CVE-2025-49124

CVE-2025-49124 : Untrusted Search Path in Apache Tomcat Windows installer. Tomcat’s Windows installer runs icacls.exe without a full path. Affected: Tomcat 11.0.0-M1–11.0.7, 10.1.0–10.1.41, 9.0.23–9.0.105 (plus some EOL versions). Mitigation: upgrade to 11.0.8, 10.1.42 or 9.0.106. CVSSv3.1 base s...

CVE-2025-49124 Apache Tomcat: exe side-loading via icalcs.exe in Tomcat installer for Windows

Untrusted Search Path vulnerability in Apache Tomcat installer for Windows. During installation, the Tomcat installer for Windows used icacls.exe without specifying a full path. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0 through 10.1.41, from 9.0.23 through...

CVE-2025-49124 Apache Tomcat: exe side-loading via icalcs.exe in Tomcat installer for Windows

Untrusted Search Path vulnerability in Apache Tomcat installer for Windows. During installation, the Tomcat installer for Windows used icacls.exe without specifying a full path. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0 through 10.1.41, from 9.0.23 through...

CVE-2025-32714

Improper access control in Windows Installer allows an authorized attacker to elevate privileges locally...

CVE-2025-33075

Improper link resolution before file access 'link following' in Windows Installer allows an authorized attacker to elevate privileges locally...

CVE-2025-33075

Improper link resolution before file access 'link following' in Windows Installer allows an authorized attacker to elevate privileges locally...

CVE-2025-33075

Improper link resolution before file access 'link following' in Windows Installer allows an authorized attacker to elevate privileges locally...

CVE-2025-32714

Improper access control in Windows Installer allows an authorized attacker to elevate privileges locally...

CVE-2025-32714

Improper access control in Windows Installer allows an authorized attacker to elevate privileges locally...

CVE-2025-33075 Windows Installer Elevation of Privilege Vulnerability

...

CVE-2025-33075 Windows Installer Elevation of Privilege Vulnerability

...

CVE-2025-33075

CVE-2025-33075 affects Windows Installer and is tied to an improper link resolution before file access (a link following issue). The root cause enables a locally authenticated attacker to achieve privilege escalation (local, high impact). The NCSC advisory aggregates list CVE-2025-33075 under Win...

CVE-2025-32714 Windows Installer Elevation of Privilege Vulnerability

...

CVE-2025-32714 Windows Installer Elevation of Privilege Vulnerability

...

CVE-2025-32714

CVE-2025-32714 maps to an improper access control in Windows Installer enabling local privilege escalation for an authenticated attacker. Connected sources confirm Windows Installer as the vulnerable component and describe the impact as obtaining elevated privileges locally. Remediation is via Mi...

Windows Installer Elevation of Privilege Vulnerability

Improper link resolution before file access 'link following' in Windows Installer allows an authorized attacker to elevate privileges locally...

Windows Installer Elevation of Privilege Vulnerability

Improper access control in Windows Installer allows an authorized attacker to elevate privileges locally...

PT-2025-24858 · Microsoft · Windows Installer +1

Name of the Vulnerable Software and Affected Versions: Windows Installer affected versions not specified Description: The issue is related to improper link resolution before file access, also known as 'link following', which allows an authorized attacker to elevate privileges locally. There is no...

Microsoft Windows Installer 后置链接漏洞

Microsoft Windows Installer is a component of the Windows operating system from Microsoft Corporation USA. It provides a standard basis for installing and uninstalling software. A backlink vulnerability exists in Microsoft Windows Installer. An attacker could exploit the vulnerability to elevate...

PT-2025-24828 · Microsoft · Windows Installer +1

Name of the Vulnerable Software and Affected Versions: Windows Installer affected versions not specified Description: The issue is related to improper access control in Windows Installer, allowing an authorized attacker to elevate privileges locally. Recommendations: At the moment, there is no...