127 matches found
CVE-2023-47132
An issue discovered in N-able N-central before 2023.6 and earlier allows attackers to gain escalated privileges via API calls...
CVE-2023-47132: Improper Privilege Management
An issue discovered in N-able N-central before 2023.6 and earlier allows attackers to gain escalated privileges via API calls...
CVE-2023-47131: Insertion of Sensitive Information into Log File
The N-able PassPortal extension before 3.29.2 for Chrome inserts sensitive information into a log file...
N-able N-central Web Interface Detection
Binary data nablencentraldetect.nbin...
MuddyWater Returns with a New Spear-Phishing Campaign
Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary MuddyWater, the Iranian nation-state actor, has been identified in a new spearphishing campaign targeting two Israeli entities and deploying a legitimate remote administration tool known as N-able Advanc...
Iran's MuddyWater Targets Israel in New Spear-Phishing Cyber Campaign
The Iranian nation-state actor known as MuddyWater has been linked to a new spear-phishing campaign targeting two Israeli entities to ultimately deploy a legitimate remote administration tool from N-able called Advanced Monitoring Agent. Cybersecurity firm Deep Instinct, which disclosed details o...
N-Able's Take Control Agent Vulnerability Exposes Windows Systems to Privilege Escalation
A high-severity security flaw has been disclosed in N-Able's Take Control Agent that could be exploited by a local unprivileged attacker to gain SYSTEM privileges. Tracked as CVE-2023-27470 CVSS score: 8.8, the issue relates to a Time-of-Check to Time-of-Use TOCTOU race condition vulnerability,...
Race condition
BASupSrvcUpdater.exe in N-able Take Control Agent through 7.0.41.1141 before 7.0.43 has a TOCTOU Race Condition via a pseudo-symlink at %PROGRAMDATA%\GetSupportServiceN-Central\PushUpdates, leading to arbitrary file deletion...
CVE-2023-27470
BASupSrvcUpdater.exe in N-able Take Control Agent through 7.0.41.1141 before 7.0.43 has a TOCTOU Race Condition via a pseudo-symlink at %PROGRAMDATA%\GetSupportServiceN-Central\PushUpdates, leading to arbitrary file deletion...
CVE-2023-27470
CVE-2023-27470 affects BASupSrvcUpdater.exe in N-able Take Control Agent up to version 7.0.41.1141 (before 7.0.43). The issue is a TOCTOU race condition via a pseudo-symlink in the directory %PROGRAMDATA%\GetSupportService_N-Central\PushUpdates, which can lead to arbitrary file deletion on Window...
CVE-2023-27470: Time-of-check Time-of-use (TOCTOU) Race Condition
BASupSrvcUpdater.exe in N-able Take Control Agent through 7.0.41.1141 before 7.0.43 has a TOCTOU Race Condition via a pseudo-symlink at %PROGRAMDATA%\GetSupportServiceN-Central\PushUpdates, leading to arbitrary file deletion...
CVE-2023-30297
An issue found in N-able Technologies N-central Server before 2023.4 allows a local attacker to execute arbitrary code via the monitoring function of the server...
Code injection
An issue found in N-able Technologies N-central Server before 2023.4 allows a local attacker to execute arbitrary code via the monitoring function of the server...
N-able Technologies N-central Server Security Vulnerability
N-able Technologies N-central Server is a comprehensive Remote Monitoring and Management RMM solution from US-based N-able Technologies. A security vulnerability exists in N-able Technologies N-central Server prior to version 2023.4, which originates from the execution of arbitrary code via the...
CVE-2023-30297
The CVE-2023-30297 entry concerns N-able Technologies N-central Server prior to version 2023.4. The issue allows a local attacker to execute arbitrary code through the server’s monitoring function. The root cause is a vulnerability in the monitoring feature that enables code execution with low pr...
CVE-2023-30297
An issue found in N-able Technologies N-central Server before 2023.4 allows a local attacker to execute arbitrary code via the monitoring function of the server...
CVE-2023-30297
An issue found in N-able Technologies N-central Server before 2023.4 allows a local attacker to execute arbitrary code via the monitoring function of the server...
PT-2023-22625 · Alt N Technologies · N-Central Server
Name of the Vulnerable Software and Affected Versions: N-able Technologies N-central Server versions prior to 2023.4 Description: The issue allows a local attacker to execute arbitrary code via the monitoring function of the server. Recommendations: For versions prior to 2023.4, update to version...
CVE-2023-30297: Undefined Security Weakness
An issue found in N-able Technologies N-central Server before 2023.4 allows a local attacker to execute arbitrary code via the monitoring function of the server...
