qlikview-poc-CVE-2024-29863

Aplicação afetada: QlikView Plataforma: Windows Problema: Escalação Local de Privilégio via instalador MSI condição de corrida de sequestro de DLL Descoberto e reportado por: Pawel Karwowski e Julian Horoszkiewicz Eviden Red Team Detalhes: Em sistemas com QuikView12 instalado, é possível para...

shakeitoff

shakeitoff Una versione più piccola, ridotta e pulita di InstallerFileTakeOver, ovvero l'exploit zero-day che è una "variante" di CVE-2021-41379 successivamente assegnato come CVE-2021-43883. Questa versione non apre una shell come InstallerFileTakeOver. Lo scopo di questo codice era creare una...

CVE-2023-32353-PoC

CVE-2023-32353 प्रूफ ऑफ कॉन्सेप्ट अस्वीकरण यह प्रूफ ऑफ कॉन्सेप्ट कोड शैक्षिक उद्देश्यों के लिए प्रकाशित किया गया है। इसका उद्देश्य अन्य लोगों को समान कमजोरियां खोजने, उन्हें जिम्मेदारी से रिपोर्ट करने और उन्हें ठीक करने के लिए प्रोत्साहित करना है। 23 मई, 2023 को एप्पल ने इस कमजोरी के लिए एक फिक्स...

msiscan

Analizzatore MSI Questo script Python per Linux può analizzare i file di installazione Microsoft Windows .msi e segnalare potenziali vulnerabilità. È stato sviluppato da Michael Baer @derbaer0 nel SEC Consult Vulnerability Lab. Attualmente, è adatto principalmente a un'escalation di privilegi...

Tsundere Botnet Expands Using Game Lures and Ethereum-Based C2 on Windows

Cybersecurity researchers have warned of an actively expanding botnet dubbed Tsundere that's targeting Windows users. Active since mid-2025, the threat is designed to execute arbitrary JavaScript code retrieved from a command-and-control C2 server, Kaspersky researcher Lisandro Ubiedo said in an...

CVE-2025-11535 MongoDB Connector for BI installation MSI leave ACLs unset on custom installation directories

MongoDB Connector for BI installation via MSI on Windows leaves ACLs unset on custom install directories allows Privilege Escalation.This issue affects MongoDB Connector for BI: from 2.0.0 through 2.14.24...

EUVD-2020-5032

Malware in sbrugna...

EUVD-2020-8229

Malware in sbrugna...

EUVD-2024-35262

Malicious code in bioql PyPI...

EUVD-2024-47737

Malicious code in bioql PyPI...

EUVD-2022-45079

Malicious code in bioql PyPI...

EUVD-2024-33163

Malicious code in bioql PyPI...

CVE-2025-10491 MongoDB Windows installation MSI may leave ACLs unset on custom installation directories

The MongoDB Windows installation MSI may leave ACLs unset on custom installation directories allowing a local attacker to introduce executable code to MongoDB's process via DLL hijacking. This issue affects MongoDB Server v6.0 version prior to 6.0.25, MongoDB Server v7.0 version prior to 7.0.21 a...

CVE-2023-1314

A vulnerability has been discovered in cloudflared's installer = 2023.3.0 for Windows 32-bits devices that allows a local attacker with no administrative permissions to escalate their privileges on the affected device. This vulnerability exists because the MSI installer used by cloudflared relied...

CVE-2022-41975

RealVNC VNC Server before 6.11.0 and VNC Viewer before 6.22.826 on Windows allow local privilege escalation via MSI installer Repair mode...

CVE-2024-42050

The MSI installer for Splashtop Streamer for Windows before 3.7.0.0 uses a temporary folder with weak permissions during installation. A local user can exploit this to escalate privileges to SYSTEM via an oplock on CredProviderInst.reg...

CVE-2024-10526

Rapid7 Velociraptor MSI Installer versions below 0.73.3 suffer from a vulnerability whereby it creates the installation directory with WRITEDACL permission to the BUILTIN\Users group. This allows local users who are not administrators to grant themselves the Full Control permission on...

CVE-2024-10526

The provided data confirms CVE-2024-10526 affects Rapid7 Velociraptor MSI Installer before version 0.73.3. The issue stems from the installer creating the installation directory with WRITE_DACL permissions for BUILTIN\Users, enabling non-admin local users to grant themselves Full Control on Veloc...

Rapid7 Velociraptor MSI Installer 安全漏洞

Rapid7 Velociraptor MSI Installer is a unique, advanced, open source endpoint monitoring, digital forensics, and cyber response platform from Rapid7 USA. A security vulnerability exists in Rapid7 Velociraptor MSI Installer prior to version 0.73.3 that originates from the execution of arbitrary co...

CVE-2024-35288

Nitro PDF Pro before 13.70.8.82 and 14.x before 14.26.1.0 allows Local Privilege Escalation in the MSI Installer because custom actions occur unsafely in repair mode. CertUtil is run in a conhost.exe window, and there is a mechanism allowing CTRL+o to launch cmd.exe as NT AUTHORITY\SYSTEM...