CVE-2019-9742

gdwfpcd.sys in G Data Total Security before 2019-02-22 allows an attacker to bypass ACLs because Interpreted Device Characteristics lacks FILE_DEVICE_SECURE_OPEN and therefore files and directories "inside" the \\.\gdwfpcd device are not properly protected, leading to unintended impersonation or object creation.

• CWE-862

• https://github.com/nafiez/nafiez.github.io/blob/master/_posts/2019-03-13-gdata-total-security-acl-bypass.mdExploit, Third Party Advisory
• https://nafiez.github.io/security/bypass/2019/03/12/gdata-total-security-acl-bypass.htmlExploit, Third Party Advisory
• https://github.com/nafiez/nafiez.github.io/blob/master/_posts/2019-03-13-gdata-total-security-acl-bypass.mdExploit, Third Party Advisory
• https://nafiez.github.io/security/bypass/2019/03/12/gdata-total-security-acl-bypass.htmlExploit, Third Party Advisory

Published

Mar 13, 2019

Last Modified

Jun 17, 2026

Status

Modified

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-9735An issue was discovered in the iptables firewall module in O…
• CVE-2019-9736DOM-based XSS exists in 1024Tools Markdown 1.0 via vectors i…
• CVE-2019-9737Editor.md 1.5.0 has DOM-based XSS via vectors involving the …6.1
• CVE-2019-9738jimmykuu Gopher 2.0 has DOM-based XSS via vectors involving …
• CVE-2019-9740An issue was discovered in urllib2 in Python 2.x through 2.7…6.1
• CVE-2019-9741An issue was discovered in net/http in Go 1.11.5. CRLF injec…6.1
• CVE-2019-9743An issue was discovered on PHOENIX CONTACT RAD-80211-XD and …
• CVE-2019-9744An issue was discovered on PHOENIX CONTACT FL NAT SMCS 8TX, …
• CVE-2019-9745CloudCTI HIP Integrator Recognition Configuration Tool allow…7.8
• CVE-2019-9746In libwebm before 2019-03-08, a NULL pointer dereference cau…
• CVE-2019-9747In tinysvcmdns through 2018-01-16, a maliciously crafted mDN…
• CVE-2019-9748In tinysvcmdns through 2018-01-16, an mDNS server processing…