CVE-2019-8461

Check Point Endpoint Security Initial Client for Windows before version E81.30 tries to load a DLL placed in any PATH location on a clean image without Endpoint Client installed. An attacker can leverage this to gain LPE using a specially crafted DLL placed in any PATH location accessible with...

CVE-2019-8452

A hard-link created from log file archive of Check Point ZoneAlarm up to 15.4.062 or Check Point Endpoint Security client for Windows before E80.96 to any file on the system will get its permission changed so that all users can access that linked file. Doing this on files with limited access gain...

CVE-2019-8463

A denial of service vulnerability was reported in Check Point Endpoint Security Client for Windows before E82.10, that could allow service log file to be written to non-standard locations...

CVE-2019-8458

Check Point Endpoint Security Client for Windows, with Anti-Malware blade installed, before version E81.00, tries to load a non-existent DLL during an update initiated by the UI. An attacker with administrator privileges can leverage this to gain code execution within a Check Point Software...

CVE-2019-8454

A local attacker can create a hard-link between a file to which the Check Point Endpoint Security client for Windows before E80.96 writes and another BAT file, then by impersonating the WPAD server, the attacker can write BAT commands into that file that will later be run by the user or the syste...

CVE-2019-8459

Check Point Endpoint Security Client for Windows, with the VPN blade, before version E80.83, starts a process without using quotes in the path. This can cause loading of a previously placed executable with a name similar to the parts of the path, instead of the intended one...

CVE-2019-3652

Code Injection vulnerability in EPSetup.exe in McAfee Endpoint Security ENS Prior to 10.6.1 October 2019 Update allows local user to get their malicious code installed by the ENS installer via code injection into EPSetup.exe by an attacker with access to the installer...

CVE-2019-3653

Improper access control vulnerability in Configuration tool in McAfee Endpoint Security ENS Prior to 10.6.1 October 2019 Update allows local user to gain access to security configuration via unauthorized use of the configuration tool...

CVE-2012-2753

Untrusted search path vulnerability in TrGUI.exe in the Endpoint Connect aka EPC GUI in Check Point Endpoint Security R73.x and E80.x on the VPN blade platform, Endpoint Security VPN R75, Endpoint Connect R73.x, and Remote Access Clients E75.x allows local users to gain privileges via a Trojan...

The vulnerability of the software development platform for endpoint protection, MetaDefender Endpoint Security SDK (formerly OESIS), and the software for secure remote access to data, Palo Alto Networks GlobalProtect App, for Windows operating systems, stems from deficiencies in access control. This allows attackers to enhance their privileges.

The vulnerability of the MetaDefender Endpoint Security SDK formerly OESIS and the Palo Alto Networks GlobalProtect App software for securing remote access to data on Windows operating systems is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to enhan...

CVE-2025-4901 D-Link DI-7003GV2 HTTP Endpoint state_view.data sub_41E304 information disclosure

A vulnerability classified as problematic was found in D-Link DI-7003GV2 24.04.18D1 R68125. Affected by this vulnerability is the function sub41E304 of the file /H5/stateview.data of the component HTTP Endpoint. The manipulation leads to information disclosure. The attack can only be done within...

PT-2025-21283 · Unknown · Phpgurukul Vehicle Record Management System

Name of the Vulnerable Software and Affected Versions: Phpgurukul Vehicle Record Management System version 1.0 Description: The issue concerns a Cross Site Scripting XSS vulnerability. It affects the /edit-brand.php endpoint, specifically when the bid parameter, represented as brandId, is used...

Microsoft Defender for Endpoint 访问控制错误漏洞

Microsoft Defender for Endpoint is an enterprise endpoint security platform from Microsoft Corporation USA that helps defend against advanced persistent threats. An access control error vulnerability exists in Microsoft Defender for Endpoint that stems from an elevation of privilege vulnerability...

PT-2025-20939 · Microsoft · Defender For Endpoint

Name of the Vulnerable Software and Affected Versions: Microsoft Defender for Endpoint affected versions not specified Description: The issue allows an authorized attacker to elevate privileges locally through external control of file name or path. The vulnerability exists in the grab java versio...

CVE-2025-3759

Endpoint /cgi-bin-igd/netcoreset.cgi which is used for changing device configuration is accessible without authentication. This poses a significant security threat allowing for e.g: administrator account hijacking or AP password changing. The vendor was contacted early about this disclosure but d...

PT-2025-20591

Name of the Vulnerable Software and Affected Versions itsourcecode Gym Management System version 1.0 Description A critical issue has been found in the itsourcecode Gym Management System. The problem is related to an unknown function of the file /ajax.php?action=delete member, where the...

CVE-2025-28073

phpList before 3.6.15 is vulnerable to Reflected Cross-Site Scripting XSS via the /lists/dl.php endpoint. An attacker can inject arbitrary JavaScript code by manipulating the id parameter, which is improperly sanitized...

CVE-2025-28073

phpList before 3.6.15 is vulnerable to Reflected Cross-Site Scripting XSS via the /lists/dl.php endpoint. An attacker can inject arbitrary JavaScript code by manipulating the id parameter, which is improperly sanitized...

CVE-2025-46554

XWiki is a generic wiki platform. In versions starting from 1.8.1 to before 14.10.22, from 15.0-rc-1 to before 15.10.12, from 16.0.0-rc-1 to before 16.4.3, and from 16.5.0-rc-1 to before 16.7.0, anyone can access the metadata of any attachment in the wiki using the wiki attachment REST endpoint...

CVE-2023-46669 Elastic Agent / Elastic Endpoint Security local API key disclosure

Exposure of sensitive information to local unauthorized actors in Elastic Agent and Elastic Security Endpoint can lead to loss of confidentiality and impersonation of Endpoint to the Elastic Stack. This issue was identified by Elastic engineers and Elastic has no indication that it is known or ha...