Remote Code Execution (RCE)

Apache Synapse uses a vulnerable version of commons-collections. This allows attackers to exploit the use of the vulnerable library to perform remote code execution RCE attacks...

PT-2017-14153

Name of the Vulnerable Software and Affected Versions Apache Synapse versions 1.1.1 through 3.0.1 Description The issue allows remote code execution attacks by injecting specially crafted serialized objects due to the lack of authentication for Java Remote Method Invocation RMI in Apache Synapse...

CVE-2017-15708: Improper Neutralization of Special Elements in Output Used by a Downstream Component

In Apache Synapse, by default no authentication is required for Java Remote Method Invocation RMI. So Apache Synapse 3.0.1 or all previous releases 3.0.0, 2.1.0, 2.0.0, 1.2, 1.1.2, 1.1.1 allows remote code execution attacks that can be performed by injecting specially crafted serialized objects...

Apache Synapse Remote Code Execution Vulnerability

Apache Synapse is a simple, high-quality open source alternative that provides a way to implement SOA by exposing existing applications without having to rewrite any code. A remote code execution vulnerability exists in Apache Synapse, which is caused by the serializability of classes in the Apac...

Design/Logic Flaw

rzpnk.sys in Razer Synapse 2.20.15.1104 allows local users to read and write to arbitrary memory locations, and consequently gain privileges, via a methodology involving a handle to \Device\PhysicalMemory, IOCTL 0x22A064, and ZwMapViewOfSection...

CVE-2017-14398

rzpnk.sys in Razer Synapse 2.20.15.1104 allows local users to read and write to arbitrary memory locations, and consequently gain privileges, via a methodology involving a handle to \Device\PhysicalMemory, IOCTL 0x22A064, and ZwMapViewOfSection...

CVE-2017-14398

rzpnk.sys in Razer Synapse 2.20.15.1104 allows local users to read and write to arbitrary memory locations, and consequently gain privileges, via a methodology involving a handle to \Device\PhysicalMemory, IOCTL 0x22A064, and ZwMapViewOfSection...

CVE-2017-14398

The CVE-2017-14398 entry affects Razer Synapse using rzpnk.sys (v2.20.15.1104). The vulnerability enables local elevation of privilege by a local attacker who uses a handle to \Device\PhysicalMemory, IOCTL 0x22A064, and ZwMapViewOfSection to read/write arbitrary memory locations. This results in ...

CVE-2017-14398

rzpnk.sys in Razer Synapse 2.20.15.1104 allows local users to read and write to arbitrary memory locations, and consequently gain privileges, via a methodology involving a handle to \Device\PhysicalMemory, IOCTL 0x22A064, and ZwMapViewOfSection...

PT-2017-13441

Name of the Vulnerable Software and Affected Versions Razer Synapse version 2.20.15.1104 Description The issue allows local users to read and write to arbitrary memory locations, and consequently gain privileges. This is achieved through a methodology involving a handle to DevicePhysicalMemory,...

CVE-2017-14398: Improper Restriction of Operations within the Bounds of a Memory Buffer

rzpnk.sys in Razer Synapse 2.20.15.1104 allows local users to read and write to arbitrary memory locations, and consequently gain privileges, via a methodology involving a handle to \Device\PhysicalMemory, IOCTL 0x22A064, and ZwMapViewOfSection...

Razer Synapse Local Elevation of Privilege Vulnerability

Razer Synapse is a Razer device configuration software from Razer USA. A security vulnerability exists in Razer Synapse 2.20.15.1104 and earlier versions, which stems from the program assigning weak privileges to the CrashReporter directory. A local attacker can exploit the vulnerability to gain...

Razer Synapse Local Elevation of Privilege Vulnerability (CNVD-2017-29736)

Razer Synapse is a Razer device configuration software from Razer USA. A security vulnerability exists in Razer Synapse 2.20.15.1104 and earlier versions, which stems from the program assigning weak privileges to the Devices path. A local attacker can exploit this vulnerability to gain privileges...

CVE-2017-11652

Razer Synapse 2.20.15.1104 and earlier uses weak permissions for the CrashReporter directory, which allows local users to gain privileges via a Trojan horse dbghelp.dll file...

CVE-2017-11652

Razer Synapse 2.20.15.1104 and earlier uses weak permissions for the CrashReporter directory, which allows local users to gain privileges via a Trojan horse dbghelp.dll file...

CVE-2017-11653

Razer Synapse 2.20.15.1104 and earlier uses weak permissions for the Devices directory, which allows local users to gain privileges via a Trojan horse 1 RazerConfigNative.dll or 2 RazerConfigNativeLOC.dll file...

CVE-2017-11653

Razer Synapse 2.20.15.1104 and earlier uses weak permissions for the Devices directory, which allows local users to gain privileges via a Trojan horse 1 RazerConfigNative.dll or 2 RazerConfigNativeLOC.dll file...

Design/Logic Flaw

Razer Synapse 2.20.15.1104 and earlier uses weak permissions for the CrashReporter directory, which allows local users to gain privileges via a Trojan horse dbghelp.dll file...

Design/Logic Flaw

Razer Synapse 2.20.15.1104 and earlier uses weak permissions for the Devices directory, which allows local users to gain privileges via a Trojan horse 1 RazerConfigNative.dll or 2 RazerConfigNativeLOC.dll file...

CVE-2017-11653

Razer Synapse 2.20.15.1104 and earlier uses weak permissions for the Devices directory, which allows local users to gain privileges via a Trojan horse 1 RazerConfigNative.dll or 2 RazerConfigNativeLOC.dll file...