106 matches found
CVE-2023-47132
An issue discovered in N-able N-central before 2023.6 and earlier allows attackers to gain escalated privileges via API calls...
CVE-2023-30297
An issue found in N-able Technologies N-central Server before 2023.4 allows a local attacker to execute arbitrary code via the monitoring function of the server...
CVE-2023-27470
BASupSrvcUpdater.exe in N-able Take Control Agent through 7.0.41.1141 before 7.0.43 has a TOCTOU Race Condition via a pseudo-symlink at %PROGRAMDATA%\GetSupportServiceN-Central\PushUpdates, leading to arbitrary file deletion...
The vulnerability of the N-able N-central monitoring and management platform for IT infrastructure lies in the incorrect restriction on the path name to the catalog, allowing attackers to read arbitrary files.
The vulnerability of the N-able N-central monitoring and management platform relates to an incorrect limitation on the path name for the /WEB-INF directory in the Apache Tomcat application. Exploiting this vulnerability allows a malicious actor to read arbitrary files...
CVE-2024-28200
The N-central server is vulnerable to an authentication bypass of the user interface. This vulnerability is present in all deployments of N-central prior to 2024.2. This vulnerability was discovered through internal N-central source code review and N-able has not observed any exploitation in the...
N-able Ecosystem Agent 安全漏洞
N-able Ecosystem Agent is an agent system from N-able Canada. A security vulnerability exists in N-able Ecosystem Agent that stems from not properly validating SSL/TLS certificates, which could allow a malicious actor to perform man-in-the-middle operations and intercept traffic between the agent...
CVE-2024-5445 Ecosystem Agent Insufficient Transport Layer Security
Ecosystem Agent version 4 4.1.5.2597 and Ecosystem Agent version 5 5.1.4.2473 did not properly validate SSL/TLS certificates, which could allow a malicious actor to perform a Man-in-the-Middle and intercept traffic between the agent and N-able servers from a privileged network position...
CVE-2024-5445
CVE-2024-5445 affects Ecosystem Agent versions 4.0–4.1.5.2597 and 5.0–5.1.4.2473. The root cause is improper validation of SSL/TLS certificates, enabling a potential Man-in-the-Middle between the agent and N-able servers from a privileged network position. Reported across multiple sources (includ...
CVE-2024-28200
The CVE-2024-28200 involves an authentication bypass in the N-central server user interface present in all deployments prior to version 2024.2. The N-central authentication bypass allows access to restricted UI areas without credentials. Connected sources confirm affected software: N-central prio...
N-able N-Central Security Vulnerability
N-able N-Central is a powerful, customizable remote monitoring and management platform from N-able. A security vulnerability previously existed in N-able N-Central version 2024.2, which stemmed from a user interface authentication that could be bypassed...
CVE-2023-37244 Privilege escalation in N-Able's AutomationManagerAgent
The affected AutomationManager.AgentService.exe application contains a TOCTOU race condition vulnerability that allows standard users to create a pseudo-symlink at C:\ProgramData\N-Able Technologies\AutomationManager\Temp, which could be leveraged by an attacker to manipulate the process into...
CVE-2023-37244
The CVE-2023-37244 entry concerns AutomationManager.AgentService.exe and describes a TOCTOU race condition that lets standard users create a pseudo-symlink at C:\ProgramData\N-Able Technologies\AutomationManager\Temp. This could enable an attacker to manipulate the process into performing arbitra...
The vulnerability of the N-able PassPortal data management tool, related to insufficient protection of registration data, allows a perpetrator to gain unauthorized access to protected information.
The vulnerability of the N-able PassPortal data management tool is related to insufficient protection for registration data. Exploiting this vulnerability could allow an attacker to gain unauthorized access to protected information...
CVE-2023-47131
The N-able PassPortal extension before 3.29.2 for Chrome inserts sensitive information into a log file...
CVE-2023-47131
The N-able PassPortal extension before 3.29.2 for Chrome inserts sensitive information into a log file...
CVE-2023-47132
An issue discovered in N-able N-central before 2023.6 and earlier allows attackers to gain escalated privileges via API calls...
Design/Logic Flaw
The N-able PassPortal extension before 3.29.2 for Chrome inserts sensitive information into a log file...
Code injection
An issue discovered in N-able N-central before 2023.6 and earlier allows attackers to gain escalated privileges via API calls...
