RSS   Vulnerabilities for
'Privilege management for windows'   RSS

2023-12-11
 
CVE-2020-12613

CWE-noinfo
 
 
An issue was discovered in BeyondTrust Privilege Management for Windows through 5.6. An attacker can spawn a process with multiple users as part of the security token (prior to Avecto elevation). When Avecto elevates the process, it removes the user who is launching the process, but not the second user. Therefore this second user still retains access and can give permission to the process back to the first user.

 
2023-12-12
 
CVE-2020-12614

CWE-noinfo
 
 
An issue was discovered in BeyondTrust Privilege Management for Windows through 5.6. If the publisher criteria is selected, it defines the name of a publisher that must be present in the certificate (and also requires that the certificate is valid). If an Add Admin token is protected by this criteria, it can be leveraged by a malicious actor to achieve Elevation of Privileges from standard user to administrator.

 
 
CVE-2020-28369

CWE-427
 
 
In BeyondTrust Privilege Management for Windows (aka PMfW) through 5.7, a SYSTEM installation causes Cryptbase.dll to be loaded from the user-writable location %WINDIR%\Temp.

 
2021-11-19
 
CVE-2021-42254

CWE-668
 
 
BeyondTrust Privilege Management prior to version 21.6 creates a Temporary File in a Directory with Insecure Permissions.

 

 >>> Vendor: Beyondtrust 3 Products
Privilege management for windows and mac
Privilege management for windows
Appliance base software

Copyright 2024, cxsecurity.com

 

Back to Top