1322 matches found
CVE-2024-29187
WiX toolset lets developers create installers for Windows Installer, the Windows installation engine. When a bundle runs as SYSTEM user, Burn uses GetTempPathW which points to an insecure directory C:\Windows\Temp to drop and load multiple binaries. Standard users can hijack the binary before it'...
CVE-2024-29188 Malicious directory junction can cause WiX RemoveFoldersEx to possibly delete elevated files
WiX toolset lets developers create installers for Windows Installer, the Windows installation engine. The custom action behind WiX's RemoveFolderEx functionality could allow a standard user to delete protected directories. RemoveFolderEx deletes an entire directory tree during installation or...
CVE-2024-29188 Malicious directory junction can cause WiX RemoveFoldersEx to possibly delete elevated files
WiX toolset lets developers create installers for Windows Installer, the Windows installation engine. The custom action behind WiX's RemoveFolderEx functionality could allow a standard user to delete protected directories. RemoveFolderEx deletes an entire directory tree during installation or...
CVE-2024-29188
CVE-2024-29188 affects WiX Toolset. The RemoveFolderEx action could be abused by a per-user folder link (directory junction) in a per-machine installer to cause deletion of protected directories during Windows Installer processing. This could allow a standard user to delete protected directories ...
CVE-2024-29188 Malicious directory junction can cause WiX RemoveFoldersEx to possibly delete elevated files
WiX toolset lets developers create installers for Windows Installer, the Windows installation engine. The custom action behind WiX's RemoveFolderEx functionality could allow a standard user to delete protected directories. RemoveFolderEx deletes an entire directory tree during installation or...
CVE-2024-29187 WiX based installers are vulnerable to binary hijack when run as SYSTEM
WiX toolset lets developers create installers for Windows Installer, the Windows installation engine. When a bundle runs as SYSTEM user, Burn uses GetTempPathW which points to an insecure directory C:\Windows\Temp to drop and load multiple binaries. Standard users can hijack the binary before it'...
CVE-2024-29187
CVE-2024-29187 affects Wix Burn-based bundles when run as SYSTEM. Burn drops binaries into the insecure C:\Windows\Temp via GetTempPathW, allowing an attacker to hijack the binaries and elevate privileges. The issue is fixed in Wix 3.14.1 and 4.0.5. Affected component: Wix Toolset Burn installer ...
CVE-2024-29187 WiX based installers are vulnerable to binary hijack when run as SYSTEM
WiX toolset lets developers create installers for Windows Installer, the Windows installation engine. When a bundle runs as SYSTEM user, Burn uses GetTempPathW which points to an insecure directory C:\Windows\Temp to drop and load multiple binaries. Standard users can hijack the binary before it'...
CVE-2023-41099
In the Windows installer in Atos Eviden CardOS API before 5.5.5.2811, Local Privilege Escalation can occur.from a regular user to SYSTEM...
CVE-2023-41099
In the Windows installer in Atos Eviden CardOS API before 5.5.5.2811, Local Privilege Escalation can occur.from a regular user to SYSTEM...
CVE-2023-41099
In the Windows installer in Atos Eviden CardOS API before 5.5.5.2811, Local Privilege Escalation can occur.from a regular user to SYSTEM...
CVE-2023-41099
CVE-2023-41099 affects the Windows installer of Atos Eviden CardOS API prior to version 5.5.5.2811, enabling local privilege escalation from a regular user to SYSTEM. The issue is documented across multiple sources (NVD, Red Hat advisory, CNNVD, CVE list) with the same description. Remediation: u...
CVE-2023-41099
In the Windows installer in Atos Eviden CardOS API before 5.5.5.2811, Local Privilege Escalation can occur.from a regular user to SYSTEM...
Atos CardOS API 安全漏洞
Atos Eviden CardOS is a smart card specialized for the Internet of Things from Atos France. A security vulnerability exists in the Atos CardOS API prior to version 5.5.5.2811, which originates in the Windows installer, where a local privilege escalation may occur...
PT-2024-12920 · Atos · Atos Eviden Cardos Api
Name of the Vulnerable Software and Affected Versions: Atos Eviden CardOS API versions prior to 5.5.5.2811 Description: The issue allows for Local Privilege Escalation, enabling an attacker to escalate privileges from a regular user to SYSTEM. This occurs in the Windows installer component of the...
CVE-2023-41099
In the Windows installer in Atos Eviden CardOS API before 5.5.5.2811, Local Privilege Escalation can occur.from a regular user to SYSTEM...
SUSE CVE-2024-27303
electron-builder is a solution to package and build a ready for distribution Electron, Proton Native app for macOS, Windows and Linux. A vulnerability that only affects eletron-builder prior to 24.13.2 in Windows, the NSIS installer makes a system call to open cmd.exe via NSExec in the .nsh...
The vulnerability of Windows operating system installers allows a hacker to increase their privileges.
The vulnerability of Windows operating system installers is related to deficiencies in access control. Exploiting this vulnerability can allow attackers to enhance their privileges...
