Privilege escalation

An elevation of privilege vulnerability exists when the Windows Modules Installer improperly handles file operations, aka 'Windows Modules Installer Elevation of Privilege Vulnerability'...

CVE-2020-1346

Technical details about CVE-2020-1346 are not publicly provided in the connected documents. Monitor for updates from official advisories and third-party analyses.

CVE-2020-1346

An elevation of privilege vulnerability exists when the Windows Modules Installer improperly handles file operations, aka 'Windows Modules Installer Elevation of Privilege Vulnerability'...

CVE-2020-15721

RosarioSIS through 6.8-beta allows modules/Custom/NotifyParents.php XSS because of the href attributes for AddStudents.php and User.php...

Servicing stack update for Windows 10, version 2004: July 14, 2004

None None...

Servicing stack update for Windows 10, version 1809: July 14, 2020

None None...

Servicing stack update for Windows Server 2008 SP2: July 14, 2020

Servicing stack update for Windows Server 2008 SP2: July 14, 2020 Applies to Windows Server 2008 for 32-bit Systems Service Pack 2 Windows Server 2008 for 32-bit Systems Service Pack 2 Server Core installation Windows Server 2008 for Itanium-Based Systems Service Pack 2 Windows Server 2008 for...

KB4565529: Windows Server 2008 July 2020 Security Update

The remote Windows host is missing security update 4565529 or cumulative update 4565536. It is, therefore, affected by multiple vulnerabilities : - A remote code execution vulnerability exists in the way that DirectWrite handles objects in memory. An attacker who successfully exploited this...

DroneSploit - Drone Pentesting Framework Console

This CLI framework is based on sploitkit and is an attempt to gather hacking techniques and exploits especially focused on drone hacking. For the ease of use, the interface has a layout that looks like Metasploit. Black Hat Europe Arsenal 2019 presentation Also see articles: Black Hat Europe: New...

CompleteFTP Professional 12.1.3 - Remote Code Execution

Exploit Title: CompleteFTP Professional 12.1.3 - Remote Code Execution Date: 2020-03-11 Exploit Author: 1F98D Original Author: Rhino Security Labs Vendor Homepage: https://enterprisedt.com/products/completeftp/ Version: CompleteFTP Professional Tested on: Windows 10 x64 CVE: CVE‑2019‑16116...

Arista Networks CloudVision Portal Privilege Escalation (SA0044)

The version of Arista Networks CloudVision Portal running on the remote device is affected by a privilege escalation vulnerability. Users with read-only permissions can exploit this to bypass permissions for restricted functionality via CVP API calls through the Configlet Builder modules. This...

[20210101] - Core - com_modules exposes module names

Lack of ACL checks in the orderPosition endpoint of commodules leak names of unpublished and/or inaccessible modules...

The vulnerability of the Windows Modules Installer Service in Microsoft Windows operating systems allows a hacker to exploit their privileges.

The vulnerability of the Windows Modules Installer Service in operating systems is related to incorrect handling of objects in memory. Exploiting this vulnerability can allow an attacker to increase their privileges...

CVE-2020-5594

Mitsubishi Electric MELSEC iQ-R, iQ-F, Q, L, and FX series CPU modules all versions contain a vulnerability that allows cleartext transmission of sensitive information between CPU modules and GX Works3 and/or GX Works2 via unspecified vectors...

CVE-2020-5594

Mitsubishi Electric MELSEC iQ-R, iQ-F, Q, L, and FX series CPU modules all versions contain a vulnerability that allows cleartext transmission of sensitive information between CPU modules and GX Works3 and/or GX Works2 via unspecified vectors...

CVE-2020-5594

Mitsubishi Electric MELSEC iQ-R, iQ-F, Q, L and FX series CPU modules (all versions) are affected by CVE-2020-5594 due to cleartext transmission of sensitive information between CPU modules and GX Works3/GX Works2. The root cause is unsecured (cleartext) communication, with vectors not specified ...

Microcin is here

In February 2020, we observed a Trojan injected into the system process memory on a particular host. The target turned out to be a diplomatic entity. What initially attracted our attention was the enterprise-grade API-like application programming interface programming style. Such an approach is n...

[SECURITY] Fedora 32 Update: mingw-glib-networking-2.64.3-1.fc32

This package contains modules that extend the networking support in GIO...

[SECURITY] Fedora 31 Update: perl-5.30.3-452.fc31

Perl is a high-level programming language with roots in C, sed, awk and she ll scripting. Perl is good at handling processes and files, and is especially good at handling text. Perl's hallmarks are practicality and efficiency. While it is used to do a lot of different things, Perl's most common...

Node.js third-party modules: Arbitrary code execution via untrusted schemas in ajv

I would like to report an arbitrary code execution vulnerability in ajv. It allows to execute arbitrary code if an attacker-controlled schema is passed to the module. I have confirmed that this should be treated as a security issue. I labeled this as low because this is an unusual scenario, usual...