561 matches found
CVE-2024-23847
The CVE-2024-23847 issue affects Yokogawa Unifier and Unifier Cast (Unifier 5.0+ and Unifier Cast 5.0+, up to before v5.10.6; unpatched versions). Root cause: Incorrect default permissions (Cast Launcher CWE-276) enabling arbitrary code execution with LocalSystem privileges. Impact: potential ins...
JVN#17680667: Multiple vulnerabilities in Unifier and Unifier Cast
Unifier and Unifier Cast provided by Yokogawa Rental ＆ Lease Corporation contains multiple vulnerabilities listed below. Incorrect Default Permissions configured by Cast Launcher CWE-276 CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Base Score 7.8 CVE-2024-23847 Missing Authorization for coejobhoo...
Rapid7 nexpose - (nexposeconsole) Unquoted Service Path Vulnerability
Exploit Title: Rapid7 nexpose - 'nexposeconsole' Unquoted Service Path Exploit Author: Saud Alenazi Vendor Homepage: https://www.rapid7.com/ Software Link: https://www.rapid7.com/products/nexpose/ Version: 6.6.240 Tested: Windows 10 x64 Step to discover Unquoted Service Path: C:\Users\saudhwmic...
Rapid7 nexpose - 'nexposeconsole' Unquoted Service Path
Exploit Title: Rapid7 nexpose - 'nexposeconsole' Unquoted Service Path Date: 2024-04-2 Exploit Author: Saud Alenazi Vendor Homepage: https://www.rapid7.com/ Software Link: https://www.rapid7.com/products/nexpose/ Version: 6.6.240 Tested: Windows 10 x64 Step to discover Unquoted Service Path:...
CVE-2023-50702
Sikka SSCWindowsService 5 2023-09-14 executes a program as LocalSystem but allows full control by low-privileged users and low-privileged users have write access to %PROGRAMDATA%\SSCService. Consequently, low-privileged users can execute arbitrary code as LocalSystem...
CVE-2023-50702
The CVE-2023-50702 entry concerns Sikka SSCWindowsService v5 (2023-09-14). It describes a flaw where the service runs a program as LocalSystem but grants write permissions to %PROGRAMDATA%\SSCService for low-privilege users, enabling them to execute arbitrary code with LocalSystem privileges. Con...
CVE-2023-50702
Sikka SSCWindowsService 5 2023-09-14 executes a program as LocalSystem but allows full control by low-privileged users and low-privileged users have write access to %PROGRAMDATA%\SSCService. Consequently, low-privileged users can execute arbitrary code as LocalSystem...
SikkaSoft Platform Utility 安全漏洞
SikkaSoft Platform Utility is a cloud platform from SikkaSoft, Inc. A security vulnerability exists in SikkaSoft Platform Utility version 5 2023-09-14 that originates from allowing a low-privileged user to execute arbitrary code with LocalSystem privileges...
S4UTomato - Escalate Service Account To LocalSystem Via Kerberos
Escalate Service Account To LocalSystem via Kerberos. Traditional Potatoes Friends familiar with the "Potato" series of privilege escalation should know that it can elevate service account privileges to local system privileges. The early exploitation techniques of "Potato" are almost identical:...
Kingo ROOT 1.5.8 Unquoted Service Path
Exploit Title: Kingo ROOT 1.5.8 - Unquoted Service Path Date: 8/22/2023 Exploit Author: Anish Feroz ZEROXINN Vendor Homepage: https://www.kingoapp.com/ Software Link: https://www.kingoapp.com/android-root/download.htm Version: 1.5.8.3353 Tested on: Windows 10 Pro -------------Discovering Unquoted...
Kingo ROOT 1.5.8 - Unquoted Service Path Vulnerability
Exploit Title: Kingo ROOT 1.5.8 - Unquoted Service Path Exploit Author: Anish Feroz ZEROXINN Vendor Homepage: https://www.kingoapp.com/ Software Link: https://www.kingoapp.com/android-root/download.htm Version: 1.5.8.3353 Tested on: Windows 10 Pro -------------Discovering Unquoted...
CVE-2023-34407
OfflinePlayerService.exe in Harbinger Offline Player 4.0.6.0.2 allows directory traversal as LocalSystem via ..\ in a URL...
CVE-2023-34407
OfflinePlayerService.exe in Harbinger Offline Player 4.0.6.0.2 allows directory traversal as LocalSystem via ..\ in a URL...
Directory traversal
OfflinePlayerService.exe in Harbinger Offline Player 4.0.6.0.2 allows directory traversal as LocalSystem via ..\ in a URL...
PT-2023-24859 · Unknown · Harbinger Offline Player
Name of the Vulnerable Software and Affected Versions: Harbinger Offline Player version 4.0.6.0.2 Description: The issue allows directory traversal as LocalSystem via .. in a URL. This can be exploited in OfflinePlayerService.exe. Recommendations: For Harbinger Offline Player version 4.0.6.0.2,...
CVE-2023-34407
The CVE-2023-34407 entry affects Harbinger Offline Player 4.0.6.0.2, specifically OfflinePlayerService.exe, which allows directory traversal via ..\ in a URL. Reported impact is confidentiality loss (C: High) with no impact to integrity or availability, and CVSSv3.1 base score 7.5 (NETWORK, LOW c...
CVE-2023-34407
OfflinePlayerService.exe in Harbinger Offline Player 4.0.6.0.2 allows directory traversal as LocalSystem via ..\ in a URL...
File Replication Pro 7.5.0 - Privilege Escalation/Password reset due Incorrect Access Control
Exploit Title: File Replication Pro 7.5.0 - Privilege Escalation/Password reset due Incorrect Access Control Date: 2023-04-13 Exploit Author: Andrea Intilangelo Vendor Homepage: http://www.diasoft.net - https://www.filereplicationpro.com Software Link:...
CVE-2023-26918
Diasoft File Replication Pro 7.5.0 allows attackers to escalate privileges by replacing a legitimate file with a Trojan horse that will be executed as LocalSystem. This occurs because %ProgramFiles%\FileReplicationPro allows Everyone:F access...
CVE-2023-26918
Diasoft File Replication Pro 7.5.0 allows attackers to escalate privileges by replacing a legitimate file with a Trojan horse that will be executed as LocalSystem. This occurs because %ProgramFiles%\FileReplicationPro allows Everyone:F access...