The vulnerability of Schneider Electric CanBrass software for designing and calculating the cost of hose pipelines lies in the fact that operations can be executed outside the buffer in memory, allowing an attacker to execute arbitrary code.

The vulnerability of Schneider Electric CanBrass’s software for designing and calculating hose pipe costs is related to the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability could allow an attacker to execute arbitrary code...

CVE-2022-24139

In IOBit Advanced System Care AscService.exe 15, an attacker with SEImpersonatePrivilege can create a named pipe with the same name as one of ASCService's named pipes. ASCService first tries to connect before trying to create the named pipes, because of that during login the service will try to...

CVE-2022-24141

The iTopVPNmini.exe component of iTop VPN 3.2 will try to connect to datastateiTopVPNPipeServer on a loop. An attacker that opened a named pipe with the same name can use it to gain the token of another user by listening for connections and abusing ImpersonateNamedPipeClient...

CVE-2022-24139

In IOBit Advanced System Care AscService.exe 15, an attacker with SEImpersonatePrivilege can create a named pipe with the same name as one of ASCService's named pipes. ASCService first tries to connect before trying to create the named pipes, because of that during login the service will try to...

CVE-2022-24141

The iTopVPNmini.exe component of iTop VPN 3.2 will try to connect to datastateiTopVPNPipeServer on a loop. An attacker that opened a named pipe with the same name can use it to gain the token of another user by listening for connections and abusing ImpersonateNamedPipeClient...

CVE-2022-24141

The iTopVPNmini.exe component of iTop VPN 3.2 will try to connect to datastateiTopVPNPipeServer on a loop. An attacker that opened a named pipe with the same name can use it to gain the token of another user by listening for connections and abusing ImpersonateNamedPipeClient...

CVE-2022-24139

In IOBit Advanced System Care AscService.exe 15, an attacker with SEImpersonatePrivilege can create a named pipe with the same name as one of ASCService's named pipes. ASCService first tries to connect before trying to create the named pipes, because of that during login the service will try to...

Code injection

In IOBit Advanced System Care AscService.exe 15, an attacker with SEImpersonatePrivilege can create a named pipe with the same name as one of ASCService's named pipes. ASCService first tries to connect before trying to create the named pipes, because of that during login the service will try to...

Design/Logic Flaw

The iTopVPNmini.exe component of iTop VPN 3.2 will try to connect to datastateiTopVPNPipeServer on a loop. An attacker that opened a named pipe with the same name can use it to gain the token of another user by listening for connections and abusing ImpersonateNamedPipeClient...

CVE-2022-24141

The CVE-2022-24141 vulnerability affects iTop VPN 3.2, specifically the iTopVPNmini.exe component. It can loop connection attempts to the named pipe datastate_iTopVPN_Pipe_Server, allowing an attacker who opens a pipe with the same name to listen for connections and abuse ImpersonateNamedPipeClie...

CVE-2022-24139

The CVE concerns IOBit Advanced System Care, ASCService.exe (version 15). An attacker with SEImpersonatePrivilege can create a named pipe that reuses one of ASCService’s expected named pipe names. ASCService first attempts to connect to the named pipe before creating its pipes, so during login th...

CVE-2022-24139: Exposure of Resource to Wrong Sphere

In IOBit Advanced System Care AscService.exe 15, an attacker with SEImpersonatePrivilege can create a named pipe with the same name as one of ASCService's named pipes. ASCService first tries to connect before trying to create the named pipes, because of that during login the service will try to...

CVE-2022-24141: Undefined Security Weakness

The iTopVPNmini.exe component of iTop VPN 3.2 will try to connect to datastateiTopVPNPipeServer on a loop. An attacker that opened a named pipe with the same name can use it to gain the token of another user by listening for connections and abusing ImpersonateNamedPipeClient...

iTop VPN 安全漏洞

iTop VPN is a VPN software from iTop. It allows users to remain anonymous and secure with advanced Salsa20 chacha20 256-bit encryption. A security vulnerability exists in iTop VPN version 3.2, which stems from the iTopVPNmini.exe component attempting to loop through connections to the...

PT-2022-16489

Name of the Vulnerable Software and Affected Versions IOBit Advanced System Care version 15 Description The issue allows an attacker with SEImpersonatePrivilege to create a named pipe with the same name as one of ASCService's named pipes. ASCService first tries to connect before trying to create...

PT-2022-16491

Name of the Vulnerable Software and Affected Versions iTop VPN version 3.2 Description The issue arises from the iTopVPNmini.exe component trying to connect to a named pipe called datastate iTopVPN Pipe Server in a loop. An attacker can exploit this by opening a named pipe with the same name,...

Exploit for Improper Initialization in Linux Linux_Kernel

CVE-2022-0847 Dirty Pipe Exploitation Impact range: =5.8,...

FortiClient (Windows) - Privilege Escalation via directory traversal attack

A relative path traversal vulnerability CWE-23 in FortiClient for Windows may allow a local unprivileged attacker to escalate their privileges to SYSTEM via the named pipe responsible for FortiESNAC service...

GSD-2022-1003459 pipe: Fix missing lock in pipe_resize_ring()

pipe: Fix missing lock in piperesizering This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.15.45 by commit...

GSD-2022-1003190 pipe: Fix missing lock in pipe_resize_ring()

pipe: Fix missing lock in piperesizering This is an automated ID intended to aid in discovery of potential security vulnerabilities. The actual impact and attack plausibility have not yet been proven. This ID is fixed in Linux Kernel version v5.17.13 by commit...