Tobias Neitzel

The issue allows attackers to execute DLL files with SYSTEM privileges by creating a symbolic link from a `%LOCALAPPDATA%TempNcpSupport*` location. This can lead to elevated privileges and potential system compromise.

The issue is related to insecure file permissions in the Support Assistant component of the NCP Secure Enterprise Client. This allows attackers to write to configuration files from low-privileged user accounts.

The issue allows attackers to read registry information of the operating system by creating a symbolic link. This is possible due to a flaw in the Support Assistant component of the NCP Secure Enterprise Client.

The issue allows attackers to read the contents of arbitrary files on the operating system by creating a symbolic link. This is related to the Support Assistant in the NCP Secure Enterprise Client.

The issue allows attackers to delete arbitrary files on the operating system by creating a symbolic link. This is possible due to a flaw in the Support Assistant component of the NCP Secure Enterprise Client.

The issue concerns Apache Karaf's use of Java Management Extensions (JMX) for monitoring applications and the Java runtime. JMX relies on Java serialized objects for client-server communication, and the implementation used by Apache Karaf is not protected against unauthenticated deserialization attacks. The impact of Java deserialization vulnerabilities depends on the classes available within the target's class path. Deserialization of untrusted data represents a high security risk and should be prevented. By default, Karaf uses a limited set of classes in the JMX server class path, which reduces the risk.

The issue allows for Escalation of Privileges due to the following of UNIX symbolic links (symlinks). This can potentially enable a remote attacker to access confidential data, compromise its integrity, and cause a denial of service.

The issue allows for a symbolic link attack on enumusb.reg via Support Assistant.

The issue is related to an insecure file copy in the software.

The issue allows for arbitrary file download.

The issue is related to insecure password storage.

The issue allows OS Command Injection. There is no information about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited.

The issue allows OS Command Injection. There is no information about the estimated number of potentially affected devices or real-world incidents where this issue was exploited.

The issue is related to insufficient filtering, where the `nasty metachars` function interprets ` ` as separate characters (`` and `n`) rather than a newline sequence. This can lead to command injection.

The issue allows PHP code injection.

The issue is a Heap-Based Buffer Overflow. It occurs when a small negative number is interpreted as a large positive number during a bzero call.

The issue allows an unprivileged user to initiate periodic log scans and send the results to a user-specified email address due to a missing authorization check. The email message may contain configuration information about the application that the plugin is installed into.