CVE-2019-12574

A vulnerability in the London Trust Media Private Internet Access PIA VPN Client v1.0 for Windows could allow an authenticated, local attacker to run arbitrary code with elevated privileges. The PIA client is vulnerable to a DLL injection vulnerability during the software update process. The...

CVE-2019-12574

The CVE-2019-12574 entry concerns the London Trust Media Private Internet Access (PIA) VPN Client for Windows (v1.0). It is vulnerable to a DLL injection flaw during the software updater process: the updater loads multiple libraries from a folder that authenticated users can write to, enabling a ...

CVE-2019-12578

A vulnerability in the London Trust Media Private Internet Access PIA VPN Client v82 for Linux could allow an authenticated, local attacker to run arbitrary code with elevated privileges. The openvpnlauncher.64 binary is setuid root. This binary executes /opt/pia/openvpn-64/openvpn, passing the...

CVE-2019-12578

Summary: CVE-2019-12578 affects the London Trust Media Private Internet Access (PIA) VPN Client v82 for Linux. An authenticated, local attacker can exploit a setuid root helper (openvpn_launcher.64) that executes /opt/pia/openvpn-64/openvpn with command-line parameters. Although dangerous OpenVPN...

CVE-2019-12571

Affected software: London Trust Media Private Internet Access (PIA) VPN Client for macOS, v0.9.8 beta (build 02099). Vulnerability details: When the client connects, it creates the XML file /tmp/pia-watcher.plist. If this file exists, it is truncated and its contents overwritten by an attacker wi...

CVE-2019-12571

A vulnerability in the London Trust Media Private Internet Access PIA VPN Client v0.9.8 beta build 02099 for macOS could allow an authenticated, local attacker to overwrite arbitrary files. When the client initiates a connection, the XML /tmp/pia-watcher.plist file is created. If the file exists,...

CVE-2019-12576

A vulnerability in the London Trust Media Private Internet Access PIA VPN Client v82 for macOS could allow an authenticated, local attacker to run arbitrary code with elevated privileges. The openvpnlauncher binary is setuid root. This program is called during the connection process and executes...

CVE-2019-12576

CVE-2019-12576 affects the London Trust Media Private Internet Access (PIA) VPN Client v82 for macOS. The openvpn_launcher binary is setuid root and invoked during connection, executing OS utilities to configure the system. The networksetup utility is called using relative paths, and a local unpr...

CVE-2019-12573

The CVE-2019-12573 entry concerns the London Trust Media Private Internet Access (PIA) VPN Client v82 for Linux and macOS. The vulnerability arises in the openvpn_launcher binary, which runs with setuid root. The --log option accepts a file path and is not sanitized, allowing an authenticated loc...

CVE-2019-12573

A vulnerability in the London Trust Media Private Internet Access PIA VPN Client v82 for Linux and macOS could allow an authenticated, local attacker to overwrite arbitrary files. The openvpnlauncher binary is setuid root. This binary supports the --log option, which accepts a path as an argument...

CVE-2019-12577

A vulnerability in the London Trust Media Private Internet Access PIA VPN Client v82 for macOS could allow an authenticated, local attacker to run arbitrary code with elevated privileges. The macOS binary openvpnlauncher.64 is setuid root. This binary creates /tmp/piaupscript.sh when executed...

CVE-2019-12577

CVE-2019-12577 affects the London Trust Media Private Internet Access (PIA) VPN Client v82 for macOS. The macOS binary openvpn_launcher.64 is setuid root and creates /tmp/pia_upscript.sh during connect; because the process’s umask is inherited and not reset, the attacker can cause world-writable ...

CVE-2019-12579

A vulnerability in the London Trust Media Private Internet Access PIA VPN Client v82 for Linux and macOS could allow an authenticated, local attacker to run arbitrary code with elevated privileges. The PIA Linux/macOS binary openvpnlauncher.64 binary is setuid root. This binary accepts several...

CVE-2019-12579

CVE-2019-12579 affects the London Trust Media Private Internet Access (PIA) VPN Client v82 for Linux/macOS. The vulnerability is in the setuid root binary openvpn_launcher.64, which accepts system-configuration parameters that are passed to OS commands via a here document without proper sanitizat...

CVE-2019-12575

A vulnerability in the London Trust Media Private Internet Access PIA VPN Client v82 for Linux could allow an authenticated, local attacker to run arbitrary code with elevated privileges. The rootrunner.64 binary is setuid root. This binary executes /opt/pia/ruby/64/ruby, which in turn attempts t...

CVE-2019-12575

CVE-2019-12575 affects the London Trust Media Private Internet Access (PIA) VPN Client v82 for Linux. The root_runner.64 binary is setuid root and executes /opt/pia/ruby/64/ruby, which loads libraries under /tmp/ruby-deploy.old/lib. A local unprivileged user can place a malicious library in that ...

CVE-2019-9657

Alarm.com ADC-V522IR 0100b9 devices have Incorrect Access Control, a different issue than CVE-2018-19588. This occurs because of incorrect protection of VPN certificates used for initiating a VPN session to the Alarm.com infrastructure on the local camera device...

Design/Logic Flaw

Alarm.com ADC-V522IR 0100b9 devices have Incorrect Access Control, a different issue than CVE-2018-19588. This occurs because of incorrect protection of VPN certificates used for initiating a VPN session to the Alarm.com infrastructure on the local camera device...

CVE-2019-9657

Alarm.com ADC-V522IR 0100b9 devices have Incorrect Access Control, a different issue than CVE-2018-19588. This occurs because of incorrect protection of VPN certificates used for initiating a VPN session to the Alarm.com infrastructure on the local camera device...

CVE-2019-9657

The CVE-2019-9657 entry affects Alarm.com ADC-V522IR 0100b9 devices, where the root cause is the incorrect protection of VPN certificates used to initiate a VPN session to the Alarm.com infrastructure on the local camera device. This results in Incorrect Access Control with an impact on confident...