Unquoted service path vulnerability in WCAssistantService Lavasoft


Vulnerability: Unquoted service path vulnerability in WCAssistantService Lavasoft

Severity: High

Impact: Any user that has Lavasoft webcompanion installed in their system can elevate his privilege on local system.

Description:

Web Companion blocks websites that try to steal your personal information by impersonating sites you know and trust. It keeps your passwords, payment and other personal information safe from hackers.

Unquoted service path exists for the service "WCAssistantService". This could potentially allow an authorized but non-privileged local user to execute arbitrary code with elevated privileges on the system.

How to check:
C:\>wmic service get name,displayname,pathname,startmode | findstr /i "auto" | findstr /i /v "c:\windows\\" | findstr /i /v """
WC Assistant                                                           WCAssistantService                                      C:\Program Files (x86)\Lavasoft\Web Companion\Application\Lavasoft.WCAssistant.WinService.exe         Auto

Initial mail sent 2nd Nov 2017
Mail sent to webcompanion on 2nd Jan 2018 --> No response
Mail sent to webcompanion on 20th Jan 2018 --> No response
Disclosure date 23rd Jan 2018




Comments

  1. abbegailquattlebaum3 March 2022 at 07:57

    Caesars Casino, LLC - DrmCD
    Caesars 인천광역 출장샵 Casino, LLC is in the business of 안동 출장샵 providing 안성 출장샵 gambling and entertainment services to the Greater Phoenix area. Our 파주 출장안마 casino is 익산 출장샵 a Native American gaming

    ReplyDelete
  2. Jacob9 July 2025 at 16:02

    Hello Guy's

    Fullz available fresh USA UK CANADA
    Updatd-2025 Database with guarantee
    Fresh Stuff never sold before
    Bulk quantity available
    SSN NIN SIN Fullz with all info
    DL Scans Fresh Front & Back with Selfie

    Contact us here for more info & deals:

    Tele Gram - @ killhacks , @ leadsupplier
    What's App - + (1)..727.. 788..6129
    TG Channel - t.me/ leadsproviderworldwide

    *Be aware from scammers using our cloned names
    (Make sure to visit our channel for real usernames & latest updated stuff)

    Fullz|Pros|Leads List:

    SSN DOB DL Address Fullz USA
    NIN DOB DL Address Sort code & Account number Fullz UK
    SIN DOB Address MMN Email Phone Fullz Canada

    DL Scans front back with SSN USA
    DL Scans real Front back with Selfie USA|UK|CA
    Passport Photos with Selfie USA|UK|CA

    Business EIN Company Pros USA
    High Credit Scores Fullz USA|UK|CA
    Dead Fullz in bulk quantity
    CC Fullz with CVV & billing Address
    Dumps with Pin Track 101 & 202 with Cash out Tutorials
    Children Fullz 2011-2023
    Old & young Age Fullz 1935-2009
    Sweep Stakes Fresh & Casino Leads
    Bulk Email (business|Crypto|B2B|Medical|Payday) Leads
    W-2 Forms with DL
    Medical & Hospital Database Leads
    Uber Eats & Doordash KYC Stuff
    Tax Return Filling Fullz
    Fullz for SBA|PUA|UI|FASFA|Loans

    RDP|SMTP|SHELLS
    C-Panels|Web-Mailers
    Bulk SMS & Email Senders
    Scam Pages & Scripting
    Carding, Cash out, Loan Methods

    #SSN #SSNDOBDL #SellSSN #CCShop #CCSELLCVV #ShopSSNDOBDLADDRESS #FULLZ #SSNFULLZ
    #REALDLSCAN #YoungAgeFullz #Fullzseller #USAFULLZ #FULLZUSA #SellerSSNDOB #ShopSSNDOB
    #BusinessFullzUSA #USAPros #USALeads #EINFullz #SIN #SINDOBDL #SellSIN #SINMMNFULLZ #MMNPROSSIN #MMNSIN
    #NIN #NINDOBDL #SellNIN #CCShop #CCSELLCVV #ShopNINDOBDLADDRESS #FULLZ #NINFULLZ

    Many more stuff available for you guy's
    Try our stuff & make good money
    Fresh stuff guaranteed
    Payment mode only in crypto
    Contact us fast for fresh Stuff

    ReplyDelete

Post a Comment

Popular posts from this blog

MY OSCP REVIEW

Image
MY OSCP REVIEW About me I am just a guy who has done B.E (Computer Engineering), C.E.H and I am doing vulnerability assessment for different clients in Mumbai. Inspiration to do OSCP Wanted to read technical stuff only then skip this para. Like other guyz I thought that OSCP is one of the most difficult task in the world of IT Security. And yes, it is one the difficult mission you could ever face. Back in Dec 2014 I was really bored with the conventional vulnerability assessment thing, I wanted to do some more exploitation and some black hat stuff. But in our job we were not allowed to do so, as the environment used to be critical most of the time and time for completing the task was less. So I asked few question on some group in facebook regarding How can I learn more exploitation stuff. There was a guy with the name Mr.WhiteW0rm who have given me a brilliant answer and recommended me to do OSCP. That time I thought though I won't be able to do OSCP but at least I...
Read more

De-Ice 1.120a Walkthrough

Image
          Few days back my friend Chetan told to get hands on De Ice and Kioptrix series before taking PWK labs.The very next weekend I started with De-Ice http://hackingdojo.com/downloads/iso/De-ICE_S1.120.iso . As my bridge network was on 192.168.1.x series I thought of doing De-Ice 1.120a just by bridging the VM. One of the awesome URL that I found today was https://blog.g0tmi1k.com/2011/03/vulnerable-by-design/ . Enumeration: I started with nmap as usual to find all the open ports. I usually use version detection and aggressive scan in nmap.
Read more