CVE-2024-42052

The MSI installer for Splashtop Streamer for Windows before 3.5.8.0 uses a temporary folder with weak permissions during installation. A local user can exploit this to escalate privileges to SYSTEM by placing a wevtutil.exe file in the folder...

CVE-2024-42053

The MSI installer for Splashtop Streamer for Windows before 3.6.0.0 uses a temporary folder with weak permissions during installation. A local user can exploit this to escalate privileges to SYSTEM by placing a version.dll file in the folder...

CVE-2024-42050

The MSI installer for Splashtop Streamer for Windows before 3.7.0.0 uses a temporary folder with weak permissions during installation. A local user can exploit this to escalate privileges to SYSTEM via an oplock on CredProviderInst.reg...

PT-2024-38126 · Unknown · Sourcecodester School Fees Payment System

Name of the Vulnerable Software and Affected Versions: SourceCodester School Fees Payment System version 1.0 Description: A critical issue has been found in the system, affecting the /ajax.php?action=login file. The manipulation of the username argument leads to SQL injection. The attack can be...

CVE-2024-42051

The CVE-2024-42051 issue affects Splashtop Streamer for Windows before version 3.6.2.0. The MSI installer uses a temporary folder with weak permissions during installation, allowing a local user to escalate privileges to SYSTEM by replacing InstRegExp.reg. The vulnerability is a local privilege e...

CVE-2024-42053

The CVE concerns Splashtop Streamer for Windows prior to version 3.6.0.0. The MSI installer creates a temporary folder with weak permissions, allowing a local attacker to place a malicious version.dll and escalate to SYSTEM during installation. Affected component: MSI installer for Windows; root ...

Splashtop Streamer 安全漏洞

Splashtop Streamer is a remote access and remote support software from Splashtop USA. A security vulnerability exists in Splashtop Streamer versions prior to 3.6.0.0 that originates from the MSI installer using a temporary folder with weak privileges during installation. An attacker could exploit...

Splashtop Streamer 安全漏洞

Splashtop Streamer is a remote access and remote support software from Splashtop USA. A security vulnerability exists in Splashtop Streamer prior to version 3.7.0.0, which originates from the MSI installer using a temporary folder with weak privileges during installation. An attacker could exploi...

CVE-2024-42050

The CVE-2024-42050 entry concerns Splashtop Streamer for Windows. The vulnerability stems from the MSI installer creating a temporary folder with weak permissions during installation, enabling a local user to escalate privileges to SYSTEM by triggering an oplock on CredProvider_Inst.reg. Affected...

PT-2024-29712 · Splashtop · Splashtop Streamer

Name of the Vulnerable Software and Affected Versions: Splashtop Streamer for Windows versions prior to 3.5.8.0 Description: The issue concerns the MSI installer for Splashtop Streamer for Windows, which uses a temporary folder with weak permissions during installation. A local user can exploit...

PT-2024-5232 · Acronis · Acronis Cyber Infrastructure

Name of the Vulnerable Software and Affected Versions: Acronis Cyber Infrastructure ACI versions prior to 5.0.1-61 Acronis Cyber Infrastructure ACI versions prior to 5.1.1-71 Acronis Cyber Infrastructure ACI versions prior to 5.2.1-69 Acronis Cyber Infrastructure ACI versions prior to 5.3.1-53...

GHSA-C2HF-VCMR-QJRF Apache Arrow Rust Object Store: AWS WebIdentityToken exposure in log files

Exposure of temporary credentials in logs in Apache Arrow Rust Object Store objectstore crate, version 0.10.1 and earlier on all platforms using AWS WebIdentityTokens. On certain error conditions, the logs may contain the OIDC token passed to AssumeRoleWithWebIdentity...

CVE-2024-41178 Apache Arrow Rust Object Store: AWS WebIdentityToken exposure in log files

Exposure of temporary credentials in logs in Apache Arrow Rust Object Store objectstore crate, version 0.10.1 and earlier on all platforms using AWS WebIdentityTokens. On certain error conditions, the logs may contain the OIDC token passed to AssumeRoleWithWebIdentity...

Moderate: Red Hat Security Advisory: edk2 security update

An update for edk2 is now available for Red Hat Enterprise Linux 8.8 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for eac...

RUSTSEC-2024-0358 Apache Arrow Rust Object Store: AWS WebIdentityToken exposure in log files

Exposure of temporary credentials in logs in Apache Arrow Rust Object Store, version 0.10.1 and earlier on all platforms using AWS WebIdentityTokens. On certain error conditions, the logs may contain the OIDC token passed to AssumeRoleWithWebIdentity. This allows someone with access to the logs t...

How to Securely Onboard New Employees Without Sharing Temporary Passwords

The initial onboarding stage is a crucial step for both employees and employers. However, this process often involves the practice of sharing temporary first-day passwords, which can expose organizations to security risks. Traditionally, IT departments have been cornered into either sharing...

PT-2024-38002 · Tenda · Tenda O3

Name of the Vulnerable Software and Affected Versions: Tenda O3 version 1.0.0.10 Description: A critical issue has been found in the formexeCommand function, where the manipulation of the cmdinput argument leads to a stack-based buffer overflow. This issue can be exploited remotely. The vendor wa...

Huawei EulerOS: Security Advisory for grub2 (EulerOS-SA-2024-2033)

The remote host is missing an update for the Huawei EulerOS SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PT-2024-37871 · Yith · Yith Essential Kit For Woocommerce

Name of the Vulnerable Software and Affected Versions: YITH Essential Kit for WooCommerce versions up to, and including, 2.34.0 Description: The issue allows authenticated attackers with Subscriber-level access and above to modify data without proper authorization. This is due to a missing...

PT-2024-5343 · D Link · D-Link Dir-823X Ax3000 Dual-Band Gigabit Wireless Router

Name of the Vulnerable Software and Affected Versions: D-Link DIR-823X AX3000 Dual-Band Gigabit Wireless Router version v21 D240126 Description: The issue is related to a remote code execution vulnerability in the ntp zone val parameter at the /goform/set ntp API endpoint. This vulnerability can ...