482 matches found
Windows Persistence via UserInitMprLogonScript Registry Key
This Python script demonstrates a Windows persistence technique based on modifying the HKCU\Environment\UserInitMprLogonScript registry value, which allows execution of a program each time the user logs in...
Malicious code in genosys (PyPI)
--- -= Per source details. Do not edit below this line.=- Source: kam193 2fb27cde30ea3d834e3160e37c203a1f8a271435cf92316a990766c5b8b9791c The campaign is built from a benign-like package e.g. genosys and the malicious dependency e.g. pynosist. The dependency uses a PTH file to trigger malicious...
Microsoft Windows Server Domain Role Detection
SMB-login based domain role detection with powershell fallback for Windows Server. SPDX-FileCopyrightText: 2026 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescriptio...
EUVD-2026-18935
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.1, 40.8.0, and 41.0.0-beta.8, on Windows, app.setLoginItemSettingsopenAtLogin: true wrote the executable path to the Run registry key without quoting. If the app ...
CVE-2026-34768 Electron: Unquoted executable path in app.setLoginItemSettings on Windows
Electron is a framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. Prior to versions 38.8.6, 39.8.1, 40.8.0, and 41.0.0-beta.8, on Windows, app.setLoginItemSettingsopenAtLogin: true wrote the executable path to the Run registry key without quoting. If the app ...
EUVD-2026-18945
Electron: Registry key path injection in app.setAsDefaultProtocolClient on Windows...
GHSA-JFQX-FXH3-C62J Electron: Unquoted executable path in app.setLoginItemSettings on Windows
Impact On Windows, app.setLoginItemSettingsopenAtLogin: true wrote the executable path to the Run registry key without quoting. If the app is installed to a path containing spaces, an attacker with write access to an ancestor directory may be able to cause a different executable to run at login...
Restore to AWS EC2 Fails with: "ClientError: Unknown OS / Missing OS files" or "FirstBootFailure"
Challenge When restoring a VM to AWS EC2, one of the following errors occurs: StatusMessage: "CLIENTERROR : ClientError: Unknown OS / Missing OS files." Failed to import machine to Amazon EC2: CLIENTERROR : FirstBootFailure: This import request failed because the instance failed to boot and...
CVE-2020-10642
In Rockwell Automation RSLinx Classic versions 4.11.00 and prior, an authenticated local attacker could modify a registry key, which could lead to the execution of malicious code using system privileges when opening RSLinx Classic...
Accessibility Features Persistence Via Debugger Registry Key
This Metasploit module makes it possible to apply the sticky keys hack to a session with appropriate rights. The hack provides a means to get a SYSTEM shell using UI-level interaction at an RDP login screen or via a UAC confirmation dialog. The module modifies the Debug registry setting for certa...
CVE-1999-0589
A system-critical Windows NT registry key has inappropriate permissions...
CVE-1999-0664
An application-critical Windows NT registry key has inappropriate permissions...
CVE-1999-0611
A system-critical Windows NT registry key has an inappropriate value...
CVE-2022-27608
Forcepoint One Endpoint prior to version 22.01 installed on Microsoft Windows is vulnerable to registry key tampering by users with Administrator privileges. This could result in a user disabling anti-tampering mechanisms which would then allow the user to disable Forcepoint One Endpoint and the...
PT-2025-44189
Name of the Vulnerable Software and Affected Versions Prevx version 3.0.5.220 Description A flaw exists in Prevx that could allow attackers to cause a denial of service. This can be achieved by sending IOCTL code 0x22E044 to the pxscan.sys driver. Specifically, processes listed under the registry...
CVE-2025-60349
An issue was discovered in Prevx v3.0.5.220 allowing attackers to cause a denial of service via sending IOCTL code 0x22E044 to the pxscan.sys driver. Any processes listed under registry key HKEYLOCALMACHINE\System\CurrentControlSet\Services\pxscan\Files will be terminated...
CVE-2025-60349
An issue was discovered in Prevx v3.0.5.220 allowing attackers to cause a denial of service via sending IOCTL code 0x22E044 to the pxscan.sys driver. Any processes listed under registry key HKEYLOCALMACHINE\System\CurrentControlSet\Services\pxscan\Files will be terminated...
EUVD-1999-1152
Malware in sbrugna...