CVE-2023-25394

CVE-2023-25394 affects the Videostream macOS app (versions 0.4.3–0.5.0). The root cause is a race condition in the Updater privileged script that runs every 5 hours, during which a low-privileged attacker could influence the update process and replace update files. CERT/CC corroborates a root-pri...

Groupnotes Videostream 安全漏洞

Groupnotes Videostream is a video streaming application from Groupnotes, Inc. A security vulnerability exists in Groupnotes Videostream version 0.5.0, 0.4.3, which stems from the fact that an Updater privileged script will attempt to update Videostream every 5 hours...

PT-2023-20044 · Unknown · Videostream

Name of the Vulnerable Software and Affected Versions: Videostream macOS app versions 0.4.3 through 0.5.0 Description: The issue is related to a Race Condition in the Videostream macOS app. The Updater privileged script attempts to update Videostream every 5 hours. Recommendations: For versions...

CVE-2022-38101

Uncontrolled search path in some IntelR NUC Chaco Canyon BIOS update software before version iFlashV Windows 5.13.00.2105 may allow an authenticated user to potentially enable escalation of privilege via local access...

Chinese Hackers Using MgBot Malware to Target International NGOs in Mainland China

The advanced persistent threat APT group referred to as Evasive Panda has been observed targeting an international non-governmental organization NGO in Mainland China with malware delivered via update channels of legitimate applications like Tencent QQ. The attack chains are designed to distribut...

PT-2023-36149 · Fwupd · Fwupd

Name of the Vulnerable Software and Affected Versions: fwupd affected versions not specified Description: The issue is related to the secure boot key. The package has been rebuilt with a new secure boot key. Recommendations: At the moment, there is no information about a newer version that contai...

Splashtop 8.71.12001.0 - Unquoted Service Path Vulnerability

Exploit Title: Splashtop 8.71.12001.0 - Unquoted Service Path Exploit Author: A.I. hernandez Version: 8.71.12001.0 Vendor Homepage: https://www.splashtop.com Version: current version Tested on: Windows 10 21H2 Step to discover Unquoted Service Path: C:\wmic service get...

Splashtop 8.71.12001.0 - Unquoted Service Path

Exploit Title: Splashtop 8.71.12001.0 - Unquoted Service Path Date: 12/20/2022 Exploit Author: A.I. hernandez Version: 8.71.12001.0 Vendor Homepage: https://www.splashtop.com Version: current version Tested on: Windows 10 21H2 Step to discover Unquoted Service Path: C:\wmic service get...

CVE-2022-3093

This vulnerability allows physical attackers to execute arbitrary code on affected Tesla vehicles. Authentication is not required to exploit this vulnerability. The specific flaw exists within the iceupdater update mechanism. The issue results from the lack of proper validation of user-supplied...

Tesla 安全漏洞

Tesla is an electric vehicle from the American company Tesla. A security vulnerability exists in Tesla Model 3 that stems from the iceupdater component not properly validating user-supplied firmware...

Google Chrome Security Update (stable-channel-update-for-desktop_21-2021-09) - Linux

Google Chrome is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:google:chrome"; ifdescription...

CVE-2023-1277

A vulnerability, which was classified as critical, was found in kylin-system-updater up to 1.4.20kord on Ubuntu Kylin. Affected is the function InstallSnap of the component Update Handler. The manipulation leads to command injection. The attack needs to be approached locally. The exploit has been...

CVE-2023-1277

A vulnerability, which was classified as critical, was found in kylin-system-updater up to 1.4.20kord on Ubuntu Kylin. Affected is the function InstallSnap of the component Update Handler. The manipulation leads to command injection. The attack needs to be approached locally. The exploit has been...

Command injection

A vulnerability, which was classified as critical, was found in kylin-system-updater up to 1.4.20kord on Ubuntu Kylin. Affected is the function InstallSnap of the component Update Handler. The manipulation leads to command injection. The attack needs to be approached locally. The exploit has been...

CVE-2023-1277 kylin-system-updater Update InstallSnap command injection

A vulnerability, which was classified as critical, was found in kylin-system-updater up to 1.4.20kord on Ubuntu Kylin. Affected is the function InstallSnap of the component Update Handler. The manipulation leads to command injection. The attack needs to be approached locally. The exploit has been...

CVE-2023-1277

The CVE-2023-1277 issue affects kylin-system-updater up to 1.4.20kord on Ubuntu Kylin, with the vulnerable component: the InstallSnap function of the Update Handler. The root cause is a command injection vulnerability that can be exploited locally. The vulnerability has been publicly disclosed; e...

CVE-2023-1277 kylin-system-updater Update InstallSnap command injection

A vulnerability, which was classified as critical, was found in kylin-system-updater up to 1.4.20kord on Ubuntu Kylin. Affected is the function InstallSnap of the component Update Handler. The manipulation leads to command injection. The attack needs to be approached locally. The exploit has been...

PT-2023-16856 · Unknown · Kylin-System-Updater

Name of the Vulnerable Software and Affected Versions: kylin-system-updater versions up to 1.4.20kord Description: A critical issue was found in the kylin-system-updater, affecting the InstallSnap function of the Update Handler component. This issue leads to command injection and requires a local...

kylinos kylin-system-updater 操作系统命令注入漏洞

kylinos kylin-system-updater is an operating system component from China Kylin Software kylinos. An operating system command injection vulnerability exists in kylin-system-updater version 1.4.20kord and earlier versions. An attacker could exploit this vulnerability to conduct a command injection...

CVE-2023-1277: Improper Neutralization of Special Elements used in a Command

A vulnerability, which was classified as critical, was found in kylin-system-updater up to 1.4.20kord on Ubuntu Kylin. Affected is the function InstallSnap of the component Update Handler. The manipulation leads to command injection. The attack needs to be approached locally. The exploit has been...