Garrett Foster

Weak authentication in Microsoft Configuration Manager allows an unauthorized attacker to disclose information over a network.

Improper input validation exists in System Center Operations Manager, potentially allowing an authorized attacker to elevate privileges over a network.

Name of the Vulnerable Software and Affected Versions: PDQ Smart Deploy version 3.0.2040 Description: An insecure permissions issue exists in PDQ Smart Deploy version 3.0.2040. A local attacker can execute arbitrary code via the `HKLMSYSTEMSetupSmartDeploy` component. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: PDQ Smart Deploy version 3.0.2040 Description: An issue allows an attacker to escalate privileges via the credential encryption routines in SDCommon.dll. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

A file disclosure issue allows a remote, unauthenticated attacker to retrieve survey user submitted data by modifying the `ID` parameter in sequential order beginning from 1 in the "UploadedImageDisplay.aspx" endpoint.

The issue allows a remote, unauthenticated attacker to retrieve data from the application's backend database. This is achieved through SQL injection in the `ID` parameter of the "UploadedImageDisplay.aspx" endpoint. The attack can be performed using boolean-based blind and UNION injection techniques.