Unspecified Vulnerability in IDrive

IDrive is a suite of cloud backup and cloud storage service solutions from IDrive USA. A security vulnerability exists in versions prior to IDrive 6.7.3.19, which can be exploited by an attacker to modify the contents of directories and subfolders to elevate privileges to NT AUTHORITYSYSTEM...

CVE-2020-15351

IDrive before 6.7.3.19 on Windows installs by default to %PROGRAMFILESX86%\IDriveWindows with weak folder permissions granting any user modify permission i.e., NT AUTHORITY\Authenticated Users:OICIM to the contents of the directory and its sub-folders. In addition, the program installs a service...

CVE-2020-15351

IDrive prior to 6.7.3.19 on Windows installs to %PROGRAMFILES(X86)%\IDriveWindows with weak folder permissions (Authenticated Users: modify) and runs a LocalSystem service (IDriveService). This enables a local user to escalate to SYSTEM by replacing the service binary with a malicious one. Affect...

FF Sandbox Escape (CVE-2020-12388)

By James Forshaw, Project Zero In my previous blog post I discussed an issue with the Windows Kernel’s handling of Restricted Tokens which allowed me to escape the Chrome GPU sandbox. Originally I’d planned to use Firefox for the proof-of-concept as Firefox uses the same effective sandbox level a...

CVE-2020-13162

CVE-2020-13162 (Pulse Secure TOCTOU Privilege Escalation) affects Pulse Secure Windows clients, specifically the Desktop Client and Standalone Installer Service. The vulnerability is a time-of-check to time-of-use race in PulseSecureService.exe that runs with SYSTEM privileges, allowing an unpriv...

CVE-2018-21239

An issue was discovered in Foxit Reader and PhantomPDF before 9.2. It allows NTLM credential theft via a GoToE or GoToR action...

CVE-2020-12431

A Windows privilege change issue was discovered in Splashtop Software Updater before 1.5.6.16. Insecure permissions on the configuration file and named pipe allow for local privilege escalation to NT AUTHORITY/SYSTEM, by forcing a permission change to any Splashtop files and directories, with...

Privilege escalation

A Windows privilege change issue was discovered in Splashtop Software Updater before 1.5.6.16. Insecure permissions on the configuration file and named pipe allow for local privilege escalation to NT AUTHORITY/SYSTEM, by forcing a permission change to any Splashtop files and directories, with...

CVE-2020-12431

A Windows privilege change issue was discovered in Splashtop Software Updater before 1.5.6.16. Insecure permissions on the configuration file and named pipe allow for local privilege escalation to NT AUTHORITY/SYSTEM, by forcing a permission change to any Splashtop files and directories, with...

CVE-2020-12431

The CVE-2020-12431 entry describes a Windows local privilege escalation in Splashtop Software Updater (before 1.5.6.16) due to insecure permissions on the updater’s configuration file and a named pipe, enabling a forced permission change of Splashtop files/directories and DLL hijacking to achieve...

ManageEngine AssetExplorer Authenticated Command Execution Vulnerability

ManageEngine AssetExplorer versions prior to 6.5 6503 suffer from an authenticated remote command execution vulnerability. ManageEngine AssetExplorer Authenticated Command Execution Vulnerability Identifiers ------------------------------------------------- CVE-2019-19034...

ManageEngine AssetExplorer Authenticated Command Execution

XL-2020-004 - Asset Explorer Windows & Linux - Authenticated Command Execution =============================================================================== Identifiers ------------------------------------------------- CVE-2019-19034 XL-20-004 CVSSv3 score...

CVE-2020-12772

An issue was discovered in Ignite Realtime Spark 2.8.3 and the ROAR plugin for it on Windows. A chat message can include an IMG element with a SRC attribute referencing an external host's IP address. Upon access to this external host, the NTLM hashes of the user are sent with the HTTP request. Th...

Design/Logic Flaw

An issue was discovered in Ignite Realtime Spark 2.8.3 and the ROAR plugin for it on Windows. A chat message can include an IMG element with a SRC attribute referencing an external host's IP address. Upon access to this external host, the NTLM hashes of the user are sent with the HTTP request. Th...

DEBIAN-CVE-2020-12783

Exim through 4.93 has an out-of-bounds read in the SPA authenticator that could result in SPA/NTLM authentication bypass in auths/spa.c and auths/auth-spa.c...

ManageEngine Asset Explorer Windows Agent Remote Code Execution

XL-2020-003 - Asset Explorer Windows Agent - Remote Code Execution =============================================================================== Identifiers ------------------------------------------------- CVE-2020-8838 XL-20-003 CVSSv3 score ------------------------------------------------- 7...

G.SKILL Trident Z Lighting Control Elevation of Privilege Vulnerability

G.SKILL Trident Z Lighting Control is a set of lighting control software from G.SKILL, Taiwan, China. An elevation of privilege vulnerability exists in the ene.sys driver in G.SKILL Trident Z Lighting Control 1.00.08 and earlier versions. An attacker can exploit this vulnerability to elevate...

CVE-2020-12446

The ene.sys driver in G.SKILL Trident Z Lighting Control through 1.00.08 exposes mapping and un-mapping of physical memory, reading and writing to Model Specific Register MSR registers, and input from and output to I/O ports to local non-privileged users. This leads to privilege escalation to NT...

Input validation

The ene.sys driver in G.SKILL Trident Z Lighting Control through 1.00.08 exposes mapping and un-mapping of physical memory, reading and writing to Model Specific Register MSR registers, and input from and output to I/O ports to local non-privileged users. This leads to privilege escalation to NT...

EmEditor 19.8 - Insecure File Permissions

Exploit Title: EmEditor 19.8 - Insecure File Permissions Date: 2020-04-27 Exploit Author: SajjadBnd Vendor Homepage: https://www.emeditor.com/ Software Link: https://support.emeditor.com/en/downloads/suggested Version: 19.8 Tested on: Win10 Professional x64 Description EmEditor is a fast,...