CVE-2019-1405

An elevation of privilege vulnerability exists when the Windows Universal Plug and Play UPnP service improperly allows COM object creation, aka 'Windows UPnP Service Elevation of Privilege Vulnerability'...

CVE-2019-1405

CVE-2019-1405 is a local privilege-escalation flaw in the Windows UPnP service where improper handling allows COM object creation. Root cause per the connected CISA KEV entry is improper COM object creation by the UPnP service, enabling elevation of privileges. The CVSSv3.1 metrics in the initial...

CVE-2019-1405

An elevation of privilege vulnerability exists when the Windows Universal Plug and Play UPnP service improperly allows COM object creation, aka 'Windows UPnP Service Elevation of Privilege Vulnerability'...

Windows UPnP Service Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists when the Windows Universal Plug and Play UPnP service improperly allows COM object creation. An attacker who successfully exploited this vulnerability could run arbitrary code with elevated system privileges. An attacker could then install programs;...

CVE-2019-1405: Improper Privilege Management

An elevation of privilege vulnerability exists when the Windows Universal Plug and Play UPnP service improperly allows COM object creation, aka 'Windows UPnP Service Elevation of Privilege Vulnerability'...

Microsoft Windows UPnP Service CVE-2019-1405 Local Privilege Escalation Vulnerability

Description Microsoft Windows is prone to a local privilege-escalation vulnerability. An attacker can exploit this issue to gain elevated privileges. Technologies Affected Microsoft Windows 10 Version 1607 for 32-bit Systems Microsoft Windows 10 Version 1607 for x64-based Systems Microsoft Window...

CVE-2019-1405

An elevation of privilege vulnerability exists when the Windows Universal Plug and Play UPnP service improperly allows COM object creation, aka ‘Windows UPnP Service Elevation of Privilege Vulnerability’. Recent assessments: Assessed Attacker Value: 0 Assessed Attacker Value: 0Assessed Attacker...

Microsoft UPnP Local Privilege Elevation Vulnerability

This exploit uses two vulnerabilities to execute a command as an elevated user. The first CVE-2019-1405 uses the UPnP Device Host Service to elevate to NT AUTHORITY\LOCAL SERVICE The second CVE-2019-1322 leverages the Update Orchestrator Service to elevate from NT AUTHORITY\LOCAL SERVICE to NT...

KLA11871 Multiple vulnerabilities in Microsoft Products (ESU)

Multiple vulnerabilities were found in Microsoft Products Extended Support Update. Malicious users can exploit these vulnerabilities to cause denial of service, gain privileges, execute arbitrary code, obtain sensitive information, bypass security restrictions. Below is a complete list of...

CVE-2019-17532: Missing Authentication for Critical Function

An issue was discovered on Belkin Wemo Switch 28B WW2.00.11057.PVT-OWRT-SNS devices. They allow remote attackers to cause a denial of service persistent rules-processing outage via a crafted ruleDbBody element in a StoreRules request to the upnp/control/rules1 URI, because database corruption...

PT-2019-15190

Name of the Vulnerable Software and Affected Versions Belkin Wemo Switch version 28B WW 2.00.11057.PVT-OWRT-SNS Description The issue allows remote attackers to cause a denial of service, resulting in a persistent rules-processing outage. This is achieved by sending a crafted ruleDbBody element i...

CVE-2019-16903

Platinum UPnP SDK 1.2.0 allows Directory Traversal in Core/PltHttpServer.cpp because it checks for /.. where it should be checking for ../ instead...

CVE-2019-16903

Platinum UPnP SDK 1.2.0 allows Directory Traversal in Core/PltHttpServer.cpp because it checks for /.. where it should be checking for ../ instead...

Directory traversal

Platinum UPnP SDK 1.2.0 allows Directory Traversal in Core/PltHttpServer.cpp because it checks for /.. where it should be checking for ../ instead...

CVE-2019-16903

Platinum UPnP SDK 1.2.0 allows Directory Traversal in Core/PltHttpServer.cpp because it checks for /.. where it should be checking for ../ instead...

CVE-2019-16903

Platinum UPnP SDK 1.2.0 contains a directory traversal flaw in Core/PltHttpServer.cpp due to checking for /.. instead of ../, enabling path traversal. Affected component: Platinum UPnP SDK 1.2.0 (PltHttpServer). Root cause: incorrect path normalization in the HTTP server. Impact is limited to vul...

CVE-2019-16903

Platinum UPnP SDK 1.2.0 allows Directory Traversal in Core/PltHttpServer.cpp because it checks for /.. where it should be checking for ../ instead...

CVE-2019-16903: Improper Limitation of a Pathname to a Restricted Directory

Platinum UPnP SDK 1.2.0 allows Directory Traversal in Core/PltHttpServer.cpp because it checks for /.. where it should be checking for ../ instead...

PT-2019-14855

Name of the Vulnerable Software and Affected Versions Platinum UPnP SDK version 1.2.0 Description The issue allows Directory Traversal due to incorrect checking for /.. instead of ../ in the Core/PltHttpServer.cpp file. Recommendations For Platinum UPnP SDK version 1.2.0, consider modifying the...

15,000 webcams vulnerable to attack: how to protect against webcam hacking

Webcams may have been around for a long time, but that doesn’t mean we know what we’re doing with them. Webcam hacking has been around for equally as long, yet new research from Wizcase indicates that more than 15,000 private, web-connected cameras are exposed and readily accessible to the genera...