Search

Find a vulnerability

Search criteria

    2 vulnerabilities by faulknermedia

    CVE-2020-26894 (GCVE-0-2020-26894)

    Vulnerability from nvd – Published: 2020-10-08 20:04 – Updated: 2024-08-04 16:03
    VLAI
    Summary
    LiveCode v9.6.1 on Windows allows local, low-privileged users to gain privileges by creating a malicious "cmd.exe" in the folder of the vulnerable LiveCode application. If the application is using LiveCode's "shell()" function, it will attempt to search for "cmd.exe" in the folder of the current application and run the malicious "cmd.exe".
    Severity
    No CVSS data available.
    CWE
    • n/a
    Assigner
    References
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T16:03:22.843Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://john-woodman.com/posts/LiveCode-Privilege-Escalation-Vulnerability/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://quality.livecode.com/show_bug.cgi?id=22942"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/livecode/livecode/pull/7454"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "LiveCode v9.6.1 on Windows allows local, low-privileged users to gain privileges by creating a malicious \"cmd.exe\" in the folder of the vulnerable LiveCode application. If the application is using LiveCode\u0027s \"shell()\" function, it will attempt to search for \"cmd.exe\" in the folder of the current application and run the malicious \"cmd.exe\"."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-10-22T16:32:41.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://john-woodman.com/posts/LiveCode-Privilege-Escalation-Vulnerability/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://quality.livecode.com/show_bug.cgi?id=22942"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/livecode/livecode/pull/7454"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2020-26894",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "LiveCode v9.6.1 on Windows allows local, low-privileged users to gain privileges by creating a malicious \"cmd.exe\" in the folder of the vulnerable LiveCode application. If the application is using LiveCode\u0027s \"shell()\" function, it will attempt to search for \"cmd.exe\" in the folder of the current application and run the malicious \"cmd.exe\"."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://john-woodman.com/posts/LiveCode-Privilege-Escalation-Vulnerability/",
              "refsource": "MISC",
              "url": "https://john-woodman.com/posts/LiveCode-Privilege-Escalation-Vulnerability/"
            },
            {
              "name": "https://quality.livecode.com/show_bug.cgi?id=22942",
              "refsource": "MISC",
              "url": "https://quality.livecode.com/show_bug.cgi?id=22942"
            },
            {
              "name": "https://github.com/livecode/livecode/pull/7454",
              "refsource": "MISC",
              "url": "https://github.com/livecode/livecode/pull/7454"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2020-26894",
    "datePublished": "2020-10-08T20:04:01.000Z",
    "dateReserved": "2020-10-08T00:00:00.000Z",
    "dateUpdated": "2024-08-04T16:03:22.843Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2020-26894 (GCVE-0-2020-26894)

    Vulnerability from cvelistv5 – Published: 2020-10-08 20:04 – Updated: 2024-08-04 16:03
    VLAI
    Summary
    LiveCode v9.6.1 on Windows allows local, low-privileged users to gain privileges by creating a malicious "cmd.exe" in the folder of the vulnerable LiveCode application. If the application is using LiveCode's "shell()" function, it will attempt to search for "cmd.exe" in the folder of the current application and run the malicious "cmd.exe".
    Severity
    No CVSS data available.
    CWE
    • n/a
    Assigner
    References
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T16:03:22.843Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://john-woodman.com/posts/LiveCode-Privilege-Escalation-Vulnerability/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://quality.livecode.com/show_bug.cgi?id=22942"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://github.com/livecode/livecode/pull/7454"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "LiveCode v9.6.1 on Windows allows local, low-privileged users to gain privileges by creating a malicious \"cmd.exe\" in the folder of the vulnerable LiveCode application. If the application is using LiveCode\u0027s \"shell()\" function, it will attempt to search for \"cmd.exe\" in the folder of the current application and run the malicious \"cmd.exe\"."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2020-10-22T16:32:41.000Z",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://john-woodman.com/posts/LiveCode-Privilege-Escalation-Vulnerability/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://quality.livecode.com/show_bug.cgi?id=22942"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/livecode/livecode/pull/7454"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2020-26894",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "LiveCode v9.6.1 on Windows allows local, low-privileged users to gain privileges by creating a malicious \"cmd.exe\" in the folder of the vulnerable LiveCode application. If the application is using LiveCode\u0027s \"shell()\" function, it will attempt to search for \"cmd.exe\" in the folder of the current application and run the malicious \"cmd.exe\"."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://john-woodman.com/posts/LiveCode-Privilege-Escalation-Vulnerability/",
              "refsource": "MISC",
              "url": "https://john-woodman.com/posts/LiveCode-Privilege-Escalation-Vulnerability/"
            },
            {
              "name": "https://quality.livecode.com/show_bug.cgi?id=22942",
              "refsource": "MISC",
              "url": "https://quality.livecode.com/show_bug.cgi?id=22942"
            },
            {
              "name": "https://github.com/livecode/livecode/pull/7454",
              "refsource": "MISC",
              "url": "https://github.com/livecode/livecode/pull/7454"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2020-26894",
    "datePublished": "2020-10-08T20:04:01.000Z",
    "dateReserved": "2020-10-08T00:00:00.000Z",
    "dateUpdated": "2024-08-04T16:03:22.843Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}