Howard Mcgreehan

يسمح التقييد غير السليم لقناة الاتصال بنقاط النهاية المقصودة لمهاجم مصرح له برفع الامتيازات محليًا.

يؤدي غياب المصادقة على إحدى الوظائف الحيوية في خدمة ترخيص سطح المكتب البعيد في Windows إلى تمكين مهاجم مخول من رفع مستوى امتيازاته محليًّا، مما قد يؤثر على النظام.

يؤدي غياب المصادقة على إحدى الوظائف الحيوية في خدمة ترخيص سطح المكتب البعيد في Windows إلى تمكين مهاجم مخول من رفع مستوى امتيازاته محليًّا، مما قد يؤثر على النظام.

تسمح عملية إزالة مرجعية مؤشر فارغ في خدمة النظام الفرعي لسلطة الأمان المحلية في Windows (LSASS) لمهاجم غير مصرح له بالتسبب في رفض الخدمة عبر الشبكة. تحدث عملية إزالة مرجعية مؤشر فارغ عندما يحاول أحد البرامج القراءة أو الكتابة في موقع ذاكرة باستخدام مؤشر فارغ، مما يؤدي عادةً إلى تعطل النظام.

توجد مشكلة تسمح للمهاجمين بالحصول على معلومات حساسة والتأثير على النظام.

توجد حالة استخدام بعد التحرير في خدمة النظام الفرعي لسلطة الأمان المحلية في Windows (LSASS). وهذا يسمح لمهاجم مخول بتنفيذ تعليمات برمجية عبر الشبكة. يمكن للمهاجمين عن بُعد تنفيذ تعليمات برمجية عشوائية والتأثير على النظام. تتضمن الثغرة الأمنية استخدام الذاكرة بعد تحريرها.

توجد مشكلة تتعلق بعدم كفاية ضوابط الوصول في ملف HTTP.sys بنظام Windows. وهذا يسمح لمهاجم مخول برفع مستوى امتيازاته عبر الشبكة. تتعلق المشكلة بانعكاس المصادقة ضد أهداف HTTP، على غرار مشكلة تم حلها سابقًا في SMB.

The issue is a buffer overflow vulnerability. An unauthenticated remote attacker with administrative privileges can exploit this to execute arbitrary system commands on the device.

The issue concerns a parameter in a certain page of ASUS Download Master that is not properly filtered for user input. This allows a remote attacker with administrative privilege to insert JavaScript code into the parameter, potentially leading to Reflected Cross-site scripting attacks.

The issue arises from a parameter in a certain page of ASUS Download Master that is not properly filtered for user input. This allows a remote attacker with administrative privilege to insert JavaScript code into the parameter, facilitating Stored Cross-site scripting attacks.

The upload functionality does not properly filter user input, allowing remote attackers with administrative privilege to upload any file to any location. This can include uploading malicious web page files to the website directory, enabling the execution of arbitrary system commands when the webpage is browsed.

The specific function parameter of ASUS Download Master does not properly filter user input. An unauthenticated remote attacker with administrative privileges can exploit this issue to execute arbitrary system commands on the device.

The issue is related to a Format String vulnerability, which allows an unauthenticated remote attacker to write to arbitrary memory addresses and perform remote arbitrary code execution, arbitrary system operations, or disrupt service. This vulnerability is associated with the use of uncontrolled format strings.

The issue is related to insufficient filtering for special characters in the HTTP header parameter, allowing a remote attacker with general user privilege to inject JavaScript and perform Stored Cross-Site Scripting (XSS) attacks.

