Search
Find a vulnerability
Search criteria
4 vulnerabilities found for surelock by 42gears
CVE-2023-2335 (GCVE-0-2023-2335)
Vulnerability from nvd – Published: 2023-04-27 17:55 – Updated: 2025-01-30 20:54
VLAI
EPSS
VEX
Title
Plaintext Password in Registry
Summary
Plaintext Password in Registry
vulnerability in 42gears surelock windows surelockwinsetupv2.40.0.Exe on Windows (Registery modules) allows Retrieve
Admin user credentials
This issue affects surelock windows: from 2.3.12 through 2.40.0.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| 42gears | surelock windows |
Affected:
2.3.12 , ≤ 2.40.0
(Patch)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T06:19:14.760Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.42gears.com/security-and-compliance/"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-2335",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-01-30T20:54:37.364693Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-01-30T20:54:42.317Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://mars.42gears.com/support/inout/surelockwinsetupv2.40.0.exe",
"defaultStatus": "unaffected",
"modules": [
"Registery"
],
"packageName": "surelockwinsetupv2.40.0.exe",
"platforms": [
"Windows"
],
"product": "surelock windows",
"vendor": "42gears",
"versions": [
{
"lessThanOrEqual": "2.40.0",
"status": "affected",
"version": "2.3.12",
"versionType": "Patch"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\n\n\u003cspan style=\"background-color: transparent;\"\u003ePlaintext Password in Registry\u003c/span\u003e\n\n vulnerability in 42gears surelock windows surelockwinsetupv2.40.0.Exe on Windows (Registery modules) allows Retrieve \n\n\u003cspan style=\"background-color: transparent;\"\u003eAdmin user credentials\u003c/span\u003e\n\n\u003cp\u003eThis issue affects surelock windows: from 2.3.12 through 2.40.0.\u003c/p\u003e"
}
],
"value": "\nPlaintext Password in Registry\n\n vulnerability in 42gears surelock windows surelockwinsetupv2.40.0.Exe on Windows (Registery modules) allows Retrieve \n\nAdmin user credentials\n\nThis issue affects surelock windows: from 2.3.12 through 2.40.0.\n\n"
}
],
"impacts": [
{
"capecId": "CAPEC-37",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-37 Retrieve Embedded Sensitive Data"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-314",
"description": "CWE-314: Cleartext Storage in the Registry",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-312",
"description": "CWE-312 Cleartext Storage of Sensitive Information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-04-27T17:57:35.096Z",
"orgId": "e5d7a401-f4d6-4559-911a-da9b371cd8ce",
"shortName": "42Gears"
},
"references": [
{
"url": "https://www.42gears.com/security-and-compliance/"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Plaintext Password in Registry",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Upgrade to \n2.41.0\n\n\u003cbr\u003e"
}
],
"value": "Upgrade to \n2.41.0\n\n\n"
}
],
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "e5d7a401-f4d6-4559-911a-da9b371cd8ce",
"assignerShortName": "42Gears",
"cveId": "CVE-2023-2335",
"datePublished": "2023-04-27T17:55:49.876Z",
"dateReserved": "2023-04-27T09:46:47.715Z",
"dateUpdated": "2025-01-30T20:54:42.317Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-2331 (GCVE-0-2023-2331)
Vulnerability from nvd – Published: 2023-04-27 11:51 – Updated: 2025-01-30 21:00
VLAI
EPSS
VEX
Title
Bypassing hardening via Unquoted Service path vulnerability
Summary
Unquoted service Path or Element vulnerability in 42Gears Surelock Windows SureLock Service (NixService.Exe) on Windows application will allows to insert arbitrary code into the service.
