4909 matches found
Optical Disc Archive Software (for Windows) registers a Windows service with an unquoted file path
Overview Optical Disc Archive Software for Windows provided by Sony Corporation contains the following vulnerability. Unquoted search path or element CWE-428 - CVE-2025-62225 Kazuma Matsumoto of GMO Cybersecurity by IERAE, Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the...
Directory Traversal
Overview InvokeAI is an An implementation of Stable Diffusion which provides various new features and options to aid the image generation process Affected versions of this package are vulnerable to Directory Traversal via the isvalidpath method. An attacker can download arbitrary files via the...
CVE-2025-48982
This vulnerability in Veeam Agent for Microsoft Windows allows for Local Privilege Escalation if a system administrator is tricked into restoring a malicious file...
Microsoft Windows LNK File Parsing Improper Input Validation NTLM Relay Vulnerability
This vulnerability allows remote attackers to relay NTLM credentials on affected installations of Microsoft Windows. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of L...
SUSE CVE-2023-47113
BleachBit cleans files to free disk space and to maintain privacy. BleachBit for Windows up to version 4.4.2 is vulnerable to a DLL Hijacking vulnerability. By placing a DLL in the Folder c:\DLLs, an attacker can run arbitrary code on every execution of BleachBit for Windows. This issue has been...
CVE-2025-62522 vite allows server.fs.deny bypass via backslash on Windows
Vite is a frontend tooling framework for JavaScript. In versions from 2.9.18 to before 3.0.0, 3.2.9 to before 4.0.0, 4.5.3 to before 5.0.0, 5.2.6 to before 5.4.21, 6.0.0 to before 6.4.1, 7.0.0 to before 7.0.8, and 7.1.0 to before 7.1.11, files denied by server.fs.deny were sent if the URL ended...
GHSA-93M4-6634-74Q7 vite allows server.fs.deny bypass via backslash on Windows
Summary Files denied by server.fs.deny were sent if the URL ended with \ when the dev server is running on Windows. Impact Only apps that match the following conditions are affected: - explicitly exposes the Vite dev server to the network using --host or server.host config option - running the de...
The vulnerability of the MapUrlToZone method in Windows operating systems allows attackers to disclose sensitive information that is protected by security measures.
The vulnerability of the MapUrlToZone method in Windows operating systems is related to the execution of operations beyond the buffer boundaries in memory. Exploiting this vulnerability can allow an attacker to disclose sensitive information that is protected by security measures...
Microsoft Inbox COM Objects Code Execution Vulnerability (CNVD-2025-25713)
Microsoft Inbox COM Objects is a built-in COM component of the Windows operating system from the U.S. company Microsoft Microsoft. A code execution vulnerability exists in Microsoft Inbox COM Objects, which can be exploited by an attacker to execute arbitrary code...
VulnCheck KEV: CVE-2023-39143
PaperCut NG and PaperCut MF before 22.1.3 on Windows allow path traversal, enabling attackers to upload, read, or delete arbitrary files. This leads to remote code execution when external device integration is enabled a very common configuration...
Google Chrome Security Update (stable-channel-update-for-desktop_14-2025-10) - Windows
Google Chrome is prone to an use after free vulnerability. SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:google:chrome";...
CVE-2025-55685
Use after free in Windows PrintWorkflowUserSvc allows an authorized attacker to elevate privileges locally...
CVE-2025-59206
Windows Resilient File System ReFS Deduplication Service Elevation of Privilege Vulnerability...
CVE-2025-55701
Improper validation of specified type of input in Microsoft Windows allows an authorized attacker to elevate privileges locally...
CVE-2025-59275 Windows Authentication Elevation of Privilege Vulnerability
...
CVE-2025-59241 Windows Health and Optimized Experiences Elevation of Privilege Vulnerability
...
CVE-2025-55695 Windows WLAN AutoConfig Service Information Disclosure Vulnerability
...
CVE-2025-55331
CVE-2025-55331: Use-after-free in Windows PrintWorkflowUserSvc that allows a locally authenticated user to escalate privileges. Connected advisories indicate Microsoft released October 2025 security updates (e.g., KB5066835 and related KBs) addressing Windows print/cryptography components; apply ...