CVE-2020-27696

Trend Micro Security 2020 Consumer contains a vulnerability in the installer package that could be exploited by placing a specific Windows system directory which can lead to obtaining administrative privileges during the installation of the product...

CVE-2020-27696

Trend Micro Security 2020 Consumer contains a vulnerability in the installer package that could be exploited by placing a specific Windows system directory which can lead to obtaining administrative privileges during the installation of the product...

CVE-2020-27696

Trend Micro Security 2020 Consumer contains a vulnerability in the installer package that could be exploited by placing a specific Windows system directory which can lead to obtaining administrative privileges during the installation of the product...

CVE-2020-5793

A vulnerability in Nessus versions 8.9.0 through 8.12.0 for Windows & Nessus Agent 8.0.0 and 8.1.0 for Windows could allow an authenticated local attacker to copy user-supplied files to a specially constructed path in a specifically named user directory. An attacker could exploit this vulnerabili...

Design/Logic Flaw

A vulnerability in Nessus versions 8.9.0 through 8.12.0 for Windows & Nessus Agent 8.0.0 and 8.1.0 for Windows could allow an authenticated local attacker to copy user-supplied files to a specially constructed path in a specifically named user directory. An attacker could exploit this vulnerabili...

CVE-2020-5793

A vulnerability in Nessus versions 8.9.0 through 8.12.0 for Windows & Nessus Agent 8.0.0 and 8.1.0 for Windows could allow an authenticated local attacker to copy user-supplied files to a specially constructed path in a specifically named user directory. An attacker could exploit this vulnerabili...

Tenable Nessus < 8.12.1 Privilege Escalation Vulnerability (TNS-2020-08)

A vulnerability in Nessus versions 8.9.0 through 8.12.0 could allow an authenticated local attacker to copy user-supplied files to a specially constructed path in a specifically named user directory. An attacker could exploit this vulnerability by creating a malicious file and copying the file to...

mail/dovecot -- multiple vulnerabilities

Aki Tuomi reports: When imap hibernation is active, an attacker can cause Dovecot to discover file system directory structure and access other users' emails using specially crafted command. The attacker must have valid credentials to access the mail server. Mail delivery / parsing crashed when th...

CVE-2020-3920

UltraLog Express device management interface does not properly perform access authentication in some specific pages/functions. Any user can access the privileged page to manage accounts through specific system directory...

CVE-2020-3920

UltraLog Express device management interface does not properly perform access authentication in some specific pages/functions. Any user can access the privileged page to manage accounts through specific system directory...

CVE-2020-3920 Unisoon UltraLog Express - Broken Authentication

UltraLog Express device management interface does not properly perform access authentication in some specific pages/functions. Any user can access the privileged page to manage accounts through specific system directory...

CVE-2020-3920

CVE-2020-3920 affects the UltraLog Express device management interface (Unisoon) where access authentication is not properly enforced on certain pages/functions, enabling any user to reach a privileged page for managing accounts via a system directory. Multiple sources (NVD, CNVD, CVE records, an...

PT-2020-17796 · Ultralog · Ultralog Express

Name of the Vulnerable Software and Affected Versions: UltraLog Express affected versions not specified Description: The UltraLog Express device management interface has an issue with access authentication on certain pages or functions. This allows any user to access a privileged page for managin...

Directory traversal

NETSAS Enigma NMS 65.0.0 and prior suffers from a directory traversal vulnerability that can allow an authenticated user to access files and directories stored outside of the web root folder. By exploiting this vulnerability, it is possible for an attacker to list operating-system directory...

Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path Vulnerability

The Cisco AnyConnect Secure Mobility Client is a virtual private network VPN client for a variety of operating systems and hardware configurations. An uncontrolled search path vulnerability exists in the installer component of the Cisco AnyConnect Secure Mobility Client for Windows versions prior...

CVE-2020-3153 Cisco AnyConnect Secure Mobility Client for Windows Uncontrolled Search Path Vulnerability

A vulnerability in the installer component of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated local attacker to copy user-supplied files to system level directories with system level privileges. The vulnerability is due to the incorrect handling of directory paths...

CVE-2020-3153

Cisco AnyConnect Secure Mobility Client for Windows is affected by CVE-2020-3153: an attacker with valid Windows credentials can exploit the installer IPC path handling to copy files to system directories with SYSTEM privileges, enabling privilege escalation (and DLL hijacking) via vpndownloader....

CVE-2015-1014

A successful exploit of these vulnerabilities requires the local user to load a crafted DLL file in the system directory on servers running Schneider Electric OFS v3.5 with version v7.40 of SCADA Expert Vijeo Citect/CitectSCADA, OFS v3.5 with version v7.30 of Vijeo Citect/CitectSCADA, and OFS v3....

SSSD Information Disclosure Vulnerability

SSSD is a daemon for managing access to remote directories and authentication mechanisms. A security vulnerability exists in SSSD that stems from the program's failure to restrict the privileges of the UNIX pipe. An attacker can exploit the vulnerability by sending a message to read sudo rules...

Input validation

An untrusted search path aka DLL Preloading vulnerability in the Cisco Immunet antimalware installer could allow an authenticated, local attacker to execute arbitrary code via DLL hijacking if a local user with administrative privileges executes the installer in the current working directory wher...