Cesar Cerrudo

The issue allows remote attackers to read hardcoded credentials via the web interface on the Pilot Below Deck Equipment (BDE) and OpenPort implementations.

The issue allows remote attackers to execute arbitrary code by uploading new firmware to the TCP port 54321. This is related to the Terminal Upgrade Tool in the Pilot Below Deck Equipment (BDE) and OpenPort implementations.

The default configuration of the affected devices contains a known SSH private key, allowing remote attackers to obtain root access and spoof alerts via an SSH session.

The issue arises from the Consent User Interface (UI) not properly handling an unspecified registry-key value. This allows local users with SeImpersonatePrivilege rights to gain privileges via a crafted application. The vulnerability could allow an attacker to run code with elevated privileges, potentially executing arbitrary code and taking complete control of an affected system. This could enable the attacker to install programs, view, change, or delete data, or create new accounts with full user rights.

The issue arises from incorrect access control lists (ACLs) on the registry keys for the Tracing Feature for Services in Microsoft Windows. This could allow an attacker to run code with elevated privileges, potentially leading to the execution of arbitrary code and complete control of an affected system. An attacker could then install programs, view, change, or delete data, or create new accounts with full user rights.

The issue arises from the Tracing Feature for Services not properly determining the length of strings in the registry. This allows local users to gain privileges or cause a denial of service through memory corruption by using a long string. An elevation of privilege vulnerability exists due to the way the Tracing Feature for Services allocates memory when processing specially crafted long strings from the registry. An attacker who successfully exploits this could run arbitrary code with system-level privileges, enabling them to install programs, view, change, or delete data, or create new accounts with full user rights.

The issue allows remote attackers to discover a redirect's target URL for a specific user's session on a web site. This is achieved by placing the site's URL in the HREF attribute of a stylesheet LINK element within an IFRAME, and then reading the `document.styleSheets[0].href` property value.

The issue allows remote attackers to discover a redirect's target URL for a specific user's session on a web site. This can be achieved by placing the site's URL in the HREF attribute of a stylesheet LINK element and then reading the `document.styleSheets[0].href` property value.

The issue allows remote attackers to discover a redirect's target URL for a specific user's session on a web site. This is achieved by placing the site's URL in the HREF attribute of a stylesheet LINK element within an IFRAME element, and then reading the `document.styleSheets[0].href` property value.

The issue arises from the RPCSS service in Microsoft Windows not properly isolating processes running under the NetworkService or LocalService accounts. This allows local users to gain privileges by accessing the resources of one of the processes. An attacker could exploit this to run code with elevated privileges, potentially executing arbitrary code and taking complete control of the affected system. This could enable the attacker to install programs, view, change, or delete data, or create new accounts with full user rights.

The issue arises from the Windows Management Instrumentation (WMI) provider not properly isolating processes running under the NetworkService or LocalService accounts. This could allow an attacker to run code with elevated privileges, potentially leading to the execution of arbitrary code and complete control of an affected system. An attacker could then install programs, view, change, or delete data, or create new accounts with full user rights.

The issue arises from the improper implementation of isolation among processes running under the same account, allowing local users to gain privileges by accessing resources of other processes due to incorrect thread ACLs. This could enable an attacker to run code with elevated privileges, potentially leading to the execution of arbitrary code and complete control of the affected system. An attacker could then perform various malicious actions such as installing programs, viewing, changing, or deleting data, or creating new accounts with full user rights.

The issue allows remote authenticated users to overwrite arbitrary files via the log file parameter in the NNSTAT procedure.

The issue is related to the improper management of the SeImpersonatePrivilege user right, allowing context-dependent attackers to gain privileges. This is due to the Microsoft Distributed Transaction Coordinator (MSDTC) transaction facility leaving a NetworkService token that can be impersonated by any process that calls into it. An attacker who successfully exploits this issue could execute arbitrary code and take complete control of an affected system, allowing them to install programs, view, change, or delete data, or create new accounts with full user rights.

Name of the Vulnerable Software and Affected Versions: Microsoft Windows versions 2000 through 2000 SP4 Microsoft Windows versions XP through SP2 Description: A privilege elevation issue exists in the Graphics Rendering Engine, allowing local users to cause a denial of service and gain privileges. This is due to the engine mapping GDI Kernel structures on a global shared memory section that can be remapped by other processes as read-write, enabling modification of kernel structures. The vulnerability could allow a logged-on user to take complete control of the system. Recommendations: For Microsoft Windows 2000 through 2000 SP4, apply the necessary security patches to fix the Graphics Rendering Engine issue. For Microsoft Windows XP through SP2, apply the necessary security patches to fix the Graphics Rendering Engine issue.

The issue is related to an unspecified vulnerability in the Net Listener component of the Oracle Database server. The impact and attack vectors of this issue are not specified.

The issue is related to an integer overflow in the IEEE 802.11 network subsystem, specifically in the ieee80211 ioctl.c file. This occurs while scanning for wireless networks and allows remote attackers to execute arbitrary code. The attack can be carried out by broadcasting crafted beacon or probe response frames.

The issue affects the Oracle Database server and involves multiple unspecified vulnerabilities in various components, including the Data Pump, Net Listener, and Oracle Text components. Specifically, it is claimed by a reliable independent researcher that one of the vulnerabilities, DB06, is a SQL injection issue in certain functions within the DBMS DATAPUMP module, including `GENERATE JOB NAME`, `GET WORKERSTATUSLIST1010`, `GET PARAMVALUES1010`, `GET DUMPFILESET1010`, `GET JOBSTATUS1010`, `ATTACH`, and `ESTABLISH REMOTE CONTEXT`. The exact impact and attack vectors are not specified due to unavailable details from Oracle.

The issue allows remote attackers to bypass security restrictions, execute arbitrary SQL commands, and gain access to sensitive data. The Connection Manager component is affected, but specific details about the impact and attack vectors are not provided.

The issue affects various components of Oracle E-Business Suite and Applications, including the Application Install, Oracle Applications Framework, Oracle Applications Technology Stack, Oracle Human Resources, Oracle Marketing, Marketing Encyclopedia System, Oracle Trade Management, and Oracle Web Applications Desktop Integration components. The vulnerabilities have unspecified impact and attack vectors.