PT-2025-27790 · Unknown · Epc2 Windows

Name of the Vulnerable Software and Affected Versions: The product name cannot be determined. Description: The issue allows the device to automatically log in the EPC2 Windows user during startup without requesting a password. Recommendations: At the moment, there is no information about a newer...

PT-2025-27789 · Microsoft · Bitlocker +1

Name of the Vulnerable Software and Affected Versions: Windows affected versions not specified Description: The issue concerns the lack of full volume encryption on device hard drives, such as BitLocker. This allows an attacker with physical access to the device to use an alternative operating...

Integrity Validation Bypass

Electron is vulnerable to Integrity Validation Bypass. The vulnerability is due to insufficient enforcement of ASAR integrity and loading restrictions due to reliance on embeddedAsarIntegrityValidation and onlyLoadAppFromAsar fuses, which can be bypassed when apps are launched from...

CVE-2024-46992

CVE-2024-46992 affects Electron versions 30.0.0-alpha.1 through 30.0.4, and 31.0.0-alpha.1 through 31.0.0-beta.1. The issue is an ASAR integrity bypass that applies only when embeddedAsarIntegrityValidation and onlyLoadAppFromAsar fuses are enabled, and only if the app is launched from a writable...

CVE-2024-46992 Electron ASAR Integrity bypass by just modifying the content

Electron is an open source framework for writing cross-platform desktop applications using JavaScript, HTML and CSS. From versions 30.0.0-alpha.1 to before 30.0.5 and 31.0.0-alpha.1 to before 31.0.0-beta.1, Electron is vulnerable to an ASAR Integrity bypass. This only impacts apps that have the...

GHSA-XW5Q-G62X-2QJC electron ASAR Integrity bypass by just modifying the content

electron's ASAR Integrity can be bypass by modifying the content. Impact This only impacts apps that have the embeddedAsarIntegrityValidation and onlyLoadAppFromAsar fuses enabled. Apps without these fuses enabled are not impacted. This issue is specific to Windows, apps using these fuses on macO...

CVE-2025-49797

Multiple Brother driver installers for Windows contain a privilege escalation vulnerability. If exploited, an arbitrary program may be executed with the administrative privilege. As for the details of affected product names, model numbers, and versions, refer to the information provided by the...

PDF-XChange Editor Heap Buffer Overflow Vulnerability (CNVD-2025-16305)

PDF-XChange Editor is a PDF-XChange company running on Microsoft Windows systems in the PDF file viewer software. PDF-XChange Editor suffers from a heap buffer overflow vulnerability that can be exploited by an attacker to execute code in the context of the current process...

PDF-XChange Editor Memory Misreference Vulnerability (CNVD-2025-16313)

PDF-XChange Editor is a PDF-XChange company running on Microsoft Windows systems in the PDF file viewer software. PDF-XChange Editor suffers from a memory misreference vulnerability that can be exploited by an attacker to execute code in the context of the current process...

CVE-2025-49797

CVE-2025-49797 affects multiple Brother driver installers for Windows, enabling privilege escalation that may allow arbitrary code execution with administrative privileges on the host. The available documents describe a local attack vector with low prerequisites and high impact (CVE-2025-49797; P...

CVE-2025-49797

Multiple Brother driver installers for Windows contain a privilege escalation vulnerability. If exploited, an arbitrary program may be executed with the administrative privilege. As for the details of affected product names, model numbers, and versions, refer to the information provided by the...

CVE-2025-6557

The CVE-2025-6557 entry concerns Google Chrome on Windows with an insufficient DevTools data validation flaw that could allow arbitrary code execution via a crafted HTML page after user interaction with specific UI gestures. Affected component: DevTools in Chrome; root cause: inadequate input val...

📄 VLC Mobile Remote for Windows 1.3.9.3 Remote Arbitrary URL Launch

VLC Mobile Remote for Windows version 1.3.9.3 allows an unauthenticated attacker to remotely cause the target system to open any URL in the victim’s default web browser by sending a specially crafted request. This can lead to forced browsing to malicious sites, phishing attacks, or NTLM credentia...

The vulnerability of the Storage Management Provider component in Windows operating systems allows a hacker to gain unauthorized access to protected information.

The vulnerability of the Storage Management Provider component in Windows operating systems is related to reading data beyond the buffer limits of memory. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

The vulnerability of the Storage Management Provider component in Windows operating systems allows a hacker to gain unauthorized access to protected information.

The vulnerability of the Storage Management Provider component in Windows operating systems is related to reading data beyond the buffer limits of memory. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

The vulnerability of the Storage Management Provider component in Windows operating systems allows attackers to disclose sensitive information that is protected by this component’s security measures.

The vulnerability of the Storage Management Provider component in Windows operating systems is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability can allow an attacker to disclose sensitive information that is protected by security measures...

The vulnerability of the Storage Management Provider component in Windows operating systems allows a hacker to gain unauthorized access to protected information.

The vulnerability of the Storage Management Provider component in Windows operating systems is related to reading data beyond the buffer limits of memory. Exploiting this vulnerability can allow an attacker to gain unauthorized access to protected information...

The vulnerability of the Local Security Authority Subsystem Service (LSASS) in Windows operating systems allows a perpetrator to trigger a service failure.

The vulnerability of the Local Security Authority Subsystem Service LSASS in Windows operating systems is related to an uncontrolled consumption of resources. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

Untrusted Search Path

Overview org.apache.tomcat.embed:tomcat-embed-core is a Core Tomcat implementation. Affected versions of this package are vulnerable to Untrusted Search Path via the icacls.exe call during Windows installation, when a full path is not specified. An attacker can execute arbitrary code with elevate...

CVE-2024-1243

Improper input validation in the Wazuh agent for Windows prior to version 4.8.0 allows an attacker with control over the Wazuh server or agent key to configure the agent to connect to a malicious UNC path. This results in the leakage of the machine account NetNTLMv2 hash, which can be relayed for...