Manuel Kiesel

An input validation issue exists in the LenovoProductivitySystemAddin used within Lenovo Vantage and Lenovo Baiying. A locally authenticated user could potentially terminate arbitrary processes with elevated privileges.

An input validation issue exists in the DeviceSettingsSystemAddin component used within Lenovo Vantage and Lenovo Baiying. A local authenticated user could potentially modify arbitrary registry keys with elevated privileges.

An input validation issue exists in the DeviceSettingsSystemAddin component used within Lenovo Vantage and Lenovo Baiying. A local authenticated user could potentially delete arbitrary registry keys with elevated privileges.

The issue arises from improper sanitization of user input in the BestInformed Web application, leading to multiple authenticated stored cross-site scripting vulnerabilities. An authenticated attacker can compromise the sessions of other users on the server by injecting JavaScript code into their sessions. This could enable a form of horizontal movement, as the compromised users might have more privileges than the attacker.

A low-privileged user can change the server address of the bestinformed Server to which the bestinformed Infoclient connects, allowing them to escalate their privileges by abusing certain features of the bestinformed Web server. These features include pushing malicious update packages and arbitrary registry read as nt authoritysystem. An attacker can escalate their privileges to nt authoritysystem on the Windows client running the bestinformed Infoclient. This attack is not possible if a custom configuration (Infoclient.ini) containing the flags ShowOnTaskbar=false or DisabledItems=stPort,stAddress is deployed.

The issue allows an authenticated user in the BestInformed Web application to execute commands on the underlying server running the application, which is a case of remote code execution. This can be achieved by creating `ScriptVars` with the type `script` and previewing them, for example, by creating a new information entry. By default, admin users have the necessary permissions, but with the granular permission system, these permissions can be assigned to other users as well. If an account with the correct permissions is compromised, an attacker can execute commands on the server running the BestInformed Web application.

The issue arises from improper sanitization of user input in the bestinformed Web application, leading to multiple unauthenticated stored cross-site scripting vulnerabilities. An unauthenticated attacker can inject JavaScript code into user sessions, compromising them and potentially abusing the privileges of those users within the application.

A XML External Entity (XXE) vulnerability has been identified in Easy Tax Client Software across multiple platforms, including Windows, Linux, and macOS.