1586 matches found
CVE-2020-8207
Improper access control in Citrix Workspace app for Windows 1912 CU1 and 2006.1 causes privilege escalation and code execution when the automatic updater service is running...
Raining SYSTEM Shells with Citrix Workspace app
TL;DR Citrix Workspace is vulnerable to a remote command execution attack running under the context of the SYSTEM account. By sending a crafted message over a named pipe and spoofing the client process ID, the Citrix Workspace Updater Service can be tricked into executing an arbitrary process und...
Splashtop Software Updater Code Issue Vulnerability
Splashtop Software Updater is a software update application for Splashtop products from Splashtop USA. A security vulnerability exists in Splashtop Software Updater prior to version 1.5.6.16 in Splashtop Streamer prior to 3.3.8.0 and Splashtop Business prior to 3.3.8.0. An attacker can exploit th...
CVE-2020-12431
A Windows privilege change issue was discovered in Splashtop Software Updater before 1.5.6.16. Insecure permissions on the configuration file and named pipe allow for local privilege escalation to NT AUTHORITY/SYSTEM, by forcing a permission change to any Splashtop files and directories, with...
CVE-2020-12431
A Windows privilege change issue was discovered in Splashtop Software Updater before 1.5.6.16. Insecure permissions on the configuration file and named pipe allow for local privilege escalation to NT AUTHORITY/SYSTEM, by forcing a permission change to any Splashtop files and directories, with...
Privilege escalation
A Windows privilege change issue was discovered in Splashtop Software Updater before 1.5.6.16. Insecure permissions on the configuration file and named pipe allow for local privilege escalation to NT AUTHORITY/SYSTEM, by forcing a permission change to any Splashtop files and directories, with...
CVE-2020-12431
A Windows privilege change issue was discovered in Splashtop Software Updater before 1.5.6.16. Insecure permissions on the configuration file and named pipe allow for local privilege escalation to NT AUTHORITY/SYSTEM, by forcing a permission change to any Splashtop files and directories, with...
CVE-2020-12431
The CVE-2020-12431 entry describes a Windows local privilege escalation in Splashtop Software Updater (before 1.5.6.16) due to insecure permissions on the updater’s configuration file and a named pipe, enabling a forced permission change of Splashtop files/directories and DLL hijacking to achieve...
Pi-hole code issue vulnerability
Pi-hole is a web-grade ad-blocking application from Pi-hole.Gravity updater is an auto-updating plugin used in it. A code issue vulnerability exists in gravityDownloadBlocklistFromUrl in Gravity updater in Pi-hole 4.4 and prior versions. An attacker can exploit this vulnerability to write a PHP...
CVE-2020-11108
The Gravity updater in Pi-hole through 4.4 allows an authenticated adversary to upload arbitrary files. This can be abused for Remote Code Execution by writing to a PHP file in the web directory. Also, it can be used in conjunction with the sudo rule for the www-data user to escalate privileges t...
CVE-2020-11108
The Gravity updater in Pi-hole through 4.4 allows an authenticated adversary to upload arbitrary files. This can be abused for Remote Code Execution by writing to a PHP file in the web directory. Also, it can be used in conjunction with the sudo rule for the www-data user to escalate privileges t...
Design/Logic Flaw
The Gravity updater in Pi-hole through 4.4 allows an authenticated adversary to upload arbitrary files. This can be abused for Remote Code Execution by writing to a PHP file in the web directory. Also, it can be used in conjunction with the sudo rule for the www-data user to escalate privileges t...
CVE-2020-11108
The Gravity updater in Pi-hole through 4.4 allows an authenticated adversary to upload arbitrary files. This can be abused for Remote Code Execution by writing to a PHP file in the web directory. Also, it can be used in conjunction with the sudo rule for the www-data user to escalate privileges t...
CVE-2020-11108
CVE-2020-11108 affects Pi-hole 4.4 and earlier, via the Gravity updater’s gravity_DownloadBlocklistFromUrl in gravity.sh. An authenticated attacker can upload arbitrary files, enabling remote code execution by writing a PHP file into the webroot. The issue can be leveraged for privilege escalatio...
CVE-2020-11108
The Gravity updater in Pi-hole through 4.4 allows an authenticated adversary to upload arbitrary files. This can be abused for Remote Code Execution by writing to a PHP file in the web directory. Also, it can be used in conjunction with the sudo rule for the www-data user to escalate privileges t...
Avira Operations Avira Software Updater Privilege Vulnerability
Avira Operations Avira Software Updater is a software upgrade management tool for Avira products from Avira Operations. A power-up vulnerability exists in Avira Operations Avira Software Updater prior to version 2.0.6.27476, which stems from the program failing to properly handle hard links to...
CVE-2020-12463
An elevation of privilege vulnerability exists in Avira Software Updater before 2.0.6.27476 due to improperly handling file hard links. This allows local users to obtain take control of arbitrary files...
CVE-2020-12463
An elevation of privilege vulnerability exists in Avira Software Updater before 2.0.6.27476 due to improperly handling file hard links. This allows local users to obtain take control of arbitrary files...
Privilege escalation
An elevation of privilege vulnerability exists in Avira Software Updater before 2.0.6.27476 due to improperly handling file hard links. This allows local users to obtain take control of arbitrary files...
CVE-2020-12463
Avira Software Updater prior to 2.0.6.27476 is affected by an elevation of privilege due to improper handling of file hard links. This allows local users to take control of arbitrary files. CVSSv3.1 base score 7.8 (LOCAL, HIGH impact on confidentiality/integrity/availability); no exploit details ...