (2834695)

This host is missing an important security update according to Microsoft Bulletin MS13-041. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only...

Internet Explorer zero-day exploit targets U.S. nuke researchers

Security researchers revealed that series of "Watering Hole" has been conducted exploiting a IE8 zero-day vulnerability to target U.S. Government experts working on nuclear weapons research. The news is not surprising but it is very concerning, the principal targets of the attacks are various...

SAP ConfigServlet Remote Code Execution Vulnerability

This Metasploit module allows remote code execution via operating system commands through the SAP ConfigServlet without any authentication. This Metasploit module has been tested successfully with SAP NetWeaver 7.00 and 7.01 on Windows Server 2008 R2. This file is part of the Metasploit Framework...

SAP ConfigServlet Remote Code Execution

This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' class Metasploit3 'SAP ConfigServlet Remote Code...

SAP ConfigServlet Remote Code Execution

This module allows remote code execution via operating system commands through the SAP ConfigServlet without any authentication. This module has been tested successfully with SAP NetWeaver 7.00 and 7.01 on Windows Server 2008 R2. This module requires Metasploit: https://metasploit.com/download...

Microsoft Windows Kernel-Mode Drivers Privilege Elevation Vulnerabilities (2829996)

This host is missing an important security update according to Microsoft Bulletin MS13-036. OpenVAS Vulnerability Test $Id: secpodms13-036.nasl 5346 2017-02-19 08:43:11Z cfi $ Microsoft Windows Kernel-Mode Drivers Privilege Elevation Vulnerabilities 2829996 Authors: Arun Kallavi Copyright:...