Name of the Vulnerable Software and Affected Versions: Sharp NEC Displays versions UN462A R1.300 and prior to it Sharp NEC Displays versions UN462VA R1.300 and prior to it Sharp NEC Displays versions UN492S R1.300 and prior to it Sharp NEC Displays versions UN492VS R1.300 and prior to it Sharp NEC Displays versions UN552A R1.300 and prior to it Sharp NEC Displays versions UN552S R1.300 and prior to it Sharp NEC Displays versions UN552VS R1.300 and prior to it Sharp NEC Displays versions UN552 R1.300 and prior to it Sharp NEC Displays versions UN552V R1.300 and prior to it Sharp NEC Displays versions UX552S R1.300 and prior to it Sharp NEC Displays versions UX552 R1.300 and prior to it Sharp NEC Displays versions V864Q R2.000 and prior to it Sharp NEC Displays versions C861Q R2.000 and prior to it Sharp NEC Displays versions P754Q R2.000 and prior to it Sharp NEC Displays versions V754Q R2.000 and prior to it Sharp NEC Displays versions C751Q R2.000 and prior to it Sharp NEC Displays versions V984Q R2.000 and prior to it Sharp NEC Displays versions C981Q R2.000 and prior to it Sharp NEC Displays versions P654Q R2.000 and prior to it Sharp NEC Displays versions V654Q R2.000 and prior to it Sharp NEC Displays versions C651Q R2.000 and prior to it Sharp NEC Displays versions V554Q R2.000 and prior to it Sharp NEC Displays versions P404 R3.200 and prior to it Sharp NEC Displays versions P484 R3.200 and prior to it Sharp NEC Displays versions P554 R3.200 and prior to it Sharp NEC Displays versions V404 R3.200 and prior to it Sharp NEC Displays versions V484 R3.200 and prior to it Sharp NEC Displays versions V554 R3.200 and prior to it Sharp NEC Displays versions V404-T R3.200 and prior to it Sharp NEC Displays versions V484-T R3.200 and prior to it Sharp NEC Displays versions V554-T R3.200 and prior to it Sharp NEC Displays versions C501 R2.000 and prior to it Sharp NEC Displays versions C551 R2.000 and prior to it Sharp NEC Displays versions C431 R2.000 and prior to it Description: The issue allows an attacker to obtain root privileges and execute remote code by sending unintended parameters that contain specific characters in an http request. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Sharp NEC Displays versions UN462A R1.300 and prior to it Sharp NEC Displays versions UN462VA R1.300 and prior to it Sharp NEC Displays versions UN492S R1.300 and prior to it Sharp NEC Displays versions UN492VS R1.300 and prior to it Sharp NEC Displays versions UN552A R1.300 and prior to it Sharp NEC Displays versions UN552S R1.300 and prior to it Sharp NEC Displays versions UN552VS R1.300 and prior to it Sharp NEC Displays versions UN552 R1.300 and prior to it Sharp NEC Displays versions UN552V R1.300 and prior to it Sharp NEC Displays versions UX552S R1.300 and prior to it Sharp NEC Displays versions UX552 R1.300 and prior to it Sharp NEC Displays versions V864Q R2.000 and prior to it Sharp NEC Displays versions C861Q R2.000 and prior to it Sharp NEC Displays versions P754Q R2.000 and prior to it Sharp NEC Displays versions V754Q R2.000 and prior to it Sharp NEC Displays versions C751Q R2.000 and prior to it Sharp NEC Displays versions V984Q R2.000 and prior to it Sharp NEC Displays versions C981Q R2.000 and prior to it Sharp NEC Displays versions P654Q R2.000 and prior to it Sharp NEC Displays versions V654Q R2.000 and prior to it Sharp NEC Displays versions C651Q R2.000 and prior to it Sharp NEC Displays versions V554Q R2.000 and prior to it Sharp NEC Displays versions P404 R3.200 and prior to it Sharp NEC Displays versions P484 R3.200 and prior to it Sharp NEC Displays versions P554 R3.200 and prior to it Sharp NEC Displays versions V404 R3.200 and prior to it Sharp NEC Displays versions V484 R3.200 and prior to it Sharp NEC Displays versions V554 R3.200 and prior to it Sharp NEC Displays versions V404-T R3.200 and prior to it Sharp NEC Displays versions V484-T R3.200 and prior to it Sharp NEC Displays versions V554-T R3.200 and prior to it Sharp NEC Displays versions C501 R2.000 and prior to it Sharp NEC Displays versions C551 R2.000 and prior to it Sharp NEC Displays versions C431 R2.000 and prior to it Description: The issue allows an attacker to execute remote code by sending long parameters that contain specific characters in an http request, resulting in a buffer overflow. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.