Path traversal

Panini Everest Engine 2.0.4 allows unprivileged users to create a file named Everest.exe in the %PROGRAMDATA%\Panini folder. This leads to privilege escalation because a service, running as SYSTEM, uses the unquoted path of %PROGRAMDATA%\Panini\Everest Engine\EverestEngine.exe and therefore a...

CVE-2022-39959

CVE-2022-39959 – Panini Everest Engine 2.0.4 : A privilege-escalation flaw arising from an unprivileged user being able to create a file named Everest.exe in %PROGRAMDATA%\Panini. The service running as SYSTEM uses the unquoted path %PROGRAMDATA%\Panini\Everest Engine\EverestEngine.exe, which can...

CVE-2022-39959

Panini Everest Engine 2.0.4 allows unprivileged users to create a file named Everest.exe in the %PROGRAMDATA%\Panini folder. This leads to privilege escalation because a service, running as SYSTEM, uses the unquoted path of %PROGRAMDATA%\Panini\Everest Engine\EverestEngine.exe and therefore a...

CVE-2022-1697

Okta Active Directory Agent versions 3.8.0 through 3.11.0 installed the Okta AD Agent Update Service using an unquoted path. Note: To remediate this vulnerability, you must uninstall Okta Active Directory Agent and reinstall Okta Active Directory Agent 3.12.0 or greater per the documentation...

CVE-2022-1697

Okta Active Directory Agent versions 3.8.0 through 3.11.0 installed the Okta AD Agent Update Service using an unquoted path. Note: To remediate this vulnerability, you must uninstall Okta Active Directory Agent and reinstall Okta Active Directory Agent 3.12.0 or greater per the documentation...

CVE-2022-1697

Okta Active Directory Agent versions 3.8.0 through 3.11.0 installed the Okta AD Agent Update Service using an unquoted path. Note: To remediate this vulnerability, you must uninstall Okta Active Directory Agent and reinstall Okta Active Directory Agent 3.12.0 or greater per the documentation...

Design/Logic Flaw

Okta Active Directory Agent versions 3.8.0 through 3.11.0 installed the Okta AD Agent Update Service using an unquoted path. Note: To remediate this vulnerability, you must uninstall Okta Active Directory Agent and reinstall Okta Active Directory Agent 3.12.0 or greater per the documentation...

CVE-2022-1697

Okta Active Directory Agent versions 3.8.0 through 3.11.0 installed the Okta AD Agent Update Service using an unquoted path. Note: To remediate this vulnerability, you must uninstall Okta Active Directory Agent and reinstall Okta Active Directory Agent 3.12.0 or greater per the documentation...

CVE-2022-1697

Okta Active Directory Agent vulnerable versions 3.8.0–3.11.0 due to the Okta AD Agent Update Service being installed with an unquoted path, enabling local privilege escalation. Affected software: Okta Active Directory Agent (Windows) versions 3.8.0 through 3.11.0. Underlying cause: installation p...

PT-2022-14053 · Okta · Okta Active Directory Agent

Name of the Vulnerable Software and Affected Versions: Okta Active Directory Agent versions 3.8.0 through 3.11.0 Description: The issue arises from the Okta Active Directory Agent installing the Okta AD Agent Update Service using an unquoted path, which can lead to privilege escalation...

Okta Active Directory Agent 代码问题漏洞

Okta Active Directory Agent is a lightweight agent from Okta USA that can be installed on any Windows Server. It is used to connect to the local Active Directory for user configuration, de-configuration and authentication requests. A code issue vulnerability exists in Okta Active Directory Agent...

"JustSystems JUST Online Update for J-License" starts a program with an unquoted file path

Overview "JustSystems JUST Online Update for J-License" is bundled with multiple products for corporate users provided by JustSystems Corporation, as in Ichitaro through Pro5 and others, and it is registered as a Windows service. "JustSystems JUST Online Update for J-License" starts another progr...

CVE-2022-31591

SAP BusinessObjects BW Publisher Service - versions 420, 430, uses a search path that contains an unquoted element. A local attacker can gain elevated privileges by inserting an executable file in the path of the affected service...

CVE-2022-33035

XLPD v7.0.0094 and below contains an unquoted service path vulnerability which allows local users to launch processes with elevated privileges...

CVE-2022-27905

In ControlUp Real-Time Agent before 8.6, an unquoted path can result in privilege escalation. An attacker would require write permissions to the root level of the OS drive C:\ to exploit this...

CVE-2022-27905

In ControlUp Real-Time Agent before 8.6, an unquoted path can result in privilege escalation. An attacker would require write permissions to the root level of the OS drive C:\ to exploit this...

CVE-2022-27905

In ControlUp Real-Time Agent before 8.6, an unquoted path can result in privilege escalation. An attacker would require write permissions to the root level of the OS drive C:\ to exploit this...

Privilege escalation

In ControlUp Real-Time Agent before 8.6, an unquoted path can result in privilege escalation. An attacker would require write permissions to the root level of the OS drive C:\ to exploit this...

CVE-2022-27905

CVE-2022-27905 affects ControlUp Real-Time Agent prior to version 8.6. The issue is an unquoted path that can lead to privilege escalation. A successful exploit requires write permissions to the root of the OS drive (C:). The available connected sources corroborate the same description across mul...

CVE-2022-27905

In ControlUp Real-Time Agent before 8.6, an unquoted path can result in privilege escalation. An attacker would require write permissions to the root level of the OS drive C:\ to exploit this...