Wedge Networks WedgeOS Multiple Vulnerabilities

Wedge Networks builds enterprise email security solutions based on the company's BeSecure Web Security Gateway. Wedge Networks WedgeOS has multiple security vulnerabilities that could be exploited by an unauthenticated attacker to read arbitrary files, root, elevate root privileges, and execute...

Wedge Networks WedgeOS <= 4.0.4 Multiple Vulnerabilities

Wedge Networks WedgeOS is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...

WedgeOS 4.0.4 Arbitrary File Read / Command Execution

, , . '.' '. ', . , '. , .', , / / / \ \ ==/ /\ \ / / \ / \ / / | \ \ Y Y \ / /| / \ /||| / / /.-. / /:wq x.0 '=.|w|.=' =''"''=. presents.. WedgeOS Multiple Vulnerabilities Affected versions: WedgeOS = 4.0.4 PDF: http://www.security-assessment.com/files/documents/advisory/WedgeOS-Final.pdf...

WedgeOS 4.0.4 - Multiple Vulnerabilities

, , . '.' '. ', . , '. , .', , / / / \ \ ==/ /\ \ / / \ / \ / / | \ \ Y Y \ / /| / \ /||| / / /.-. / /:wq x.0 '=.|w|.=' =''"''=. presents.. WedgeOS Multiple Vulnerabilities Affected versions: WedgeOS = 4.0.4 PDF: http://www.security-assessment.com/files/documents/advisory/WedgeOS-Final.pdf...

Lenovo System Update Privilege Escalation Exploit

Exploit for hardware platform in category local exploits This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class Metasploit3 'Lenovo System Update Privilege Escalation', 'Description' = %q The named pipe, \SUPipeServer,...

Lenovo System Update Privilege Escalation

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class Metasploit3 'Lenovo System Update Privilege Escalation', 'Description' = %q The named pipe, \SUPipeServer, can be accessed by normal users to interact with the Syst...

Lenovo System Update Installed

Binary data lenovosudetection.nbin...

Lenovo System Update < 5.06.0034 Multiple Vulnerabilities

The version of Lenovo System Update installed on the remote host is prior to 5.06.0034. It is, therefore, affected by the following vulnerabilities : - A flaw exists in SUService.exe System Update service due to generating security tokens for a named pipe in a predictable manner. A local attacker...

Medium: tomcat8

Issue Overview: It was discovered that JBoss Web / Apache Tomcat did not limit the length of chunk sizes when using chunked transfer encoding. A remote attacker could use this flaw to perform a denial of service attack against JBoss Web / Apache Tomcat by streaming an unlimited quantity of data,...

CVE-2015-2234

Race condition in Lenovo System Update formerly ThinkVantage System Update before 5.06.0034 uses world-writable permissions for the update files directory, which allows local users to gain privileges by writing to an update file after the signature is validated...

CVE-2015-2233

Lenovo System Update formerly ThinkVantage System Update before 5.06.0034 does not properly validate CA chains during signature validation, which allows man-in-the-middle attackers to upload and execute arbitrary files via a crafted certificate...

CVE-2015-2219

Lenovo System Update formerly ThinkVantage System Update before 5.06.0034 uses predictable security tokens, which allows local users to gain privileges by sending a valid token with a command to the System Update service SUService.exe through an unspecified named pipe...

Design/Logic Flaw

Lenovo System Update formerly ThinkVantage System Update before 5.06.0034 uses predictable security tokens, which allows local users to gain privileges by sending a valid token with a command to the System Update service SUService.exe through an unspecified named pipe...

Design/Logic Flaw

Lenovo System Update formerly ThinkVantage System Update before 5.06.0034 does not properly validate CA chains during signature validation, which allows man-in-the-middle attackers to upload and execute arbitrary files via a crafted certificate...

Race condition

Race condition in Lenovo System Update formerly ThinkVantage System Update before 5.06.0034 uses world-writable permissions for the update files directory, which allows local users to gain privileges by writing to an update file after the signature is validated...

CVE-2015-2233

Lenovo System Update formerly ThinkVantage System Update before 5.06.0034 does not properly validate CA chains during signature validation, which allows man-in-the-middle attackers to upload and execute arbitrary files via a crafted certificate...

CVE-2015-2234

Race condition in Lenovo System Update formerly ThinkVantage System Update before 5.06.0034 uses world-writable permissions for the update files directory, which allows local users to gain privileges by writing to an update file after the signature is validated...

CVE-2015-2219

Lenovo System Update formerly ThinkVantage System Update before 5.06.0034 uses predictable security tokens, which allows local users to gain privileges by sending a valid token with a command to the System Update service SUService.exe through an unspecified named pipe...

CVE-2015-2219

Lenovo System Update (before 5.06.0034) contains a local privilege escalation due to predictable security tokens used to access the System Update named pipe SUservice.exe. The named pipe, \SUPipeServer, can be interacted with by normal users to inject commands as SYSTEM if a valid token is provid...

CVE-2015-2234

CVE-2015-2234 affects Lenovo System Update (versions prior to 5.06.0034). The issue is a race/permission problem where the update files directory is world-writable, allowing a local attacker to replace an update file after signature validation and potentially escalate privileges. The Nes­sus/Kasp...