64 matches found
CVE-2025-63945-Tencent-iOA-EoP
CVE-2025-63945 Tencent iOA EoP Version : before 210.9.28693.62001 Summary: I discovered a vulnerability in Tencent PC Manager where files and directories under C:\Windows\Temp are insecurely handled. An attacker can leverage symbolic link symlink attacks to coerce a SYSTEM-privileged process into...
CVE-2024-0670
CVE-2024-0670 PoC This repository provides a Proof of Concept PoC exploit for the CVE-2024-0670 vulnerability, affecting the CheckMK Agent on Windows systems. The vulnerability occurs when the CheckMK Agent creates and executes temporary files in the C:\Windows\Temp directory. An attacker can abu...
Malicious code in sme-rko-finance-front-operations-income (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 7448e3b039f1a22821f5906a1b39378c1259cb5d98090c1b1b8176421482ec0a On require of the package, compat.js reconstructs attacker-controlled hostnames via array split-and-join obfuscation oob-worker.cf101-adf.workers.dev...
MAL-2026-13221 Malicious code in bigops-legacy-telephony-panel (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 610b2084c8573d9a89262f1a4dcd8ff26acdcc0568f7fa29ac5a921a292e390a On require of this package, index.js loads init.js which at module load fetches a platform-specific binary from hostnames reassembled at runtime from...
MAL-2026-13331 Malicious code in dolyame-boxy-independent-bnpl-table (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector fd3ad7593e26ae49876e0310a51ac122ddcb6878eefddc74a5828cce061d200b On require of the package, index.js loads init.js which assembles obfuscated Cloudflare Workers hostnames oob-worker.cf.workers.dev from string-split...
MAL-2026-13156 Malicious code in dolyame-ui-footer (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 3ebf602f046406a056b2d9d36768cf4592ae2f8a02375b0fdb5212c3cc1e80ca On require of dolyame-ui-footer, index.js loads./runtime.js which selects a per-OS payload path, fetches a binary via HTTPS from one of three hardcod...
Malicious code in bigops-tslint (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e6335298379affbc02ca5288e29777324f4d13ddec51b21ce999bb6eeda3996f The package advertises itself as a lint tool but its index.js unconditionally requires./ext, which on load selects a platform-specific payload path,...
MAL-2026-12918 Malicious code in bnpl-blocks-desktop-bnpl-category-gallery (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector a277db0429a37308bb1ce8f4d8f051e7be7b04cf8c327c10b967d9a7b17da75b The package's main entry unconditionally requires support.js, which at load time fetches a platform-specific native binary from obfuscated Cloudflare...
MAL-2026-13264 Malicious code in devplatform-sre-devplatform-sre-core (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 90a5c16f77f85cd9f782efd521d9f6d2b677ab2468503d191d8763c400f366b8 On require of this package, index.js loads helpers.js which selects an OS/arch-specific path and downloads a native binary from one of three Cloudfla...
Malicious code in checkout-commit-pos-order-am (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 732c6bcc33ca109e02cca656cb0f2324504d3bc3176cff55420b4705990a62e8 [email protected] executes a dropper on module load. Its main entry index.js requires shim.js, which selects a platform-specific...
Malicious code in delivery-ci-tech-holder (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 63eae2afeb5a45d70f1d217049ab813392464cc8fb099462c716b8573836ed6b On require of the package, index.js loads support.js, which reconstructs hardcoded destinations from split string arrays...
MAL-2026-12215 Malicious code in statist-browser-typed-client-sme.salary.web.metrics (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 66329f83c07140aacf28b612ad7211b0279deeef95014e0720b4c7be3097a3fe On require, adapter.js fetches a platform-specific binary payload from split-string-obfuscated Cloudflare Workers hosts...
MAL-2026-12144 Malicious code in beaver-ui-drawer (npm)
--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector e7ff4f4ef11d2ff4bbba6d98547a1f6c1e5834739b4943f581e057abb9e313ce [email protected] ships a postinstall script setup.js that assembles network destinations at runtime by joining split string fragments to hide...
CVE-2026-11958 Local privilege escalation in ANSSI’s DFIR-ORC
Local privilege escalation by loading DLLs from a shared temporary directory in ANSSI’s DFIR-ORC, versions 10.2.7 and prior. An attacker with prior access to the system, can place a malicious DLL in C:\Windows\Temp and wait for the application to be executed. Because DFIR-ORC is extracted and...
CVE-2026-11958
Local privilege escalation by loading DLLs from a shared temporary directory in ANSSI’s DFIR-ORC, versions 10.2.7 and prior. An attacker with prior access to the system, can place a malicious DLL in C:\Windows\Temp and wait for the application to be executed. Because DFIR-ORC is extracted and...
EUVD-2026-37877
Local privilege escalation by loading DLLs from a shared temporary directory in ANSSI’s DFIR-ORC, versions 10.2.7 and prior. An attacker with prior access to the system, can place a malicious DLL in C:\Windows\Temp and wait for the application to be executed. Because DFIR-ORC is extracted and...
CVE-2026-11958
ANSSI DFIR-ORC (versions up to 10.2.7) is affected by local privilege escalation via DLLs loaded from a shared temporary directory. An attacker with prior system access can drop a malicious DLL in C:\Windows\Temp and wait for the DFIR-ORC process, which is extracted and executed from that locatio...
CVE-2026-11958: Uncontrolled Search Path Element
Local privilege escalation by loading DLLs from a shared temporary directory in ANSSI’s DFIR-ORC, versions 10.2.7 and prior. An attacker with prior access to the system, can place a malicious DLL in C:\Windows\Temp and wait for the application to be executed. Because DFIR-ORC is extracted and...