This issue affects Surelock Windows : from 2.3.12 through 2.40.0.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-428 - Unquoted Search Path or Element
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.42gears.com/security-and-compliance | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| 42Gears | Surelock Windows |
Affected:
2.3.12 , ≤ 2.40.0
(patch)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T06:19:14.680Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://www.42gears.com/security-and-compliance"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-2331",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-01-30T21:00:48.147460Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-01-30T21:00:57.199Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://mars.42gears.com/support/inout/surelockwinsetupv2.40.0.exe",
"defaultStatus": "unaffected",
"packageName": "SureLock Service (NixService.exe)",
"platforms": [
"Windows"
],
"product": "Surelock Windows ",
"vendor": "42Gears",
"versions": [
{
"lessThanOrEqual": "2.40.0",
"status": "affected",
"version": "2.3.12",
"versionType": "patch"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Unquoted service Path or Element vulnerability in 42Gears Surelock Windows SureLock Service (NixService.Exe) on Windows application will allows to insert arbitrary code into the service.\u003cbr\u003e\u003cp\u003eThis issue affects Surelock Windows : from 2.3.12 through 2.40.0.\u003c/p\u003e"
}
],
"value": "Unquoted service Path or Element vulnerability in 42Gears Surelock Windows SureLock Service (NixService.Exe) on Windows application will allows to insert arbitrary code into the service.\nThis issue affects Surelock Windows : from 2.3.12 through 2.40.0.\n\n"
}
],
"impacts": [
{
"capecId": "CAPEC-233",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-233 Privilege Escalation"
}
]
},
{
"capecId": "CAPEC-549",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-549 Local Execution of Code"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-428",
"description": "CWE-428 Unquoted Search Path or Element",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-04-28T07:16:21.298Z",
"orgId": "e5d7a401-f4d6-4559-911a-da9b371cd8ce",
"shortName": "42Gears"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.42gears.com/security-and-compliance"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cb\u003eUpgrade to\u003c/b\u003e\u003cspan style=\"background-color: transparent;\"\u003e\u003cb\u003e\u0026nbsp;SureLock windows agent version 2.41.0\u003c/b\u003e\u003c/span\u003e \n\n"
}
],
"value": "Upgrade to\u00a0SureLock windows agent version 2.41.0 \n\n"
}
],
"source": {
"advisory": "01",
"discovery": "EXTERNAL"
},
"title": "Bypassing hardening via Unquoted Service path vulnerability",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "e5d7a401-f4d6-4559-911a-da9b371cd8ce",
"assignerShortName": "42Gears",
"cveId": "CVE-2023-2331",
"datePublished": "2023-04-27T11:51:45.946Z",
"dateReserved": "2023-04-27T09:20:29.336Z",
"dateUpdated": "2025-01-30T21:00:57.199Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-2335 (GCVE-0-2023-2335)
Vulnerability from cvelistv5 – Published: 2023-04-27 17:55 – Updated: 2025-01-30 20:54
VLAI
EPSS
VEX
Title
Plaintext Password in Registry
Summary
Plaintext Password in Registry
vulnerability in 42gears surelock windows surelockwinsetupv2.40.0.Exe on Windows (Registery modules) allows Retrieve
Admin user credentials
This issue affects surelock windows: from 2.3.12 through 2.40.0.
Severity
6.5 (Medium)
SSVC
Exploitation: none
Automatable: no
Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
Assigner
References
1 reference
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| 42gears | surelock windows |
Affected:
2.3.12 , ≤ 2.40.0
(Patch)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T06:19:14.760Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_transferred"
],
"url": "https://www.42gears.com/security-and-compliance/"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-2335",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-01-30T20:54:37.364693Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-01-30T20:54:42.317Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://mars.42gears.com/support/inout/surelockwinsetupv2.40.0.exe",
"defaultStatus": "unaffected",
"modules": [
"Registery"
],
"packageName": "surelockwinsetupv2.40.0.exe",
"platforms": [
"Windows"
],
"product": "surelock windows",
"vendor": "42gears",
"versions": [
{
"lessThanOrEqual": "2.40.0",
"status": "affected",
"version": "2.3.12",
"versionType": "Patch"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\n\n\u003cspan style=\"background-color: transparent;\"\u003ePlaintext Password in Registry\u003c/span\u003e\n\n vulnerability in 42gears surelock windows surelockwinsetupv2.40.0.Exe on Windows (Registery modules) allows Retrieve \n\n\u003cspan style=\"background-color: transparent;\"\u003eAdmin user credentials\u003c/span\u003e\n\n\u003cp\u003eThis issue affects surelock windows: from 2.3.12 through 2.40.0.\u003c/p\u003e"
}
],
"value": "\nPlaintext Password in Registry\n\n vulnerability in 42gears surelock windows surelockwinsetupv2.40.0.Exe on Windows (Registery modules) allows Retrieve \n\nAdmin user credentials\n\nThis issue affects surelock windows: from 2.3.12 through 2.40.0.\n\n"
}
],
"impacts": [
{
"capecId": "CAPEC-37",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-37 Retrieve Embedded Sensitive Data"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-314",
"description": "CWE-314: Cleartext Storage in the Registry",
"lang": "en",
"type": "CWE"
}
]
},
{
"descriptions": [
{
"cweId": "CWE-312",
"description": "CWE-312 Cleartext Storage of Sensitive Information",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-04-27T17:57:35.096Z",
"orgId": "e5d7a401-f4d6-4559-911a-da9b371cd8ce",
"shortName": "42Gears"
},
"references": [
{
"url": "https://www.42gears.com/security-and-compliance/"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Plaintext Password in Registry",
"workarounds": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Upgrade to \n2.41.0\n\n\u003cbr\u003e"
}
],
"value": "Upgrade to \n2.41.0\n\n\n"
}
],
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "e5d7a401-f4d6-4559-911a-da9b371cd8ce",
"assignerShortName": "42Gears",
"cveId": "CVE-2023-2335",
"datePublished": "2023-04-27T17:55:49.876Z",
"dateReserved": "2023-04-27T09:46:47.715Z",
"dateUpdated": "2025-01-30T20:54:42.317Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2023-2331 (GCVE-0-2023-2331)
Vulnerability from cvelistv5 – Published: 2023-04-27 11:51 – Updated: 2025-01-30 21:00
VLAI
EPSS
VEX
Title
Bypassing hardening via Unquoted Service path vulnerability
Summary
Unquoted service Path or Element vulnerability in 42Gears Surelock Windows SureLock Service (NixService.Exe) on Windows application will allows to insert arbitrary code into the service.
