Nabeel Ahmed

يوجد خلل في تنفيذ الأسلوب `FetchStoredLicense` في Senstar Symphony، مما يسمح للمهاجمين عن بُعد بالكشف عن معلومات حساسة دون مصادقة. قد يؤدي هذا الكشف عن المعلومات إلى إفشاء بيانات الاعتماد المخزنة وإلى احتمال تعرض النظام لمخاطر إضافية.

An issue in Axigen Mail Server allows unauthenticated attackers to submit a `setAdminPassword` operation request, setting a new arbitrary password for the `admin` account.

Name of the Vulnerable Software and Affected Versions: Cisco Webex Meetings and Cisco Webex Meetings Server (affected versions not specified) Description: The issue is related to a lack of protection against brute forcing of the host key in the reclaim host role feature. This could allow a remote attacker to take over the host role during a meeting by sending crafted requests to a vulnerable site. A successful exploit would require the attacker to have access to join a Webex meeting, including applicable meeting join links and passwords. Recommendations: As a temporary workaround, consider restricting access to the reclaim host role feature until a patch is available. Restrict access to the `host key` to minimize the risk of exploitation. Avoid using the `reclaim host role` feature in the affected Cisco Webex Meetings or Webex Meetings Server until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue is related to improper input validation of the URL parameters in an HTTP request, allowing an unauthenticated, remote attacker to redirect a user to an untrusted web page, bypassing the warning mechanism. This can be exploited by persuading a user to click a crafted link, potentially leading to phishing attacks. The vulnerability is known as an open redirect attack, which could convince users to unknowingly visit malicious sites.

Name of the Vulnerable Software and Affected Versions: Windows (affected versions not specified) Description: The issue is related to an elevation of privilege vulnerability that exists when Group Policy improperly checks access. This could allow an attacker to run processes in an elevated context. To exploit this, an attacker would first need to log on to the system and then run a specially crafted application to take control over the affected system. The vulnerability is also described as a buffer overflow issue in the Group Policy Services of the Windows operating system, which could allow an attacker to elevate their privileges. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue is related to a missing certification validation in the GlobalProtect app when the pre-logon feature is enabled. This can disclose the pre-logon authentication cookie to a man-in-the-middle attacker on the same local area network segment with the ability to manipulate ARP or conduct ARP spoofing attacks. The attacker can access the GlobalProtect Server as allowed by configured Security rules for the 'pre-login' user, although this access may be limited compared to regular users.

The issue is related to a lack of proper access control in the Windows group policy, allowing a remote attacker to potentially elevate their privileges and execute arbitrary code using a specially crafted application. This can affect the system, enabling attackers to impact it.

A vulnerability in the improper handling of junctions before deletion can allow an attacker to trigger a denial of service on the affected device.

The issue allows a local attacker to disclose sensitive information or create a denial-of-service condition on affected installations. To exploit this, an attacker must first obtain the ability to execute low-privileged code on the target system.

The issue is related to errors in handling hard links in the Windows AppX Deployment Service (AppXSVC), which can be exploited by an attacker to elevate their privileges using a specially crafted application. An elevation-of-privilege vulnerability allows attackers to affect the system. There have been reports of a bypass for the recent Windows patch, with a second zero-day exploit disclosed that apparently bypasses Microsoft's patch for a Windows Elevation of Privilege (EoP) vulnerability.

Name of the Vulnerable Software and Affected Versions: Microsoft Windows Server 2008 SP2 and R2 SP1 Microsoft Windows 7 SP1 Microsoft Windows 8.1 and RT 8.1 Microsoft Windows Server 2012 and R2 Microsoft Windows 10 versions 1511, 1607, 1703, and 1709 Microsoft Windows Server 2016 and Windows Server, version 1709 Description: The issue is related to how XML External Entities (XXE) are processed, allowing an information disclosure. This could enable attackers to obtain sensitive information and affect the system. Recommendations: For Microsoft Windows Server 2008 SP2 and R2 SP1, update to a newer version to mitigate the risk. For Microsoft Windows 7 SP1, update to a newer version to mitigate the risk. For Microsoft Windows 8.1 and RT 8.1, update to a newer version to mitigate the risk. For Microsoft Windows Server 2012 and R2, update to a newer version to mitigate the risk. For Microsoft Windows 10 versions 1511, 1607, 1703, and 1709, update to a newer version to mitigate the risk. For Microsoft Windows Server 2016 and Windows Server, version 1709, update to a newer version to mitigate the risk. As a temporary workaround, consider restricting the use of Windows Remote Assistance until a patch is available.

The issue is related to how specially crafted requests are handled by the Microsoft Server Message Block 2.0 and 3.0 (SMBv2/SMBv3) client, leading to a denial of service vulnerability. This vulnerability is caused by insufficient input validation in the mrxsmb.sys module, which implements the SMBv2/SMBv3 protocol in Windows operating systems. An attacker could exploit this vulnerability by sending a specially crafted packet, allowing them to cause a denial of service in the SMB client.

The issue allows authenticated users to edit documents of other users without proper permissions. This is due to a problem in the includes/component.php file of the BuddyPress Docs plugin for WordPress.

The issue allows man-in-the-middle attackers to bypass authentication via vectors related to a fallback to NTLM authentication during a domain account password change. This is due to insufficient access restrictions in the Windows operating system, which can be exploited by a remote attacker to bypass the authentication procedure by affecting the NTLM authentication system during a domain account password change.

The issue is related to errors in LDAP authentication handling, which can be exploited by man-in-the-middle attackers to gain privileges. This is achieved by modifying group-policy update data within a domain-controller data stream. The estimated number of potentially affected devices worldwide is not specified. There is no information about real-world incidents where this issue was exploited. Technical details about exploitation include the manipulation of LDAP authentication, allowing attackers to elevate their privileges.

The issue is related to the Kerberos component in Microsoft Windows, which does not properly validate password changes. This allows remote attackers to bypass authentication by deploying a crafted Key Distribution Center (KDC) and then performing a sign-in action. The vulnerability is also related to errors in managing registration data, which can be exploited by a local attacker to bypass the authentication procedure. Additionally, the vulnerability can be used to bypass Kerberos authentication on a target machine and decrypt drives protected by BitLocker.