CVE-2020-15528

CVE-2020-15528 affects the GOG Galaxy Client version 2.0.17. The issue is a local privilege escalation caused by weak file permissions and missing file integrity checks, enabling a non-privileged user to elevate privileges when starting or uninstalling a game. Publicly available connected documen...

CVE-2020-15528

An issue was discovered in GOG Galaxy Client 2.0.17. Local escalation of privileges is possible when a user starts or uninstalls a game because of weak file permissions and missing file integrity checks...

CVE-2020-15529

CVE-2020-15529 affects GOG Galaxy Client 2.0.17. The issue is local privilege escalation due to weak file permissions, exploitable via opportunistic locks during game install or verify/repair operations. Documented in NVD/CNVD entries; no exploitation status or patch/version remediation details p...

CVE-2020-15529

An issue was discovered in GOG Galaxy Client 2.0.17. Local escalation of privileges is possible when a user installs a game or performs a verify/repair operation. The issue exists because of weak file permissions and can be exploited by using opportunistic locks...

GOG Galaxy Privilege Permission and Access Control Issues Vulnerability (CNVD-2021-25692)

GOG Galaxy is a game client program from the Polish company GOG. The program is used to install, launch and update games. A vulnerability exists in GOG Galaxy version 1.2.x prior to 1.2.62 and version 2.0.x prior to 2.0.12 in the context of privilege permission and access control issues. An...

GOG GalaxyClientService Privilege Escalation

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core/post/windows/services' require 'openssl' class MetasploitModule 'GOG GalaxyClientService Privilege Escalation', 'Description' = %q This module will sen...

GOG GalaxyClientService Privilege Escalation Exploit

This Metasploit module will send arbitrary filepaths to the GOG GalaxyClientService, which will be executed with SYSTEM privileges verified on GOG Galaxy Client v1.2.62 and v2.0.12; prior versions are also likely affected. This module requires Metasploit: https://metasploit.com/download Current...

GOG GalaxyClientService Privilege Escalation

This module will send arbitrary filepaths to the GOG GalaxyClientService, which will be executed with SYSTEM privileges verified on GOG Galaxy Client v1.2.62 and v2.0.12; prior versions are also likely affected. Module Options msf use exploit/windows/local/gog/galaxyclientserviceprivesc msf...

GOG Galaxy elevation of privilege vulnerability (CNVD-2020-02829)

GOG Galaxy is a game client program. The program is used to install, launch and update games. An elevation of privilege vulnerability exists in the GalaxyClientService installed by GOG Galaxy, which stems from faulty access control. An attacker can exploit this vulnerability by sending...

CVE-2019-15511

An exploitable local privilege escalation vulnerability exists in the GalaxyClientService installed by GOG Galaxy. Due to Improper Access Control, an attacker can send unauthenticated local TCP packets to the service to gain SYSTEM privileges in Windows system where GOG Galaxy software is...

CVE-2019-15511

An exploitable local privilege escalation vulnerability exists in the GalaxyClientService installed by GOG Galaxy. Due to Improper Access Control, an attacker can send unauthenticated local TCP packets to the service to gain SYSTEM privileges in Windows system where GOG Galaxy software is...

Privilege escalation

An exploitable local privilege escalation vulnerability exists in the GalaxyClientService installed by GOG Galaxy. Due to Improper Access Control, an attacker can send unauthenticated local TCP packets to the service to gain SYSTEM privileges in Windows system where GOG Galaxy software is...

CVE-2019-15511

CVE-2019-15511 affects the GalaxyClientService in GOG Galaxy. Root cause: faulty/improper access control enabling unauthenticated local TCP packets to be processed, allowing local privilege escalation to SYSTEM on Windows. Affected products/versions: GOG Galaxy and GalaxyClientService before 1.2....

CVE-2019-15511

An exploitable local privilege escalation vulnerability exists in the GalaxyClientService installed by GOG Galaxy. Due to Improper Access Control, an attacker can send unauthenticated local TCP packets to the service to gain SYSTEM privileges in Windows system where GOG Galaxy software is...

Exploit for Missing Authentication for Critical Function in Gog Galaxy

GOG Galaxy Exploit for CVE-2019-15511 usage: exploit.py -...

GOG Galaxy Privilege Permission and Access Control Issues Vulnerability

GOG Galaxy is a game client program. The program is used to install, launch and update games. A vulnerability exists in GOG Galaxy for privilege permission and access control issues. The vulnerability stems from a lack of effective privilege permission and access control measures on a networked...

CVE-2018-4048

An exploitable local privilege elevation vulnerability exists in the file system permissions of the Temp directory in GOG Galaxy 1.2.48.36 Windows 64-bit Installer. An attacker can overwrite executables of the Desktop Galaxy Updater to exploit this vulnerability and execute arbitrary code with...

Privilege escalation

An exploitable local privilege elevation vulnerability exists in the file system permissions of the Temp directory in GOG Galaxy 1.2.48.36 Windows 64-bit Installer. An attacker can overwrite executables of the Desktop Galaxy Updater to exploit this vulnerability and execute arbitrary code with...

CVE-2018-4048

An exploitable local privilege elevation vulnerability exists in the file system permissions of the Temp directory in GOG Galaxy 1.2.48.36 Windows 64-bit Installer. An attacker can overwrite executables of the Desktop Galaxy Updater to exploit this vulnerability and execute arbitrary code with...

CVE-2018-4048

An exploitable local privilege elevation vulnerability exists in the file system permissions of the Temp directory in GOG Galaxy 1.2.48.36 Windows 64-bit Installer. An attacker can overwrite executables of the Desktop Galaxy Updater to exploit this vulnerability and execute arbitrary code with...