copyple.blogg.se

When a valid Windows logon was found, a distinct response would be generated. In affected versions if a Windows user was registered in tgstation-server (TGS), an attacker could discover their username by brute-forcing the login endpoint with an invalid password. TGstation is a toolset to manage production BYOND servers. NOTE: The vendor considers this a low severity issue. The vulnerability exists in Windows 7 (any Windows until Windows 8) and in any implementation of TCP/IP, which is vulnerable to the Idle scan attack (including many IoT devices). Windows 7 is vulnerable to a full blind TCP/IP hijacking attack.

This issue can allow attackers to open a file dialog box via the function window.print() which can then be used to open an unprivileged command prompt. KioWare for Windows through v8.33 was discovered to contain an incomplete blacklist filter for blocked dialog boxes on Windows 10. This issue can allow attackers to open a file dialog box via the function showDirectoryPicker() which can then be used to open an unprivileged command prompt.

This vulnerability has been fixed in version 0.8.2 and 0.9.3. Any user using Livebook Desktop on Windows is potentially vulnerable to arbitrary code execution when they expect Livebook to be opened from browser. On Windows, it is possible to open a `livebook://` link from a browser which opens Livebook Desktop and triggers arbitrary code execution on victim's machine. Livebook is a web application for writing interactive and collaborative code notebooks.

NOTE: the vendor's perspective is "this is intended behavior as the application can be locked using a password." ** DISPUTED ** Lack of access control in wfc.exe in Malwarebytes Binisoft Windows Firewall Control 6.9.2.0 allows local unprivileged users to bypass Windows Firewall restrictions via the user interface's rules tab. (This is fixed in, for example, Shibboleth Service Provider 3.4.1.3 on Windows.) Shibboleth XMLTooling before 3.2.4, as used in OpenSAML and Shibboleth Service Provider, allows SSRF via a crafted KeyInfo element.