CVE-2025-0913

os.OpenFilepath, os.OCREATE|OEXCL behaved differently on Unix and Windows systems when the target path was a dangling symlink. On Unix systems, OpenFile with OCREATE and OEXCL flags never follows symlinks. On Windows, when the target path was a symlink to a nonexistent location, OpenFile would...

Microsoft Windows Local Security Authority Subsystem Service 代码问题漏洞

The Microsoft Windows Local Security Authority Subsystem Service is an internal program of Microsoft Corporation USA that runs Windows system security policies. It verifies user identity, manages user password changes, and generates access characters when a user logs on to a computer standalone o...

Microsoft WebDAV 安全漏洞

Microsoft WebDAV is an HTTP protocol-based extension for file management and collaborative editing over the Internet from Microsoft USA. A security vulnerability exists in Microsoft WebDAV. An attacker exploiting this vulnerability could execute code. The following products and versions are...

Python Library jupyter_core < 5.8.0 Uncontrolled Search Path

The detected version of the Python package, jupytercore, is prior to 5.8.0. It is, therefore, affected by a vulnerability, as explained in the GHSA-33p9-3p43-82vq advisory. Jupyter Core is a package for the core common functionality of Jupyter projects. When using Jupyter Core prior to version...

Unauthorized Configuration Manipulation

Jupyter Core is vulnerable to Unauthorized Configuration Manipulation. The vulnerability is due to improper access control on the %PROGRAMDATA% directory, allowing unprivileged users to write configuration files that affect other users on shared Windows systems...

CVE-2025-30167

Jupyter Core is a package for the core common functionality of Jupyter projects. When using Jupyter Core prior to version 5.8.0 on Windows, the shared %PROGRAMDATA% directory is searched for configuration files SYSTEMCONFIGPATH and SYSTEMJUPYTERPATH, which may allow users to create configuration...

CVE-2025-30167

Jupyter Core on Windows (CVE-2025-30167) before 5.8.0 searches the shared %PROGRAMDATA% for configuration files (SYSTEM_CONFIG_PATH and SYSTEM_JUPYTER_PATH), which may let an attacker place files affecting other users. Affected: Jupyter Core components on Windows in multi-user, unprotected %PROGR...

CVE-2025-30167

Jupyter Core is a package for the core common functionality of Jupyter projects. When using Jupyter Core prior to version 5.8.0 on Windows, the shared %PROGRAMDATA% directory is searched for configuration files SYSTEMCONFIGPATH and SYSTEMJUPYTERPATH, which may allow users to create configuration...

CVE-2025-5265

CVE-2025-5265 concerns Firefox on Windows where the Copy as cURL feature improperly escapes the ampersand, enabling a crafted command to trigger local code execution. The impact is described as potentially allowing arbitrary code execution on the user’s system when the user runs the affected curl...

CVE-2025-0459

A vulnerability, which was classified as problematic, has been found in libretro RetroArch up to 1.19.1 on Windows. Affected by this issue is some unknown functionality in the library profapi.dll of the component Startup. The manipulation leads to untrusted search path. An attack has to be...

CVE-2024-55957

In Thermo Fisher Scientific Xcalibur before 4.7 SP1 and Thermo Foundation Instrument Control Software ICSW before 3.1 SP10, the driver packages have a local privilege escalation vulnerability due to improper access control permissions on Windows systems...

CVE-2024-31462

stable-diffusion-webui is a web interface for Stable Diffusion, implemented using Gradio library. Stable-diffusion-webui 1.7.0 is vulnerable to a limited file write affecting Windows systems. The createui method Backup/Restore tab in modules/uiextensions.py takes user input into the configsavenam...

CVE-2024-37284

Improper handling of alternate encoding occurs when Elastic Defend on Windows systems attempts to scan a file or process encoded as a multibyte character. This leads to an uncaught exception causing Elastic Defend to crash which in turn will prevent it from quarantining the file and/or killing th...

CVE-2024-6913

Execution with unnecessary privileges in PerkinElmer ProcessPlus allows an attacker to spawn a remote shell on the windows system.This issue affects ProcessPlus: through 1.11.6507.0...

CVE-2023-27497

Due to missing authentication and input sanitization of code the EventLogServiceCollector of SAP Diagnostics Agent - version 720, allows an attacker to execute malicious scripts on all connected Diagnostics Agents running on Windows. On successful exploitation, the attacker can completely...

CVE-2023-26077

Atera Agent through 1.8.3.6 on Windows Creates a Temporary File in a Directory with Insecure Permissions...

CVE-2022-43673

Wire through 3.22.3993 on Windows advertises deletion of sent messages; nonetheless, all messages can be retrieved for a limited period of time from the AppData\Roaming\Wire\IndexedDB\httpsapp.wire.com0.indexeddb.leveldb database...

CVE-2022-21606

Vulnerability in the Oracle Services for Microsoft Transaction Server component of Oracle Database Server. The supported version that is affected is 19c. Easily exploitable vulnerability allows unauthenticated attacker with network access via HTTP to compromise Oracle Services for Microsoft...

CVE-2022-34823

Buffer overflow vulnerability in CLUSTERPRO X 5.0 for Windows and earlier, EXPRESSCLUSTER X 5.0 for Windows and earlier, CLUSTERPRO X 5.0 SingleServerSafe for Windows and earlier, EXPRESSCLUSTER X 5.0 SingleServerSafe for Windows and earlier allows a remote unauthenticated attacker to overwrite...

CVE-2022-21295

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is Prior to 6.1.32. Easily exploitable vulnerability allows low privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise...