The Microsoft Visual Studio Products are missing security updates. It is, therefore, affected by multiple vulnerabilities :

  - An elevation of privilege vulnerability exists when the     Diagnostics Hub Standard Collector improperly handles     file operations. An attacker who successfully exploited     this vulnerability could run processes in an elevated     context. An attacker could exploit this vulnerability by     running a specially crafted application on the victim     system. The update addresses the vulnerability by     correcting the way the Diagnostics Hub Standard     Collector handles file operations. (CVE-2020-1133)

  - A remote code execution vulnerability exists in Visual     Studio when it improperly handles objects in memory. An     attacker who successfully exploited the vulnerability     could run arbitrary code in the context of the current     user. If the current user is logged on with     administrative user rights, an attacker could take     control of the affected system. An attacker could then     install programs; view, change, or delete data; or     create new accounts with full user rights. Users whose     accounts are configured to have fewer user rights on the     system could be less impacted than users who operate     with administrative user rights.  (CVE-2020-16856,     CVE-2020-16874)

  - An elevation of privilege vulnerability exists when the     Diagnostics Hub Standard Collector improperly handles     data operations. An attacker who successfully exploited     this vulnerability could run processes in an elevated     context. An attacker could exploit this vulnerability by     running a specially crafted application on the victim     system. The update addresses the vulnerability by     correcting the way the Diagnostics Hub Standard     Collector handles data operations. (CVE-2020-1130)

The versions of Oracle Siebel CRM installed on the remote host are affected by multiple vulnerabilities as referenced in the October 2022 CPU advisory.

  - Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing     (XMLBeans)). Supported versions that are affected are 22.8 and prior. Easily exploitable vulnerability     allows unauthenticated attacker with network access via HTTP to compromise Siebel Apps - Marketing.
    Successful attacks of this vulnerability can result in unauthorized access to critical data or complete     access to all Siebel Apps - Marketing accessible data and unauthorized ability to cause a hang or     frequently repeatable crash (complete DOS) of Siebel Apps - Marketing. (CVE-2021-23926)

  - Vulnerability in the Siebel Industry - Life Sciences product of Oracle Siebel CRM (component: eDetailing     (PDF Viewer)). Supported versions that are affected are 22.8 and prior. Easily exploitable vulnerability     allows unauthenticated attacker with network access via HTTP to compromise Siebel Industry - Life     Sciences. Successful attacks require human interaction from a person other than the attacker. Successful     attacks of this vulnerability can result in takeover of Siebel Industry - Life Sciences. (CVE-2018-5158)

  - Vulnerability in the Siebel Engineering - Rel Eng product of Oracle Siebel CRM (component: Build System     (Visual Studio)). Supported versions that are affected are 22.8 and prior. Easily exploitable     vulnerability allows unauthenticated attacker with logon to the infrastructure where Siebel Engineering -     Rel Eng executes to compromise Siebel Engineering - Rel Eng. Successful attacks require human interaction     from a person other than the attacker. Successful attacks of this vulnerability can result in takeover of     Siebel Engineering - Rel Eng. (CVE-2020-16856)

  - Vulnerability in the Siebel Core - Automation product of Oracle Siebel CRM (component: Keyword Automation     (Google Gson)). Supported versions that are affected are 22.8 and prior. Easily exploitable vulnerability     allows unauthenticated attacker with network access via HTTP to compromise Siebel Core - Automation.
    Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently     repeatable crash (complete DOS) of Siebel Core - Automation.  Vulnerability in the Siebel Core - Common     Components product of Oracle Siebel CRM (component: DISA (Google Gson)). Supported versions that are     affected are 22.8 and prior. Easily exploitable vulnerability allows unauthenticated attacker with network     access via HTTP to compromise Siebel Core - Common Components. Successful attacks of this vulnerability     can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of Siebel     Core - Common Components. (CVE-2022-25647)

  - Vulnerability in the Siebel Core - Common Components product of Oracle Siebel CRM (component: Calendar     (Moment.js)). Supported versions that are affected are 22.8 and prior. Easily exploitable vulnerability     allows unauthenticated attacker with network access via HTTP to compromise Siebel Core - Common     Components. Successful attacks of this vulnerability can result in unauthorized creation, deletion or     modification access to critical data or all Siebel Core - Common Components accessible data.
    (CVE-2022-24785)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Microsoft Visual Studio製品に、セキュリティ更新プログラムが適用されていません。したがって、以下の複数の脆弱性による影響を受けます。

  - Diagnostics Hub Standard Collectorがファイル操作を不適切に処理するとき、権限昇格の脆弱性があります。この脆弱性の悪用に成功した攻撃者が、昇格したコンテキストでプロセスを実行する可能性があります。攻撃者が、巧妙に作りこまれたアプリケーションを被害者のシステムで実行し、この脆弱性を悪用する可能性があります。更新プログラムは、Diagnostics Hub Standard Collectorがファイル操作を行う方法を調整することにより、この脆弱性に対応します。（CVE-2020-1133）

  - Visual Studioがメモリ内のオブジェクトを不適切に処理するとき、リモートでコードが実行される脆弱性があります。この脆弱性の悪用に成功した攻撃者が、現行ユーザーのコンテキストで任意のコードを実行する可能性があります。現行ユーザーが管理者ユーザー権限でログオンしている場合、攻撃者が影響を受けるシステムを乗っ取る可能性があります。攻撃者が、完全なユーザー権限で、プログラムのインストール、データの表示・変更・削除、または新規アカウントの作成を実行する可能性があります。システムで、ユーザー権限の設定がより制限されたアカウントを持つユーザーは、管理者ユーザー権限で操作を行うユーザーよりも、受ける影響が少なくなる可能性があります。（CVE-2020-16856、CVE-2020-16874）

  - Diagnostics Hub Standard Collectorがデータ作を不適切に処理するとき、権限昇格の脆弱性があります。この脆弱性の悪用に成功した攻撃者が、昇格したコンテキストでプロセスを実行する可能性があります。攻撃者が、巧妙に作りこまれたアプリケーションを被害者のシステムで実行し、この脆弱性を悪用する可能性があります。更新プログラムは、Diagnostics Hub Standard Collectorがデータ操作を行う方法を調整することにより、この脆弱性に対応します。（CVE-2020-1130）

Microsoft Visual Studio 产品缺少安全更新。因此，该应用程序受到多个漏洞的影响：

  - 诊断中心标准收集器未正确处理文件操作时，存在权限提升漏洞。成功利用该漏洞的攻击者能在权限提升的环境中运行进程。攻击者可通过在受害者系统上运行特别构建的应用程序来利用该漏洞。此安全性更新通过更正诊断中心标准收集器处理文件操作的方式来修复此漏洞。(CVE-2020-1133)

  - Visual Studio 未正确处理内存中的对象时，该软件存在远程代码执行漏洞。成功利用此漏洞的攻击者可在当前用户环境中运行任意代码。如果当前用户使用管理用户权限登录，攻击者可控制受影响的系统。然后，攻击者可安装程序，查看、更改或删除数据，或者创建拥有完全用户权限的新帐户。其帐户被配置为具备较少系统权限的用户，将比以采用特权帐户进行操作的用户所受的影响更小。（CVE-2020-16856、CVE-2020-16874）

  - 诊断中心标准收集器未正确处理数据操作时，存在权限提升漏洞。成功利用该漏洞的攻击者能在权限提升的环境中运行进程。攻击者可通过在受害者系统上运行特别构建的应用程序来利用该漏洞。此安全性更新通过更正诊断中心标准收集器处理数据操作的方式来修复此漏洞。(CVE-2020-1130)

Microsoft Visual Studio 產品缺少安全性更新。因此，此類應用程式受到多個弱點影響：

  - Diagnostics Hub Standard Collector 未正確處理檔案作業時，存在權限提高弱點。成功惡意利用此弱點的攻擊者可在提升的內容中執行處理程序。攻擊者可以在受害者系統上執行特製的應用程式，藉此加以惡意利用。安全性更新透過更正 Diagnostics Hub Standard Collector 處理檔案作業的方式修復此弱點。(CVE-2020-1133)

  - Visual Studio 未正確處理記憶體中的物件時，該軟體中存在遠端程式碼執行弱點。成功利用該弱點的攻擊者可在目前使用者的內容中執行任意程式碼。如果目前使用者以管理使用者權限登入，則攻擊者可以控制受影響的系統。攻擊者接下來可以安裝程式、檢視/變更/刪除資料，或是建立具有完整使用者權限的新帳戶。如果使用者的帳戶在系統上的使用者權限較低，則其受到的影響比擁有系統管理員權限的使用者要小。(CVE-2020-16856、CVE-2020-16874)

  - Diagnostics Hub Standard Collector 未正確處理資料作業時，存在權限提高弱點。成功惡意利用此弱點的攻擊者可在提升的內容中執行處理程序。攻擊者可以在受害者系統上執行特製的應用程式，藉此加以惡意利用。安全性更新透過更正 Diagnostics Hub Standard Collector 處理資料作業的方式修復此弱點。(CVE-2020-1130)

ID	Name	Product	Family	Published	Updated	Severity
140465	Security Updates for Microsoft Visual Studio Products (September 2020)	Nessus	Windows : Microsoft Bulletins	9/10/2020	12/5/2022	high
212450	Oracle Siebel Server (October 2022 CPU)	Nessus	Misc.	12/11/2024	12/12/2024	critical
140465	Microsoft Visual Studio製品のセキュリティ更新プログラム（2020年9月）	Nessus	Windows : Microsoft Bulletins	9/10/2020	12/5/2022	high
140465	Microsoft Visual Studio 产品的安全更新（2020 年 9 月）	Nessus	Windows : Microsoft Bulletins	9/10/2020	12/5/2022	high
140465	Microsoft Visual Studio 產品的安全性更新 (2020 年 9 月)	Nessus	Windows : Microsoft Bulletins	9/10/2020	12/5/2022	high

Detections

Analytics

Plugins Search

high

critical

high

high

high