Path traversal

The GLCKIo low-level driver in ASUS Aura Sync v1.07.22 and earlier exposes a path to write an arbitrary DWORD to an arbitrary address...

Code injection

The GLCKIo and Asusgio low-level drivers in ASUS Aura Sync v1.07.22 and earlier expose functionality to read/write data from/to IO ports. This could be leveraged in a number of ways to ultimately run code with elevated privileges...

CVE-2018-18535

The Asusgio low-level driver in ASUS Aura Sync v1.07.22 and earlier exposes functionality to read and write Machine Specific Registers MSRs. This could be leveraged to execute arbitrary ring-0 code...

CVE-2018-18536

The CVE-2018-18536 issue concerns ASUS Aura Sync’s GLCKIo and Asusgio low-level drivers (version 1.07.22 and earlier). The drivers expose functionality to read/write data from/to IO ports, which can be leveraged on a local system to run code with elevated privileges. Documented impact is local co...

CVE-2018-18537

The GLCKIo low-level driver in ASUS Aura Sync v1.07.22 and earlier exposes a path to write an arbitrary DWORD to an arbitrary address...

CVE-2018-18537

CVE-2018-18537 affects the GLCKIo low-level driver in ASUS Aura Sync prior to v1.07.22, where an exposed IOCTL path permits writing an arbitrary DWORD to an arbitrary address due to insufficient access control. This enables local privilege escalation by manipulating kernel memory. Documented impa...

CVE-2018-18536

The GLCKIo and Asusgio low-level drivers in ASUS Aura Sync v1.07.22 and earlier expose functionality to read/write data from/to IO ports. This could be leveraged in a number of ways to ultimately run code with elevated privileges...

CVE-2018-18535

CVE-2018-18535 affects the Asusgio low-level driver in ASUS Aura Sync versions 1.07.22 and earlier. The driver exposes functionality to read and write Machine Specific Registers (MSRs), which can be leveraged to execute arbitrary ring-0 code via local access. The vulnerability is described as a l...

ASUS Aura Sync Arbitrary Code Execution Vulnerability

ASUS Aura Sync is a suite of lighting management software from ASUS. An arbitrary code execution vulnerability exists in ASUS Aura Sync version 1.07.22. A local attacker can exploit this vulnerability to execute arbitrary ring-0 code...

ASUS Aura Sync Arbitrary Code Execution Vulnerability

ASUS Aura Sync is a suite of lighting management software from ASUS. An arbitrary code execution vulnerability exists in ASUS Aura Sync version 1.07.22. A local attacker can exploit this vulnerability to write an arbitrary DWORD to an arbitrary address...

ASUS Aura Sync versions 1.07.22 Driver Privilege Escalation Exploit

Multiple vulnerabilities were found in the GLCKIo and Asusgio drivers installed by ASUS Aura Sync, which could allow a local attacker to elevate privileges. ASUS Aura Sync versions 1.07.22 and below are affected. ASUS Drivers Elevation of Privilege Vulnerabilities 1. Advisory Information Title:...

ASUS Aura Sync Arbitrary Code Execution Vulnerability

ASUS Aura Sync is a suite of lighting management software from ASUS. An arbitrary code execution vulnerability exists in ASUS Aura Sync version 1.07.22, which can be exploited by a local attacker to execute code with elevated privileges...

CVE-2018-15616

CVE-2018-15616 involves the Web UI component of Avaya Aura System Platform. Affected versions include 6.3.0–6.3.9 and 6.4.0–6.4.2. The vulnerability is a targeted deserialization flaw in the Web UI that could allow a remote, unauthenticated user to achieve remote code execution. The available doc...

CVE-2018-15616 System Platform Web UI Deserialization

A vulnerability in the Web UI component of Avaya Aura System Platform could allow a remote, unauthenticated user to perform a targeted deserialization attack that could result in remote code execution. Affected versions of System Platform includes 6.3.0 through 6.3.9 and 6.4.0 through 6.4.2...

CVE-2018-15616

A vulnerability in the Web UI component of Avaya Aura System Platform could allow a remote, unauthenticated user to perform a targeted deserialization attack that could result in remote code execution. Affected versions of System Platform includes 6.3.0 through 6.3.9 and 6.4.0 through 6.4.2...

Deserialization of untrusted data

A vulnerability in the Web UI component of Avaya Aura System Platform could allow a remote, unauthenticated user to perform a targeted deserialization attack that could result in remote code execution. Affected versions of System Platform includes 6.3.0 through 6.3.9 and 6.4.0 through 6.4.2...

Avaya Aura Communication Manager Elevation of Privilege Vulnerability

Avaya Aura Communication Manager is an open and extensible IP telephony platform from Avaya, Inc. with built-in conferencing and contact center applications and support for a wide range of servers, gateways, and other IP-based communications devices. The platform has built-in conferencing and...

CVE-2018-15611

A vulnerability in the local system administration component of Avaya Aura Communication Manager can allow an authenticated, privileged user on the local system to gain root privileges. Affected versions include 6.3.x and all 7.x version prior to 7.1.3.1...

CVE-2018-15611

A vulnerability in the local system administration component of Avaya Aura Communication Manager can allow an authenticated, privileged user on the local system to gain root privileges. Affected versions include 6.3.x and all 7.x version prior to 7.1.3.1...

CVE-2018-15611

CVE-2018-15611 describes an elevation-of-privilege vulnerability in the Avaya Aura Communication Manager’s local system administration component. An authenticated, privileged local user can gain root privileges on affected systems. Affected versions include 6.3.x and all 7.x releases before 7.1.3...