CVE-2023-39520 Cryptomator vulnerable to Local Elevation of Privileges

Cryptomator encrypts data being stored on cloud infrastructure. The MSI installer provided on the homepage for Cryptomator version 1.9.2 allows local privilege escalation for low privileged users, via the repair function. The problem occurs as the repair function of the MSI is spawning an SYSTEM...

CVE-2023-39520 Cryptomator vulnerable to Local Elevation of Privileges

Cryptomator encrypts data being stored on cloud infrastructure. The MSI installer provided on the homepage for Cryptomator version 1.9.2 allows local privilege escalation for low privileged users, via the repair function. The problem occurs as the repair function of the MSI is spawning an SYSTEM...

CVE-2023-39520

CVE-2023-39520 affects Cryptomator. The MSI installer for version 1.9.2 spawns a SYSTEM PowerShell from the repair function, without using -NoProfile, causing the user’s profile to load and enabling local privilege escalation for low-privileged users. Version 1.9.3 includes a fix; a workaround is...

CVE-2023-39520 Cryptomator vulnerable to Local Elevation of Privileges

Cryptomator encrypts data being stored on cloud infrastructure. The MSI installer provided on the homepage for Cryptomator version 1.9.2 allows local privilege escalation for low privileged users, via the repair function. The problem occurs as the repair function of the MSI is spawning an SYSTEM...

OESA-2023-1474 qemu security update

QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed. Security Fixes: A flaw was found in the QEMU implementation of VMWare's paravirtual RDMA device. This flaw allows a crafted guest driver to execute HW commands when shared buffers are not yet allocated,...

OESA-2023-1476 qemu security update

QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed. Security Fixes: A flaw was found in the QEMU Guest Agent service for Windows. A local unprivileged user may be able to manipulate the QEMU Guest Agent's Windows installer via repair custom actions to...

OESA-2023-1475 qemu security update

QEMU is a FAST! processor emulator using dynamic translation to achieve good emulation speed. Security Fixes: A flaw was found in the QEMU Guest Agent service for Windows. A local unprivileged user may be able to manipulate the QEMU Guest Agent's Windows installer via repair custom actions to...

Huawei HarmonyOS 安全漏洞

Huawei HarmonyOS is an operating system from Huawei China. It provides a full-scenario distributed operating system based on a microkernel. Huawei HarmonyOS suffers from a security restriction bypass vulnerability that originates from an error in the validation of user-supplied input by the...

CVE-2023-38418

The BIG-IP Edge Client Installer on macOS does not follow best practices for elevating privileges during the installation process. Note: Software versions which have reached End of Technical Support EoTS are not evaluated...

K000134746: BIG-IP Edge Client for macOS vulnerability CVE-2023-38418

Security Advisory Description The BIG-IP Edge Client Installer on macOS does not follow best practices for elevating privileges during the installation process. CVE-2023-38418 Impact An attacker with an ability to run unprivileged arbitrary code on the target macOS client may be able to abuse an...

CVE-2022-43703

An installer that loads or executes files using an unconstrained search path may be vulnerable to substitute files under control of an attacker being loaded or executed instead of the intended files...

CVE-2022-43703

An installer that loads or executes files using an unconstrained search path may be vulnerable to substitute files under control of an attacker being loaded or executed instead of the intended files...

CVE-2022-43702

When the directory containing the installer does not have sufficiently restrictive file permissions, an attacker can modify or replace the installer to execute malicious code...

Design/Logic Flaw

When the directory containing the installer does not have sufficiently restrictive file permissions, an attacker can modify or replace the installer to execute malicious code...

CVE-2022-43703 Incomplete verification of installation file signature

An installer that loads or executes files using an unconstrained search path may be vulnerable to substitute files under control of an attacker being loaded or executed instead of the intended files...

CVE-2022-43703

The connected Intel advisory (INTEL-SA-00930) associates CVE-2022-43703 with Arm DS for Intel® SoC FPGA software, describing an Uncontrolled search path element in the installer that may allow escalation of privilege via local access. Affected product: Arm DS for Intel® SoC FPGA software, all ver...

CVE-2022-43702

Arm DS for Intel SoC FPGA software is affected by CVE-2022-43702 due to improper access control in the installer, potentially allowing a local-authenticated user to escalate privileges. The advisory notes all versions are affected and assigns a CVSS v3.1 base score of 8.8 (High). Remediation advi...

CVE-2022-43702 Incomplete verification of installation file signature

When the directory containing the installer does not have sufficiently restrictive file permissions, an attacker can modify or replace the installer to execute malicious code...

July 27, 2023, update for Office 2016 (KB4493158)

None None...

PT-2023-14295 · Arm · Arm Compiler 5 (Ac5) +2

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue concerns an installer that loads or executes files using an unconstrained search path, making it potentially vulnerable to attacks where an...