CVE-2023-33778

Draytek Vigor Routers firmware versions below 3.9.6/4.2.4, Access Points firmware versions below v1.4.0, Switches firmware versions below 2.6.7, and Myvigor firmware versions below 2.3.2 were discovered to use hardcoded encryption keys which allows attackers to bind any affected device to their o...

CVE-2023-33778

Draytek Vigor Routers firmware versions below 3.9.6/4.2.4, Access Points firmware versions below v1.4.0, Switches firmware versions below 2.6.7, and Myvigor firmware versions below 2.3.2 were discovered to use hardcoded encryption keys which allows attackers to bind any affected device to their o...

January 11, 2022-KB5008880 Cumulative Update for .NET Framework 3.5 and 4.8 for Windows 11

None None...

January 11, 2022-KB5008877 Cumulative Update for .NET Framework 4.8 for Windows 10, version 1607 and Windows Server, version 2016

None None...

January 11, 2022-KB5008882 Cumulative Update for .NET Framework 3.5 and 4.8 for Microsoft server operating system version 21H2

None None...

January 11, 2022-KB5008879 Cumulative Update for .NET Framework 3.5 and 4.8 for Windows 10, version 1909

None None...

Controlup Real-Time Agent Command Injection Vulnerability

Controlup Real-Time Agent is a real-time agent from Controlup USA. The Controlup Real-Time Agent suffers from a command injection vulnerability that originates from an unauthenticated named pipe channel in the Controlup Real-Time Agent, which can be exploited by an attacker to run operating syste...

Command injection

An unauthenticated Named Pipe channel in Controlup Real-Time Agent cuAgent.exe before 8.5 potentially allows an attacker to run OS commands via the ProcessActionRequest WCF method...

CVE-2021-45913

A hardcoded key in ControlUp Real-Time Agent cuAgent.exe before 8.2.5 may allow a potential attacker to run OS commands via a WCF channel...

Hardcoded credentials

A hardcoded key in ControlUp Real-Time Agent cuAgent.exe before 8.2.5 may allow a potential attacker to run OS commands via a WCF channel...

CVE-2021-45912

Controlup Real-Time Agent (cuAgent.exe) exposes an unauthenticated Named Pipe channel that, before version 8.5, allows an attacker to execute OS commands via the ProcessActionRequest WCF method. Impact is local and could enable command execution with the attacker’s privileges. Remediation per sou...

CVE-2021-45913

A hardcoded key in ControlUp Real-Time Agent cuAgent.exe before 8.2.5 may allow a potential attacker to run OS commands via a WCF channel...

CVE-2021-45913

CVE-2021-45913 affects ControlUp Real-Time Agent (cuAgent.exe) prior to version 8.2.5. Root cause: a hardcoded key in the agent creates a potential weakness that can be exploited to execute operating system commands via a WCF channel. Impact described as allowing an attacker to run OS commands th...

CVE-2021-31475

This vulnerability allows remote attackers to execute arbitrary code on affected installations of SolarWinds Orion Job Scheduler 2020.2.1 HF 2. Authentication is required to exploit this vulnerability. The specific flaw exists within the JobRouterService WCF service. The issue is due to the WCF...

Design/Logic Flaw

This vulnerability allows remote attackers to execute arbitrary code on affected installations of SolarWinds Orion Job Scheduler 2020.2.1 HF 2. Authentication is required to exploit this vulnerability. The specific flaw exists within the JobRouterService WCF service. The issue is due to the WCF...

CVE-2021-31475

This vulnerability allows remote attackers to execute arbitrary code on affected installations of SolarWinds Orion Job Scheduler 2020.2.1 HF 2. Authentication is required to exploit this vulnerability. The specific flaw exists within the JobRouterService WCF service. The issue is due to the WCF...

CVE-2021-31475

CVE-2021-31475 affects SolarWinds Orion Job Scheduler 2020.2.1 HF 2. The flaw resides in the JobRouterService WCF configuration, which allows unprivileged users to access a critical resource, enabling remote code execution in the administrator context. Authentication is required to exploit, with ...

CVE-2021-27277

This vulnerability allows local attackers to escalate privileges on affected installations of SolarWinds Orion Virtual Infrastructure Monitor 2020.2. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific...

CVE-2021-27277

This vulnerability allows local attackers to escalate privileges on affected installations of SolarWinds Orion Virtual Infrastructure Monitor 2020.2. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific...

SolarWinds Orion Virtual Infrastructure Monitor OneTimeJobSchedulerEventsService Deserialization of Untrusted Data Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of SolarWinds Orion Virtual Infrastructure Monitor. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw...