401 matches found
Foxit Reader Elevation of Privilege Vulnerability
Foxit Reader is a PDF document reader. An elevation of privilege vulnerability exists in Foxit Reader 10.0.1.35811 and earlier versions in the handling of configuration files used by the update service. The vulnerability stems from incorrect privilege settings on resources used by the update...
Foxit PhantomPDF Update Service Incorrect Permission Assignment Privilege Escalation Vulnerability
This vulnerability allows local attackers to escalate privileges on affected installations of Foxit PhantomPDF. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handling of the...
Citrix Systems Workspace App Access Control Error Vulnerability (CNVD-2020-42654)
Citrix Systems Workspace App formerly known as Receiver is an application from Citrix Systems, Inc. that provides secure access to applications, desktops, and data. An access control error vulnerability exists in the automatic update service in the Citrix Systems Workspace App Windows 1912 LTSR a...
Fixed vulnerability in Citrix Workspace (formerly Citrix Receiver)
A vulnerability has been fixed in the automatic update service of the Citrix Workspace app for Windows that could result in increased user privileges. Citrix has made an update available to fix the vulnerability. fix. For more information, see the following page:...
The vulnerability of the software update service for Cisco Webex Meetings Desktop App allows a perpetrator to execute arbitrary code.
The vulnerability of the software update service for the Cisco Webex Meetings Desktop App is related to insufficient validation of input data. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...
The vulnerability of the update service for microprogramming software of Cisco TelePresence Collaboration Endpoint Software and the Cisco RoomOS operating system allows a hacker to modify the file system, trigger a service failure, or gain privileged access to the root file system.
The vulnerability of the software update service for Cisco TelePresence Collaboration Endpoint Software and the operating system Cisco RoomOS exists due to the lack of measures taken to neutralize special elements used in the operating system’s command set. Exploiting this vulnerability can allow...
The vulnerability of the software update service for Cisco Webex Meetings Desktop App on Mac operating systems allows a perpetrator to execute arbitrary code.
The vulnerability of the software update service for the Cisco Webex Meetings Desktop App on Mac operating systems is related to authentication errors. Exploiting this vulnerability allows a malicious actor to execute arbitrary code via a specially created website...
The vulnerability of the Microsoft Visual Studio software update service allows a hacker to escalate their privileges.
The vulnerability of the Microsoft Visual Studio software update service is related to deficiencies in access control. Exploiting this vulnerability could allow attackers to enhance their privileges...
NVIDIA Update Service Daemon 1.0.21 - (nvUpdatusService) Unquoted Service Path Vulnerability
Exploit Title: NVIDIA Update Service Daemon 1.0.21 - 'nvUpdatusService' Unquoted Service Path Discovery by: Roberto Piña Vendor Homepage: https://www.nvidia.com/es-la/ Software Link : https://www.nvidia.com/es-la/ Tested Version: 1.0.21 Vulnerability Type: Unquoted Service Path Tested on OS:...
NVIDIA Update Service Daemon 1.0.21 - 'nvUpdatusService' Unquoted Service Path
Exploit Title: NVIDIA Update Service Daemon 1.0.21 - 'nvUpdatusService' Unquoted Service Path Discovery by: Roberto Piña Discovery Date: 2020-04-27 Vendor Homepage: https://www.nvidia.com/es-la/ Software Link : https://www.nvidia.com/es-la/ Tested Version: 1.0.21 Vulnerability Type: Unquoted...
Popcorn Time 6.2 - 'Update service' Unquoted Service Path
Exploit Title: Popcorn Time 6.2 - 'Update service' Unquoted Service Path Date: 2020-04-24 Vendor Homepage: https://getpopcorntime.is Exploit Authors: Uriel Yochpaz & Jonatan Schor Software Link: https://dl.getpopcorntime.is/PopcornTime-latest.exe Version: 6.2.1.14 and probably prior versions Test...
Schneider Electric Interactive Graphical SCADA System Access Control Error Vulnerability
Schneider Electric Interactive Graphical SCADA System IGSS is a SCADA Data Acquisition and Supervisory System system for monitoring and controlling industrial processes from Schneider Electric, France. An access control error vulnerability exists in Schneider Electric IGSS Interactive Graphical...
CVE-2020-7479
A CWE-306: Missing Authentication for Critical Function vulnerability exists in IGSS Versions 14 and prior using the service: IGSSupdate, which could allow a local user to execute processes that otherwise require escalation privileges when sending local network commands to the IGSS Update Service...
CVE-2020-7478
A CWE-22: Improper Limitation of a Pathname to a Restricted Directory exists in IGSS Versions 14 and prior using the service: IGSSupdate, which could allow a remote unauthenticated attacker to read arbitrary files from the IGSS server PC on an unrestricted or shared network when the IGSS Update...
CVE-2020-7479
A CWE-306: Missing Authentication for Critical Function vulnerability exists in IGSS Versions 14 and prior using the service: IGSSupdate, which could allow a local user to execute processes that otherwise require escalation privileges when sending local network commands to the IGSS Update Service...
Design/Logic Flaw
A CWE-22: Improper Limitation of a Pathname to a Restricted Directory exists in IGSS Versions 14 and prior using the service: IGSSupdate, which could allow a remote unauthenticated attacker to read arbitrary files from the IGSS server PC on an unrestricted or shared network when the IGSS Update...
PT-2020-19606 · Igss · Igss
Name of the Vulnerable Software and Affected Versions: IGSS versions 14 and prior Description: A Missing Authentication for Critical Function issue exists, which could allow a local user to execute processes that otherwise require escalation privileges when sending local network commands to the...
PT-2020-19605 · Igss · Igss
Name of the Vulnerable Software and Affected Versions: IGSS versions 14 and prior Description: A CWE-22 issue exists, which could allow a remote unauthenticated attacker to read arbitrary files from the IGSS server PC on an unrestricted or shared network when the IGSS Update Service is enabled...
Cross site scripting
A Cross-site Scripting XSS vulnerability exists in FortiManager 5.2.1 and earlier and 5.0.10 and earlier via an unspecified parameter in the FortiWeb auto update service page...
