CVE-2023-43748

Improper access control in some IntelR GPA Framework software installers before version 2023.3 may allow an authenticated user to potentially enable escalation of privilege via local access...

CVE-2023-40071

Improper access control in some IntelR GPA software installers before version 2023.3 may allow an authenticated user to potentially enable escalation of privilege via local access...

CVE-2023-24460

Incorrect default permissions in some IntelR GPA software installers before version 2023.3 may allow an authenticated user to potentially enable escalation of privilege via local access...

CVE-2023-43629

Incorrect default permissions in some IntelR GPA software installers before version 2023.3 may allow an authenticated user to potentially enable escalation of privilege via local access...

CVE-2023-40071

Improper access control in some IntelR GPA software installers before version 2023.3 may allow an authenticated user to potentially enable escalation of privilege via local access...

CVE-2023-42433

Incorrect default permissions in some Endurance Gaming Mode software installers before version 1.3.937.0 may allow an authenticated user to potentially enable escalation of privilege via local access...

CVE-2023-42433

The CVE-2023-42433 affects Endurance Gaming Mode software installers prior to version 1.3.937.0. Root cause: incorrect default permissions in the installers, enabling an authenticated local user to potentially escalate privileges. Impact: local privilege escalation with a base CVSS 3.1 score of 6...

CVE-2024-21813

Exposure of resource to wrong sphere in some IntelR DTT software installers may allow an authenticated user to potentially enable escalation of privilege via local access...

PT-2024-12036

Name of the Vulnerable Software and Affected Versions IntelR GPA software versions prior to 2023.3 Description The issue is related to incorrect default permissions in some IntelR GPA software installers, which may allow an authenticated user to potentially enable escalation of privilege via loca...

PT-2024-12839

Name of the Vulnerable Software and Affected Versions IntelR GPA software versions prior to 2023.3 Description The issue is related to improper access control in some IntelR GPA software installers, which may allow an authenticated user to potentially enable escalation of privilege via local...

CVE-2024-21813: Exposure of Resource to Wrong Sphere

Exposure of resource to wrong sphere in some IntelR DTT software installers may allow an authenticated user to potentially enable escalation of privilege via local access...

PT-2024-10053 · Intel · Intel Dtt

Name of the Vulnerable Software and Affected Versions: Intel DTT software affected versions not specified Description: The issue is related to the exposure of resources to the wrong sphere in some Intel DTT software installers, potentially allowing an authenticated user to enable escalation of...

Ongoing Malvertising Campaign leads to Ransomware

Executive Summary Rapid7 has observed an ongoing campaign to distribute trojanized installers for WinSCP and PuTTY via malicious ads on commonly used search engines, where clicking on the ad leads to typo squatted domains. In at least one observed case, the infection has led to the attempted...

FIN7 Hacker Group Leverages Malicious Google Ads to Deliver NetSupport RAT

The financially motivated threat actor known as FIN7 has been observed leveraging malicious Google ads spoofing legitimate brands as a means to deliver MSIX installers that culminate in the deployment of NetSupport RAT. "The threat actors used malicious websites to impersonate well-known brands,...

Malvertising Campaign Unleashes Nitrogen Malware Via Fake Installers

...

CVE-2024-25376

An issue discovered in Thesycon Software Solutions Gmbh & Co. KG TUSBAudio MSI-based installers before 5.68.0 allows a local attacker to execute arbitrary code via the msiexec.exe repair mode...

CVE-2024-25376

An issue discovered in Thesycon Software Solutions Gmbh & Co. KG TUSBAudio MSI-based installers before 5.68.0 allows a local attacker to execute arbitrary code via the msiexec.exe repair mode...

CVE-2024-25376

An issue in Thesycon Software Solutions Gmbh & Co. KG TUSBAudio MSI-based installers (versions prior to 5.68.0 ) allows a local attacker to execute arbitrary code via the msiexec.exe repair mode. This vulnerability is classified as an Improper Control of Generation of Code (CWE-94) . Proof-of-con...

CVE-2024-25376: Improper Control of Generation of Code

An issue discovered in Thesycon Software Solutions Gmbh & Co. KG TUSBAudio MSI-based installers before 5.68.0 allows a local attacker to execute arbitrary code via the msiexec.exe repair mode...

WiX based installers are vulnerable to binary hijack when run as SYSTEM

Summary Burn uses an unprotected C:\Windows\Temp directory to copy binaries and run them from there. This directory is not entirely protected against low privilege users. Details When a bundle runs as SYSTEM user, Burn uses GetTempPathW which points to an insecure directory C:\Windows\Temp to dro...