cve-2021-33879

CVEID : CVE-2021-33879 受影响产品及版本名称 : GameLoop（所有早于 4.1.21.90 的版本） 漏洞类型 : CWE-494：无完整性校验的代码下载 摘要 GameLoop 是腾讯开发的 Android 模拟器。其更新机制未加密或认证（除 MD5 哈希外，而在此漏洞中攻击者可控制该哈希），使得处于中间人位置的攻击者能够拦截并发送自己的更新包，这些包将在受害机器上执行。 描述 4.1.21.90 之前的 Tencent GameLoop 通过不安全的 HTTP 连接下载更新。处于中间人位置的恶意攻击者可篡改描述更新包的 XML 文档内容，将下载 URL...

gosign-desktop-exploit-poc

GoSign Desktop の複数の脆弱性によりリモートコード実行が可能 名前: GoSign Desktop の TLS 検証バイパスと安全でない更新 CVE: CVE-2025-34324、CVE-2025-34327 影響を受けるシステム: GoSign Desktop = 2.4.0 修正: FoSign Desktop 2.4.1 部分的に修正 ベンダー: Tinexta InfoCert S.p.A. 深刻度: 高 8.2/10 CVSS 3.1: AV:L/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H アドバイザリ:...

CVE-2026-25961-SumatraPDF-3.5.0---3.5.2-RCE

SumatraPDF 安全でない更新 PoC CVE-2026-25961 – 悪意のある更新サーバーによるリモートコード実行 著者: Mohammed Idrees Banyamer 日付: 2026年2月 CVE: CVE-2026-25961 GHSA: GHSA-xpm2-rr5m-x96q CVSS v3.1: 7.5 High AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H 影響を受けるバージョン: SumatraPDF 3.5.0 – 3.5.2 テスト環境: Windows 10 / Windows 11 脆弱性 SumatraPDF バージョン...

CVE-2026-0392

eParakstītājs 3.0 for Windows prior to 1.10.0 is vulnerable: its auto-update uses an unauthenticated/integrity-free channel. The client fetches an XML update descriptor over TLS while accepting any certificate, with no verification of the descriptor’s digital signature, no Authenticode/signature ...

CVE-2026-14929 JS Help Desk < 3.1.4 - Subscriber+ Ticket Reply Modification via IDOR

The JS Help Desk WordPress plugin before 3.1.4 does not verify ownership of the targeted reply before updating it, allowing any authenticated user Subscriber and above to overwrite the content of any support-ticket reply on the site...

CVE-2026-45342

LinkAce is a self-hosted archive to collect website links. Prior to 2.5.6, LinkAce contains an Insecure Direct Object Reference vulnerability in the authorization policy layer that allows any authenticated user to modify resources owned by other users. The affected resource types are links, lists...

Exploit for CVE-2026-25961

SumatraPDF Insecure Update PoC CVE-2026-25961 – Remote C...

CVE-2025-63434

The update mechanism in Xtooltech Xtool AnyScan Android Application 4.40.40 and prior is insecure. The application downloads and extracts update packages containing executable code without performing a cryptographic integrity or authenticity check on their contents. An attacker who can control th...

CVE-2025-63434

The update mechanism in Xtooltech Xtool AnyScan Android Application 4.40.40 and prior is insecure. The application downloads and extracts update packages containing executable code without performing a cryptographic integrity or authenticity check on their contents. An attacker who can control th...

Xtool AnyScan App 安全漏洞

Xtool AnyScan App is an automotive diagnostic mobile application from China-based Xtool. A security vulnerability exists in Xtool AnyScan App version 4.40.40 and earlier, which stems from an insecure update mechanism that could execute arbitrary code...

CVE-2025-63434

CVE-2025-63434 affects Xtooltech Xtool AnyScan Android Application (versions up to 4.40.40). The update mechanism downloads and extracts update packages containing executable code without cryptographic integrity or authenticity checks. If an attacker can control update metadata, they can serve a ...

EUVD-2019-5857

Malware in sbrugna...

EUVD-2017-17792

Malware in sbrugna...

EUVD-2012-0101

Malware in sbrugna...

EUVD-2020-19974

Malware in sbrugna...

EUVD-2018-17980

Malware in sbrugna...

EUVD-2023-42169

Malicious code in bioql PyPI...

CVE-2025-10541 Local Privilege Escalation via Insecure Update Mechanism in iMonitor EAM

iMonitor EAM 9.6394 installs a system service eamusbsrv64.exe that runs with NT AUTHORITY\SYSTEM privileges. This service includes an insecure update mechanism that automatically loads files placed in the C:\sysupdate\ directory during startup. Because any local user can create and write to this...

CVE-2025-10541

CVE-2025-10541 affects iMonitor EAM 9.6394, where the installed system service eamusbsrv64.exe runs with NT AUTHORITY\SYSTEM privileges. The service uses an insecure update mechanism that loads files placed in the C:\sysupdate\ directory during startup. Any local user can create/write to this dir...

iMonitor EAM 安全漏洞

iMonitor EAM is an employee computer network activity monitoring software from iMonitor USA. A security vulnerability exists in iMonitor EAM version 9.6394, which stems from an insecure system service update mechanism that could lead to elevated privileges...