This issue affects Surelock Windows : from 2.3.12 through 2.40.0.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator (v2.0.3)
CWE
- CWE-428 - Unquoted Search Path or Element
Assigner
References
1 reference
| URL | Tags |
|---|---|
| https://www.42gears.com/security-and-compliance | vendor-advisory |
Impacted products
1 product
| Vendor | Product | Version | |
|---|---|---|---|
| 42Gears | Surelock Windows |
Affected:
2.3.12 , ≤ 2.40.0
(patch)
|
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T06:19:14.680Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://www.42gears.com/security-and-compliance"
}
],
"title": "CVE Program Container"
},
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2023-2331",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-01-30T21:00:48.147460Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2025-01-30T21:00:57.199Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"collectionURL": "https://mars.42gears.com/support/inout/surelockwinsetupv2.40.0.exe",
"defaultStatus": "unaffected",
"packageName": "SureLock Service (NixService.exe)",
"platforms": [
"Windows"
],
"product": "Surelock Windows ",
"vendor": "42Gears",
"versions": [
{
"lessThanOrEqual": "2.40.0",
"status": "affected",
"version": "2.3.12",
"versionType": "patch"
}
]
}
],
"descriptions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "Unquoted service Path or Element vulnerability in 42Gears Surelock Windows SureLock Service (NixService.Exe) on Windows application will allows to insert arbitrary code into the service.\u003cbr\u003e\u003cp\u003eThis issue affects Surelock Windows : from 2.3.12 through 2.40.0.\u003c/p\u003e"
}
],
"value": "Unquoted service Path or Element vulnerability in 42Gears Surelock Windows SureLock Service (NixService.Exe) on Windows application will allows to insert arbitrary code into the service.\nThis issue affects Surelock Windows : from 2.3.12 through 2.40.0.\n\n"
}
],
"impacts": [
{
"capecId": "CAPEC-233",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-233 Privilege Escalation"
}
]
},
{
"capecId": "CAPEC-549",
"descriptions": [
{
"lang": "en",
"value": "CAPEC-549 Local Execution of Code"
}
]
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-428",
"description": "CWE-428 Unquoted Search Path or Element",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2023-04-28T07:16:21.298Z",
"orgId": "e5d7a401-f4d6-4559-911a-da9b371cd8ce",
"shortName": "42Gears"
},
"references": [
{
"tags": [
"vendor-advisory"
],
"url": "https://www.42gears.com/security-and-compliance"
}
],
"solutions": [
{
"lang": "en",
"supportingMedia": [
{
"base64": false,
"type": "text/html",
"value": "\u003cb\u003eUpgrade to\u003c/b\u003e\u003cspan style=\"background-color: transparent;\"\u003e\u003cb\u003e\u0026nbsp;SureLock windows agent version 2.41.0\u003c/b\u003e\u003c/span\u003e \n\n"
}
],
"value": "Upgrade to\u00a0SureLock windows agent version 2.41.0 \n\n"
}
],
"source": {
"advisory": "01",
"discovery": "EXTERNAL"
},
"title": "Bypassing hardening via Unquoted Service path vulnerability",
"x_generator": {
"engine": "Vulnogram 0.1.0-dev"
}
}
},
"cveMetadata": {
"assignerOrgId": "e5d7a401-f4d6-4559-911a-da9b371cd8ce",
"assignerShortName": "42Gears",
"cveId": "CVE-2023-2331",
"datePublished": "2023-04-27T11:51:45.946Z",
"dateReserved": "2023-04-27T09:20:29.336Z",
"dateUpdated": "2025-01-30T21:00:57.199Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}