CVE-2019-11204

The CVE-2019-11204 entry concerns the web interface component of TIBCO Spotfire Statistics Services. Affected releases are Spotfire Statistics Services up to 7.11.1 and 10.0.0. The vulnerability could allow an authenticated user to access sensitive information (e.g., database, JMX, LDAP, Windows ...

PT-2019-12182 · Tibco · Tibco Spotfire Statistics Services

Name of the Vulnerable Software and Affected Versions: TIBCO Spotfire Statistics Services versions up to and including 7.11.1 TIBCO Spotfire Statistics Services version 10.0.0 Description: The web interface component of TIBCO Spotfire Statistics Services contains an issue that could allow an...

WebEx - Local Service Permissions Exploit (Metasploit)

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'WebEx Local Service Permissions Exploit', 'Description' = %q This module exploits a flaw in the 'webexservice' Windows service, which runs as...

WebEx Local Service Permissions Code Execution Exploit

This Metasploit module exploits a flaw in the 'webexservice' Windows service, which runs as SYSTEM, can be used to run arbitrary commands locally, and can be started by limited users in default installations. This module requires Metasploit: https://metasploit.com/download Current source:...

WebEx Local Service Permissions Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'WebEx Local Service Permissions Exploit', 'Description' = %q This module exploits a flaw in the 'webexservice' Windows service, which runs as...

WebEx Local Service Permissions Exploit

This module exploits a flaw in the 'webexservice' Windows service, which runs as SYSTEM, can be used to run arbitrary commands locally, and can be started by limited users in default installations. Module Options msf use exploit/windows/local/webexec msf undefinedwebexec show actions ...actions...

Lansweeper Arbitrary Code Execution Vulnerability

Lansweeper is a network-assisted software that lists Windows hardware from Lansweeper Belgium. An arbitrary code execution vulnerability exists in Lansweeper. A remote attacker can use a specially crafted Windows service to execute arbitrary code on an administrator's workstation...

Code injection

Lansweeper 4.x through 6.x before 6.0.0.48 allows attackers to execute arbitrary code on the administrator's workstation via a crafted Windows service...

CVE-2015-9264

Lansweeper 4.x through 6.x before 6.0.0.48 allows attackers to execute arbitrary code on the administrator's workstation via a crafted Windows service...

CVE-2015-9264

Lansweeper 4.x through 6.x before 6.0.0.48 allows attackers to execute arbitrary code on the administrator's workstation via a crafted Windows service...

CVE-2015-9264

Lansweeper 4.x–6.x prior to 6.0.0.48 contains a vulnerability that allows an attacker to execute arbitrary code on an administrator’s workstation by supplying a crafted Windows service. Affected product: Lansweeper (Windows, admin workstation context). Root cause: improper handling of Windows ser...

CVE-2017-11672

The OPC Foundation Local Discovery Server LDS before 1.03.367 is installed as a Windows Service without adding double quotes around the opcualds.exe executable path, which might allow local users to gain privileges...

CVE-2017-11672

The OPC Foundation Local Discovery Server LDS before 1.03.367 is installed as a Windows Service without adding double quotes around the opcualds.exe executable path, which might allow local users to gain privileges...

Design/Logic Flaw

The OPC Foundation Local Discovery Server LDS before 1.03.367 is installed as a Windows Service without adding double quotes around the opcualds.exe executable path, which might allow local users to gain privileges...

CVE-2017-11672

The OPC Foundation Local Discovery Server LDS before 1.03.367 is installed as a Windows Service without adding double quotes around the opcualds.exe executable path, which might allow local users to gain privileges...

CVE-2017-11672

The CVE-2017-11672 entry concerns the OPC Foundation Local Discovery Server (LDS) prior to 1.03.367. Root cause: the Windows service for opcualds.exe is registered without surrounding the executable path in quotes, which can allow a local user to gain privileges. Impact is privilege escalation fo...

Windscribe WindscribeService Named Pipe Privilege Escalation

The Windscribe VPN client application for Windows makes use of a Windows service WindscribeService.exe which exposes a named pipe .\pipe\WindscribeService allowing execution of programs with elevated privileges. Windscribe versions prior to 1.82 do not validate user-supplied program names,...

CVE-2018-10645

Golden Frog VyprVPN 2.12.1.8015 for Windows suffers from a SYSTEM privilege escalation vulnerability through the "VyprVPN" service. This service establishes a NetNamedPipe endpoint that allows applications to connect and call publicly exposed methods. The "SetProperty" method allows an attacker t...

Anti-Virus Privileged File Write

Dear list, This mail is not about a single vulnerability, but a more or less general technique I discovered to abuse the restore from quarantine feature in anti-virus solutions to gain local admin rights. As I also presented this attack at the IT SECX conference, I had to invent a name for it too...

CVE-2017-6005

Waves MaxxAudio, as installed on Dell laptops, adds a "WavesSysSvc" Windows service with File Version 1.1.6.0. This service has a vulnerability known as Unquoted Service Path. This could potentially allow an authorized but non-privileged local user to execute arbitrary code with elevated privileg...