Spencer Mcintyre

The issue is related to insufficient access control in the administration platform of VMware Workspace ONE Access, VMware Identity Manager, and VMware vRealize Automation. A malicious actor with local access can exploit this to escalate privileges to 'root'.

The issue is related to a privilege escalation vulnerability in the administration platform of VMware Workspace One Access, VMware Identity Manager console, and VMware vRealize Automation virtual infrastructure management tool. This vulnerability is due to insufficient access control. A malicious actor with local access can exploit this issue to escalate privileges to 'root'.

The issue is related to a null pointer dereference in the implementation of the Windows SMBv3 protocol. By sending a malformed `FileNormalizedNameInformation` SMBv3 request over a named pipe, an attacker can cause a Blue Screen of Death (BSOD) crash of the Windows kernel, leading to a denial-of-service. For most systems, this attack requires authentication, except in the special case of Windows Domain Controllers, where unauthenticated users can always open named pipes as long as they can establish an SMB session. Typically, after the BSOD, the victim SMBv3 server will reboot.

The issue is related to a specially crafted IOCTL that can be issued to the rzpnk.sys driver, allowing a handle to be opened to an arbitrary process through ZwOpenProcess. This is due to insufficient access control to the ZwOpenProcess procedure. Exploitation of this issue may allow a remote attacker to open a descriptor for any process.

The issue allows remote attackers to execute arbitrary Python code via a crafted plugin configuration file. This can be achieved by manipulating the plugin configuration file (.cfg) in the Framework Daemon.

A stack-based buffer overflow issue exists, allowing remote attackers to potentially cause a denial of service or execute arbitrary code by sending a crafted string to the TCP port 8001.

The issue is caused by a stack-based buffer overflow in the Firebird database management system. This can be exploited by a remote attacker who sends a specially crafted TCP packet to port 3050, potentially allowing the execution of arbitrary code. The vulnerability is related to a missing size check during the extraction of a group number from CNCT information.

The issue allows remote attackers to bypass authentication via unspecified data associated with a "true" authentication status, related to AMF data and the `LSRoom Remoting.authenticate` function in the "gateway.php" endpoint.