CVE-2023-28351

An issue was discovered in Faronics Insight 10.0.19045 on Windows. Every keystroke made by any user on a computer with the Student application installed is logged to a world-readable directory. A local attacker can trivially extract these cleartext keystrokes, potentially enabling them to obtain...

CVE-2023-28345

An issue was discovered in Faronics Insight 10.0.19045 on Windows. The Insight Teacher Console application exposes the teacher's Console password in cleartext via an API endpoint accessible from localhost. Attackers with physical access to the Teacher Console can open a web browser, navigate to t...

CVE-2023-28349

An issue was discovered in Faronics Insight 10.0.19045 on Windows. It is possible for an attacker to create a crafted program that functions similarly to the Teacher Console. This can compel Student Consoles to connect and put themselves at risk automatically. Connected Student Consoles can be...

CVE-2023-28350

An issue was discovered in Faronics Insight 10.0.19045 on Windows. Attacker-supplied input is not validated/sanitized before being rendered in both the Teacher and Student Console applications, enabling an attacker to execute JavaScript in these applications. Due to the rich and highly privileged...

Faronics Deep Freeze 缓冲区错误漏洞

Faronics Deep Freeze is a system recovery software developed by Faronics, Inc. A buffer error vulnerability exists in Faronics Deep Freeze version 9.00.020.5760, which stems from susceptibility to an out-of-bounds read vulnerability that can trigger the 0x70014 IOCTL code in the FarDisk.sys drive...

Faronics WINSelect Hardcoded Credentials / Bad Permissions / Unhashed Password

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple Vulnerabilities allowing complete bypass product: Faronics WINSelect Standard + Enterprise vulnerable version: 8.30.xx.903 fixed version: 8.30.xx.903 CVE number:...

CVE-2024-36495

The application Faronics WINSelect Standard + Enterprise saves its configuration in an encrypted file on the file system which "Everyone" has read and write access to, path to file: C:\ProgramData\WINSelect\WINSelect.wsd The path for the affected WINSelect Enterprise configuration file is:...

CVE-2024-36495 Read/Write Permissions for Everyone on Configuration File

The application Faronics WINSelect Standard + Enterprise saves its configuration in an encrypted file on the file system which "Everyone" has read and write access to, path to file: C:\ProgramData\WINSelect\WINSelect.wsd The path for the affected WINSelect Enterprise configuration file is:...

CVE-2024-36495 Read/Write Permissions for Everyone on Configuration File

The application Faronics WINSelect Standard + Enterprise saves its configuration in an encrypted file on the file system which "Everyone" has read and write access to, path to file: C:\ProgramData\WINSelect\WINSelect.wsd The path for the affected WINSelect Enterprise configuration file is:...

CVE-2024-36495

CVE-2024-36495 affects Faronics WINSelect (Standard + Enterprise). The configuration files are stored on disk with overly permissive permissions: C:\ProgramData\WINSelect\WINSelect.wsd and, for Enterprise, C:\ProgramData\Faronics\StorageSpace\WS\WINSelect.wsd. The issue arises from an encrypted c...

Faronics WINSelect Trust Management Issues Vulnerability

Faronics WINSelect is an application from Faronics, Inc. It is used to customize the usage configuration of Windows computers. A security vulnerability previously existed in Faronics WINSelect version 8.30.xx.903, which arose from the use of configuration files encrypted with a static key derived...

Faronics WINSelect Security Breach

Faronics WINSelect is an application from Faronics, Inc. It is used to customize the usage configuration of Windows computers. A security vulnerability previously existed in Faronics WINSelect version 8.30.xx.903, which stemmed from improper privilege management of configuration files...

Faronics WINSelect Security Breach

Faronics WINSelect is an application from Faronics, Inc. It is used to customize the usage configuration of Windows computers. A security vulnerability previously existed in Faronics WINSelect version 8.30.xx.903, which arose from a decrypted configuration file containing a plaintext password use...

PT-2024-27029 · Faronics · Winselect

Name of the Vulnerable Software and Affected Versions: Faronics WINSelect Standard + Enterprise affected versions not specified Description: The application saves its configuration in an encrypted file on the file system, which "Everyone" has read and write access to. The paths to the configurati...

PT-2024-27030 · Faronics · Winselect

Name of the Vulnerable Software and Affected Versions: Software affected versions not specified Description: The issue concerns the encryption of a configuration file using a static key derived from a static five-character password. This password is hashed with the outdated MD5 algorithm, which i...

Code injection

A search path or unquoted item vulnerability in Faronics Deep Freeze Server Standard, which affects versions 8.30.020.4627 and earlier. This vulnerability affects the DFServ.exe file. An attacker with local user privileges could exploit this vulnerability to replace the legitimate DFServ.exe...

CVE-2024-1618 Unquoted item or search path vulnerability in Faronics Deep Freeze Server Standard

A search path or unquoted item vulnerability in Faronics Deep Freeze Server Standard, which affects versions 8.30.020.4627 and earlier. This vulnerability affects the DFServ.exe file. An attacker with local user privileges could exploit this vulnerability to replace the legitimate DFServ.exe...

CVE-2024-1618

Affected software: Faronics Deep Freeze Server Standard, version ≤ 8.30.020.4627. Vulnerable component: DFServ.exe (service). Root cause: Unquoted item / search path vulnerability that lets a malicious file with the same name be loaded if placed in a higher-priority directory. Impact: Local attac...

CVE-2024-1618 Unquoted item or search path vulnerability in Faronics Deep Freeze Server Standard

A search path or unquoted item vulnerability in Faronics Deep Freeze Server Standard, which affects versions 8.30.020.4627 and earlier. This vulnerability affects the DFServ.exe file. An attacker with local user privileges could exploit this vulnerability to replace the legitimate DFServ.exe...

PT-2024-18171 · Faronics · Faronics Deep Freeze Server Standard

Name of the Vulnerable Software and Affected Versions: Faronics Deep Freeze Server Standard versions 8.30.020.4627 and earlier Description: A search path or unquoted item vulnerability affects the DFServ.exe file, allowing an attacker with local user privileges to replace the legitimate DFServ.ex...