MS14-045: Vulnerabilities in kernel-mode drivers could allow elevation of privilege: August 12, 2014

Resolves vulnerabilities in Windows that could allow elevation of privilege if an attacker logs on to the system and runs a specially crafted application.INTRODUCTIONMicrosoft has released security bulletin MS14-045. To learn more about this security bulletin:Home...

MS14-044: Vulnerability in SQL Server Could Allow Elevation of Privilege (2984340) (uncredentialed check)

The remote host has a version of Microsoft SQL Server installed. This version of SQL Server is potentially affected by multiple vulnerabilities : - A cross-site scripting vulnerability exists in the SQL Master Data Services. CVE-2014-1820 - A denial of service vulnerability exists in SQL Server...

Symantec Endpoint Protection Local Client Application Device Control Buffer Overflow

SUMMARY Symantec is aware of a local access Symantec Endpoint Protection SEP client buffer overflow exploit that has been released publicly which could potentially cause a BSOD on the client or possibly allow unauthorized local privilege elevation on Symantec Endpoint Protection SEP clients...

CVE-2014-2781

CVE-2014-2781 describes a local privilege-escalation in Windows On-Screen Keyboard (OSK). A low-integrity process could interact with OSK to load a crafted program, bypassing integrity checks and achieving elevation. Affected products include Windows Vista SP2, Windows Server 2008 SP2/R2 SP1, Win...

MS14-040: Vulnerability in ancillary function driver could allow elevation of privilege: July 8, 2014

Resolves a vulnerability in Windows that could allow elevation of privilege an attacker logs on to a system and runs a specially crafted application.INTRODUCTIONMicrosoft has released security bulletin MS14-040. To learn more about this security bulletin: Home...

Juergen Weigert screen 3.9 User Supplied Format String Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/1641/info Various format string vulnerabilities exist in versions 3.9.5 and prior of 'screen' that may allow local users to elevate their privileges. If screen is setuid root, it is possible to alter the contents of the...

Micro Focus Cobol 4.1 Arbitrary Command Execution Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/2359/info Micro Focus Cobol is a development suite for unix platforms offered by Merant. It is typically licensed on a per-user basis. If Micro Focus Cobol is installed with the 'Apptrack' feature enabled, local users may...

Intego FileGuard 2.0/4.0 Weak Password Encryption Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/3213/info Intego FileGuard is a commercial access control utility for Mac OS versions 7-9.1. It's functionality includes the ability to enforce privileges, log activities, manage user accounts, restrict access by time, et...

Apache suEXEC Privilege Elevation / Information Disclosure

No description provided by source. Apache suEXEC privilege elevation / information disclosure Discovered by Kingcope/Aug 2013 The suEXEC feature provides Apache users the ability to run CGI and SSI programs under user IDs different from the user ID of the calling web server. Normally, when a CGI ...

ISC INN 2.x Command-Line Buffer Overflow Vulnerability (1)

No description provided by source. source: http://www.securityfocus.com/bid/2620/info The innfeed utility, part of ISC InterNetNews, has an exploitable buffer overflow in its command-line parser. Specifically, innfeed will overflow if an overly long -c option is passed to it. A local attacker in...

MS Windows 2000/NT 4/XP Window Message Subsystem Design Error Vulnerability (1)

No description provided by source. source: http://www.securityfocus.com/bid/5408/info A serious design error in the Win32 API has been reported. The issue is related to the inter-window message passing system. This vulnerability is wide-ranging and likely affects almost every Win32 window-based...

KDE 1.1.2 KApplication configfile vulnerability (2)

No description provided by source. source: http://www.securityfocus.com/bid/1291/info The KDE configuration-file management has a bug which could result in root compromise. Due to insecure creation of configuration rc files via KApplication-class, local users can modify ownership of arbitrary fil...

HP Tru64 NLSPATH Environment Variable Local Buffer Overflow Vulnerability (1)

No description provided by source. source: http://www.securityfocus.com/bid/5647/info Tru64 is a commercially available UNIX operating system. Tru64 was originally developed by Digital and is now distributed and maintained by HP. A buffer overflow has been discovered in a number of Tru64 binaries...

Taylor UUCP 1.0.6 Argument Handling Privilege Elevation Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/3312/info Taylor UUCP is an implementation of the UUCP package written originally by Ian Lance Taylor. A problem has been discovered in Taylor UUCP that makes it possible for local users to gain elevated privileges. The...

QPopper 4.0.x PopAuth Trace File Shell Command Execution Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/3710/info Qpopper is a freely available, open source Post Office Protocol server. It is maintained and distributed by Qualcomm. When popauth is executed with the trace option, it does not correctly handle user-supplied...

IM-Switch Insecure Temporary File Handling Symbolic Link Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/10717/info IM-Switch Insecure Temporary File Handling Symbolic Link VulnerabilityIt is reported that im-switch is prone to a local insecure temporary file handling symbolic link vulnerability. This issue is due to a desig...

OReilly WebSite 1.x/2.0 win-c-sample.exe Buffer Overflow Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/2078/info O'Reilly WebSite Pro is a Windows 95/NT Web Server package. Versions 2.0 and below contained a vulnerable sample script, win-c-sample.exe, placed by default in /cgi-shl/ off the web root directory. This program ...

ISC INN 2.x Command-Line Buffer Overflow Vulnerability (2)

No description provided by source. source: http://www.securityfocus.com/bid/2620/info The innfeed utility, part of ISC InterNetNews, has an exploitable buffer overflow in its command-line parser. Specifically, innfeed will overflow if an overly long -c option is passed to it. A local attacker in...

Tarantella Enterprise 3 Symbolic Link Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/4115/info Tarantella Enterprise 3 contains a locally exploitable symbolic link vulnerability during it's installation procedure. This vulnerability can be exploited to elevate privileges. An attacker anticipating the...

Microsoft Windows 2000 / NT 4.0 Process Handle Local Privilege Elevation Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/4287/info A vulnerability in Microsoft Windows 2000 and NT 4 could allow a user to gain SYSTEM-level privileges on the local host. The debugging subsystem, which is available to all users, may be used to create duplicate...