Valve: Arbitrary file creation with semi-controlled content (leads to DoS, EoP and others) at Steam Windows Client

The vulnerability allows to create arbitrary file with some crafted text or append to existing file. Tested on actual version 5.31.28.21 SteamService.exe filevesion info. At start of the report I describe how to trigger vulnerability, than describe how to cause any consequences. How to trigger - ...

PT-2019-2922 · Microsoft · Windows Dhcp Client +1

Name of the Vulnerable Software and Affected Versions: Windows DHCP client affected versions not specified Description: A memory corruption issue exists in the Windows DHCP client, allowing an attacker to run arbitrary code on the client machine by sending specially crafted DHCP responses. The...

Steam Windows Client - Local Privilege Escalation Exploit

Steam Windows Client - Local Privilege Escalation Exploit $SteamRegKey = "HKLM:\SOFTWARE\WOW6432Node\Valve\Steam\NSIS" $MSIRegKey = "HKLM:\SYSTEM\CurrentControlSet\Services\msiserver" $RegDir = "C:\Windows\Temp\RegLN.exe" $PayDir = "C:\Windows\Temp\payload.exe" $Payload =...

Steam Windows Client - Local Privilege Escalation

Steam Windows Client - Local Privilege Escalation $SteamRegKey = "HKLM:\SOFTWARE\WOW6432Node\Valve\Steam\NSIS" $MSIRegKey = "HKLM:\SYSTEM\CurrentControlSet\Services\msiserver" $RegDir = "C:\Windows\Temp\RegLN.exe" $PayDir = "C:\Windows\Temp\payload.exe" $Payload = "c:\windows\system32\cmd.exe /c...

CVE-2019-8459

Check Point Endpoint Security Client for Windows, with the VPN blade, before version E80.83, starts a process without using quotes in the path. This can cause loading of a previously placed executable with a name similar to the parts of the path, instead of the intended one...

May 14, 2019—KB4499165 (Security-only update)

None None...

Microsoft Guidance to mitigate Microarchitectural Data Sampling vulnerabilities

Executive Summary On May 14, 2019, Intel published information about a new subclass of speculative execution side channel vulnerabilities known as Microarchitectural Data Sampling. An attacker who successfully exploited these vulnerabilities may be able to read privileged data across trust...

Design/Logic Flaw

Symantec Norton Security prior to 22.16.3, SEP Windows client prior to and including 12.1 RU6 MP9, and prior to 14.2 RU1, SEP SBE prior to Cloud Agent 3.00.31.2817, NIS-22.15.2.22, SEP-12.1.7484.7002 and SEP Cloud prior to 22.16.3 may be susceptible to a kernel memory disclosure, which is a type ...

CVE-2018-18366

Symantec Endpoint Protection Small Business Edition ccSetx86.sys kernel driver (IOCTL 0x224844) has an information-disclosure vulnerability. A specially crafted IRP can cause the driver to return uninitialized kernel memory to a user-mode process, potentially leaking sensitive data. The issue is ...

Sql injection

Norton Security Windows client prior to 22.16.3 and SEP SBE Windows client prior to Cloud Agent 3.00.31.2817, NIS-22.15.2.22 & SEP-12.1.7484.7002, may be susceptible to a DLL Preloading vulnerability, which is a type of issue that can occur when an application looks to call a DLL for execution an...

CVE-2018-18369

Norton Security Windows client prior to 22.16.3 and SEP SBE Windows client prior to Cloud Agent 3.00.31.2817, NIS-22.15.2.22 & SEP-12.1.7484.7002, may be susceptible to a DLL Preloading vulnerability, which is a type of issue that can occur when an application looks to call a DLL for execution an...

CVE-2018-18369

Norton Security Windows client prior to 22.16.3 and SEP SBE Windows client prior to Cloud Agent 3.00.31.2817, NIS-22.15.2.22 & SEP-12.1.7484.7002, may be susceptible to a DLL Preloading vulnerability, which is a type of issue that can occur when an application looks to call a DLL for execution an...

CVE-2019-0697

A memory corruption vulnerability exists in the Windows DHCP client when an attacker sends specially crafted DHCP responses to a client, aka 'Windows DHCP Client Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0698, CVE-2019-0726...

CVE-2019-0726

A memory corruption vulnerability exists in the Windows DHCP client when an attacker sends specially crafted DHCP responses to a client, aka 'Windows DHCP Client Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0697, CVE-2019-0698...

Microsoft Windows DHCP Client Memory Corruption Vulnerability

Microsoft Windows and Microsoft Windows Server are both products of Microsoft Corporation, U.S.A. Microsoft Windows is an operating system for personal devices.Microsoft Windows Server is a server operating system. Windows DHCP Client is one of the Dynamic Host IP Configuration Protocol clients. ...

McAfee Endpoint Security (ENS) Microsoft Windows Client Elevation of Privilege Vulnerability

McAfee Endpoint Security is McAfee's latest antivirus product that provides comprehensive protection against network security threats. An elevation of privilege vulnerability exists in the Microsoft Windows client for McAfee Endpoint Security ENS 10.6.1 and earlier. A local user can exploit the...

CVE-2019-3582

Privilege Escalation vulnerability in Microsoft Windows client in McAfee Endpoint Security ENS 10.6.1 and earlier allows local users to gain elevated privileges via a specific set of circumstances...

Cordaware bestinformed Windows client arbitrary command execution and elevation of privilege vulnerability

Cordaware bestinformed is a mass notification system from the German company Cordaware. A security vulnerability exists in the Scripting and AutoUpdate features in the Cordaware bestinformed Microsoft Windows client prior to version 6.2.1.0. A remote attacker could exploit the vulnerability to...

Cordaware bestinformed has an unspecified vulnerability.

Cordaware bestinformed is a mass notification system from the German company Cordaware. A security vulnerability exists in the Cordaware bestinformed Windows client prior to version 6.2.1.0, which stems from an insecure SSL certificate inspection and access mode. A remote attacker could exploit t...

CVE-2019-6266

Cordaware bestinformed Microsoft Windows client before 6.2.1.0 is affected by insecure SSL certificate verification and insecure access patterns. These issues allow remote attackers to downgrade encrypted connections to cleartext...