CVE-2022-50903

CVE-2022-50903 affects Wondershare MobileTrans 3.5.9, where the ElevationService exposes an unquoted service path vulnerability. Local users can potentially execute code with elevated privileges by placing malicious executables in specific filesystem locations that are then launched with LocalSys...

CVE-2026-0859

TYPO3 CMS contains a local deserialization vulnerability in the mail-file spool handling. Local users with write access to the spool directory can craft a file that is deserialized during mailer:spool:send, enabling arbitrary PHP code execution on the web server. Affected versions: 10.0.0–10.4.54...

CVE-2026-0859 TYPO3 CMS Allows Insecure Deserialization via Mailer File Spool

TYPO3's mail‑file spool deserialization flaw lets local users with write access to the spool directory craft a malicious file that is deserialized during the mailer:spool:send command, enabling arbitrary PHP code execution on the web server. This issue affects TYPO3 CMS versions 10.0.0-10.4.54,...

PT-2026-2376

Name of the Vulnerable Software and Affected Versions Wondershare Dr.Fone version 12.0.18 Description Wondershare Dr.Fone version 12.0.18 contains an unquoted service path issue. This allows local users to execute arbitrary code with elevated system privileges. The misconfigured service path can ...

Wondershare FamiSafe 安全漏洞

Wondershare FamiSafe is a parental control application from China's Wanxing Technology Wondershare. A security vulnerability exists in Wondershare FamiSafe version 1.0, which stems from an unquoted FSService service path, and could lead to code execution and elevation of privileges by a local use...

Wondershare Dr.Fone 代码问题漏洞

Wondershare Dr.Fone is a one-stop solution for cell phones from China Wanxing Wondershare. A code issue vulnerability exists in Wondershare Dr.Fone version 11.4.9, which stems from an unquoted path to the DFWSIDService service that could lead to the execution of arbitrary code by a local user...

CVE-2025-68276 Avahi has a reachable assertion in avahi_wide_area_scan_cache

Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, an unprivileged local users can crash avahi-daemon with wide-area disabled by creating record browsers with the AVAHILOOKUPUSEWIDEAREA flag set via D-Bus. This can ...

Avahi 安全漏洞

Avahi is the Avahi open source set of local service discovery tools for Linux. A security vulnerability exists in Avahi 0.9-rc2 and earlier versions, which stems from the fact that an unauthorized local user can create a logging browser via D-Bus, which may cause avahi-daemon to crash...

CVE-2026-22246

Mastodon is a free, open-source social network server based on ActivityPub. Mastodon 4.3 added notifications of severed relationships, allowing end-users to inspect the relationships they lost as the result of a moderation action. The code allowing users to download lists of severed relationships...

CVE-2005-1722

Unknown vulnerability in the CoreGraphics Window Server for Mac OS X 10.4.x up to 10.4.1 allows local users to inject arbitrary commands into root sessions...

CVE-2005-1399

FreeBSD 4.6 to 4.11 and 5.x to 5.4 uses insecure default permissions for the /dev/iir device, which allows local users to execute restricted ioctl calls to read or modify data on hardware that is controlled by the iir driver...

CVE-2005-1472

Certain system calls in Apple Mac OS X 10.4.1 do not properly enforce the permissions of certain directories without the POSIX read bit set, but with the execute bits set for group or other, which allows local users to list files in otherwise restricted directories...

CVE-2005-1036

FreeBSD 5.x to 5.4 on AMD64 does not properly initialize the IO permission bitmap used to allow user access to certain hardware, which allows local users to bypass intended access restrictions to cause a denial of service, obtain sensitive information, and possibly gain privileges...

CVE-2005-1859

Unknown vulnerability in arshell in the Array Service arrayd for SGI ProPack 3 with SP 5 and 6, and SGI ProPack 4, allows local users to execute arbitrary shells as root on other hosts in the cluster or array...

CVE-2005-1675

Groove Virtual Office before 3.1 build 2338, before 3.1a build 2364, and Groove Workspace before 2.5n build 1871 installs the client installation directories with insecure EVERYBODY permissions, which allows local users to gain sensitive information...

CVE-2023-50446

An issue was discovered in Mullvad VPN Windows app before 2023.6-beta1. Insufficient permissions on a directory allow any local unprivileged user to escalate privileges to SYSTEM...

CVE-2018-10977

In 2345 Security Guard 3.7, the driver file 2345BdPcSafe.sys, X64 version allows local users to cause a denial of service BSOD or possibly have unspecified other impact because of not validating input values from IOCTL 0x002220E4...

CVE-2018-6208

In Max Secure Anti Virus 19.0.3.019,, the driver file MaxProtector32.sys allows local users to cause a denial of service BSOD or possibly have unspecified other impact because of not validating input values from IOCtl 0x22000d...

CVE-2018-6207

In Max Secure Anti Virus 19.0.3.019,, the driver file MaxProtector32.sys allows local users to cause a denial of service BSOD or possibly have unspecified other impact because of not validating input values from IOCtl 0x220019...

CVE-2009-4361

Multiple buffer overflows in qoslist in IBM AIX 6.1 allow local users to cause a denial of service application crash or possibly gain privileges via a long string argument. NOTE: some of these details are obtained from third party information...