CVE-2023-36393 Windows User Interface Application Core Remote Code Execution Vulnerability

...

Microsoft Windows User Interface security vulnerability

Microsoft Windows is a suite of operating systems for use on personal devices from the U.S.-based Microsoft Corporation. A security vulnerability exists in Microsoft Windows User Interface. An attacker could exploit this vulnerability to remotely execute code. The following products and versions...

PT-2023-6948 · Microsoft · Windows User Interface Application Core +1

Name of the Vulnerable Software and Affected Versions: Windows User Interface Application Core affected versions not specified Description: The issue is related to insufficient input validation in the Windows User Interface Application Core, which can be exploited by attackers to execute arbitrar...

SUSE CVE-2023-31132

Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a privilege escalation vulnerability. A low-privileged OS user with access to a Windows host where Cacti is installed can create arbitrary PHP files in a web document directory. The use...

PT-2023-28783 · Broadcom · Broadcom Raid Controller

Name of the Vulnerable Software and Affected Versions: Broadcom RAID Controller affected versions not specified Description: The Broadcom RAID Controller web interface is vulnerable to exposure of sensitive data. The keys used for encryption are accessible to any local user on Windows...

Microsoft Windows Multiple Vulnerabilities (KB5029253)

This host is missing an important security update according to Microsoft KB5029253 SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescriptio...

CVE-2023-36898

Tablet Windows User Interface Application Core Remote Code Execution Vulnerability...

CVE-2023-34243

TGstation is a toolset to manage production BYOND servers. In affected versions if a Windows user was registered in tgstation-server TGS, an attacker could discover their username by brute-forcing the login endpoint with an invalid password. When a valid Windows logon was found, a distinct respon...

Code injection

TGstation is a toolset to manage production BYOND servers. In affected versions if a Windows user was registered in tgstation-server TGS, an attacker could discover their username by brute-forcing the login endpoint with an invalid password. When a valid Windows logon was found, a distinct respon...

CVE-2023-34243 Windows user name disclosure in TGstation

TGstation is a toolset to manage production BYOND servers. In affected versions if a Windows user was registered in tgstation-server TGS, an attacker could discover their username by brute-forcing the login endpoint with an invalid password. When a valid Windows logon was found, a distinct respon...

CVE-2023-32322 Arbitrary file read in Ombi

Ombi is an open source application which allows users to request specific media from popular self-hosted streaming servers. Versions prior to 4.38.2 contain an arbitrary file read vulnerability where an Ombi administrative user may access files available to the Ombi server process on the host...

CVE-2023-29187 DLL Hijacking vulnerability in SapSetup (Software Installation Program)

A Windows user with basic user authorization can exploit a DLL hijacking attack in SapSetup Software Installation Program - version 9.0, resulting in a privilege escalation running code as administrator of the very same Windows PC. A successful attack depends on various preconditions beyond the...

CVE-2022-47529

Insecure Win32 memory objects in Endpoint Windows Agents in RSA NetWitness Platform before 12.2 allow local and admin Windows user accounts to modify the endpoint agent service configuration: to either disable it completely or run user-supplied code or commands, thereby bypassing tamper-protectio...

CVE-2023-24485

Vulnerabilities have been identified that, collectively, allow a standard Windows user to perform operations as SYSTEM on the computer running Citrix Workspace app...

Design/Logic Flaw

Vulnerabilities have been identified that, collectively, allow a standard Windows user to perform operations as SYSTEM on the computer running Citrix Workspace app...

CVE-2023-24485

Citrix Workspace App for Windows vulnerabilities CVE-2023-24484 and CVE-2023-24485 allow a local user to escalate to SYSTEM during installation/uninstallation of vulnerable versions. AFFECTED SOFTWARE: Citrix Workspace App for Windows (pre-2212; 2203 LTSR before CU2; 1912 LTSR before CU7 Hotfix 2...

South River Technologies TitanFTP NextGen 安全漏洞

South River Technologies TitanFTP NextGen South River Technologies Titan FTP NextGen is a natively supported cluster for high availability and failover SFTP/ FTP server. A security vulnerability exists in South River Technologies TitanFTP NextGen prior to version 1.2.1050, which stems from...

CVE-2022-25154

A DLL hijacking vulnerability in Samsung portable SSD T5 PC software before 1.6.9 could allow a local attacker to escalate privileges. An attacker must already have user privileges on Windows 7, 10, or 11 to exploit this vulnerability...

Microsoft’s privilege escalation vulnerability that refuses to go away

THREAT LEVEL: Amber. For a detailed advisory, download the pdf file here After seven months, a vulnerability that was addressed in August 2021 patch Tuesday remained unpatched. This locally exploited vulnerability is tracked as CVE-2021-34484 and affects the Windows User Profile Service. While...

Microsoft Tablet Windows User Interface 权限许可和访问控制问题漏洞

Microsoft Windows is a suite of operating systems for use on personal devices from Microsoft Corporation USA. A vulnerability exists in Microsoft Tablet Windows User Interface with privilege permission and access control issues. The following products and editions are affected: Windows Server...