James Burton

A use-after-free condition in Windows NetBIOS enables an authorized attacker to elevate privileges locally. Use-after-free is a memory corruption issue that occurs when an application continues to use a pointer after it has been freed.

The issue concerns an unauthenticated Named Pipe channel in the Controlup Real-Time Agent, potentially allowing an attacker to run OS commands via the `ProcessActionRequest` WCF method.

A hardcoded key in the ControlUp Real-Time Agent may allow a potential attacker to run OS commands via a WCF channel.

The issue concerns the web server in Novell ZENworks Configuration Management, which fails to properly authenticate requests to the "zenworks/jsp/index.jsp" endpoint. This allows remote attackers to perform directory traversal attacks, upload, and execute arbitrary programs by sending a request to TCP port 443.