shakeitoff

shakeitoff A smaller, minimized, and cleaner version of InstallerFileTakeOver aka the zero-day exploit that is a "variation" of CVE-2021-41379 later assigned CVE-2021-43883. This version does not pop a shell like InstallerFileTakeOver. The point of this code was to create a simpler proof of conce...

qlikview-poc-CVE-2024-29863

Aplicación afectada: QlikView Plataforma: Windows Problema: Escalada de privilegios local mediante el instalador MSI condición de carrera por secuestro de DLL Descubierto y reportado por: Pawel Karwowski y Julian Horoszkiewicz Eviden Red Team Detalles: En sistemas con QuikView12 instalado, es...

CVE-2023-32353-PoC

CVE-2023-32353 概念验证 免责声明 此概念验证代码仅用于教育目的。 它应鼓励其他人发现类似漏洞，负责任地报告并修复它们。 2023年5月23日，Apple 已发布该漏洞的修复程序。 建议您将 iTunes 更新到最新版本（至少 12.12.9）。 我没有发现此 CVE，我只是做了这个 PoC。请阅读“致谢”部分。 本人及此仓库均与 Apple 无关。 此 PoC（概念验证）的适用性有限。您可以在问答部分了解更多信息。 概要 音乐播放器 Apple iTunes 的 MSI 安装程序存在一个漏洞，允许 Microsoft Windows 计算机上的普通低权限用户以 NT...

msiscan

MSI Analyzer Este script de Python para Linux puede analizar archivos instaladores de Microsoft Windows .msi y señalar posibles vulnerabilidades. Fue desarrollado por Michael Baer @derbaer0 en el SEC Consult Vulnerability Lab. Actualmente, está orientado principalmente a una escalada local de...

Winlogbeat 8.13.0 Security Update (ESA-2024-49)

Improper Link Resolution Before File Access 'Link Following' in Winlogbeat Leading to Arbitrary File Write and Denial of Service A local vulnerability in the Winlogbeat Windows installer caused runtime files to be placed in a directory writable by unprivileged users. A low-privileged attacker wit...

Tsundere Botnet Expands Using Game Lures and Ethereum-Based C2 on Windows

Cybersecurity researchers have warned of an actively expanding botnet dubbed Tsundere that's targeting Windows users. Active since mid-2025, the threat is designed to execute arbitrary JavaScript code retrieved from a command-and-control C2 server, Kaspersky researcher Lisandro Ubiedo said in an...

CVE-2025-11535 MongoDB Connector for BI installation MSI leave ACLs unset on custom installation directories

MongoDB Connector for BI installation via MSI on Windows leaves ACLs unset on custom install directories allows Privilege Escalation.This issue affects MongoDB Connector for BI: from 2.0.0 through 2.14.24...

EUVD-2020-5032

Malware in sbrugna...

EUVD-2020-8229

Malware in sbrugna...

EUVD-2024-35262

Malicious code in bioql PyPI...

EUVD-2024-47737

Malicious code in bioql PyPI...

EUVD-2022-45079

Malicious code in bioql PyPI...

EUVD-2024-33163

Malicious code in bioql PyPI...

CVE-2025-10491 MongoDB Windows installation MSI may leave ACLs unset on custom installation directories

The MongoDB Windows installation MSI may leave ACLs unset on custom installation directories allowing a local attacker to introduce executable code to MongoDB's process via DLL hijacking. This issue affects MongoDB Server v6.0 version prior to 6.0.25, MongoDB Server v7.0 version prior to 7.0.21 a...

CVE-2023-1314

A vulnerability has been discovered in cloudflared's installer = 2023.3.0 for Windows 32-bits devices that allows a local attacker with no administrative permissions to escalate their privileges on the affected device. This vulnerability exists because the MSI installer used by cloudflared relied...

CVE-2022-41975

RealVNC VNC Server before 6.11.0 and VNC Viewer before 6.22.826 on Windows allow local privilege escalation via MSI installer Repair mode...

CVE-2024-42050

The MSI installer for Splashtop Streamer for Windows before 3.7.0.0 uses a temporary folder with weak permissions during installation. A local user can exploit this to escalate privileges to SYSTEM via an oplock on CredProviderInst.reg...

CVE-2024-10526

Rapid7 Velociraptor MSI Installer versions below 0.73.3 suffer from a vulnerability whereby it creates the installation directory with WRITEDACL permission to the BUILTIN\Users group. This allows local users who are not administrators to grant themselves the Full Control permission on...

CVE-2024-10526

The provided data confirms CVE-2024-10526 affects Rapid7 Velociraptor MSI Installer before version 0.73.3. The issue stems from the installer creating the installation directory with WRITE_DACL permissions for BUILTIN\Users, enabling non-admin local users to grant themselves Full Control on Veloc...

Rapid7 Velociraptor MSI Installer 安全漏洞

Rapid7 Velociraptor MSI Installer is a unique, advanced, open source endpoint monitoring, digital forensics, and cyber response platform from Rapid7 USA. A security vulnerability exists in Rapid7 Velociraptor MSI Installer prior to version 0.73.3 that originates from the execution of arbitrary co...