CVE-2025-66461

FULLBACK Manager Pro provided by GS Yuasa International Ltd. registers two Windows services with unquoted file paths. A user may execute arbitrary code with SYSTEM privilege if he/she has the write permission on the path to the directory where the affected product is installed...

CVE-2025-66461

Summary: The CVE-2025-66461 vulnerability affects GS Yuasa’s FULLBACK Manager Pro. The issue is unquoted file paths for two Windows services, enabling local user with write access to the installation directory to execute arbitrary code with SYSTEM privileges. Affected product (from sources): FULL...

CVE-2025-66461

FULLBACK Manager Pro provided by GS Yuasa International Ltd. registers two Windows services with unquoted file paths. A user may execute arbitrary code with SYSTEM privilege if he/she has the write permission on the path to the directory where the affected product is installed...

CVE-2025-66461

FULLBACK Manager Pro provided by GS Yuasa International Ltd. registers two Windows services with unquoted file paths. A user may execute arbitrary code with SYSTEM privilege if he/she has the write permission on the path to the directory where the affected product is installed...

Vulnerabilities fixed in Splunk Enterprise and Splunk Cloud Platform

Splunk has fixed vulnerabilities in Splunk Enterprise and Splunk Cloud Platform. The vulnerabilities include several issues, including the ability for low-privileged users to create unauthorized dashboards, access sensitive information via mobile notifications, and the injection of ANSI escape...

PT-2025-49543

Name of the Vulnerable Software and Affected Versions FULLBACK Manager Pro affected versions not specified Description The software registers two Windows services with unquoted file paths. A user with write permission to the installation directory can execute arbitrary code with SYSTEM privileges...

PT-2025-49580

Name of the Vulnerable Software and Affected Versions Android affected versions not specified Description A flaw exists in the preparePackage function within InstallPackageHelper.java that may allow an application to install in a hidden state without providing a means for uninstallation. This is...

Malicious code in qt-main (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 bd1f92a69928dc8fa2a6a50cfd596c34802bc68fc28dd5dd8508fc24344bbec9 Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

MAL-2025-192302 Malicious code in coremsft (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: kam193 c8eaed1685f9346b5e86fd47bb3359843533e558e34995d405dd903df8e23c4e Installing the package or importing the module exfiltrates basic information about the host, and the package has no other purpose. --- Category: PROBABLYPENTES...

bbot (>=1.0.4.1233rc0, <=1.1.7.3028rc0), enoslib (>=8.3.1, <=8.4.1) +3 more potentially affected by CVE-2025-14010 via ansible (7.7.0)

ansible PYPI version 7.7.0 is affected by a known vulnerability. The following packages have a transitive dependency on ansible and may be impacted: - bbot =1.0.4.1233rc0, =8.3.1, =14.0.0.0rc1, =0.1.0, =0.2.0, =0.2.2 Source cves: CVE-2025-14010 Source advisory: OSV:GHSA-8GGH-XWR9-3373...

CVE-2025-20386

In Splunk Enterprise for Windows versions below 10.0.2, 9.4.6, 9.3.8, and 9.2.10, a new installation of or an upgrade to an affected version can result in incorrect permissions assignment in the Splunk Enterprise for Windows Installation directory. This lets non-administrator users on the machine...

CVE-2025-13828

SummaryA non privileged user can install and remove arbitrary packages via composer for a composer based installed, even if the flag in update settings for enable composer based update is unticked. ImpactA low-privileged user of the platform can install malicious code to obtain higher privileges...

CVE-2025-20387

CVE-2025-20387 affects Splunk Universal Forwarder for Windows. The issue, observed in versions below 10.0.2, 9.4.6, 9.3.8, and 9.2.10, arises when installing or upgrading to an affected build, causing incorrect permissions in the Forwarder installation directory. This misconfiguration allows non-...

CVE-2025-20386 Incorrect permission assignment on Splunk Enterprise for Windows during new installation or upgrade

In Splunk Enterprise for Windows versions below 10.0.2, 9.4.6, 9.3.8, and 9.2.10, a new installation of or an upgrade to an affected version can result in incorrect permissions assignment in the Splunk Enterprise for Windows Installation directory. This lets non-administrator users on the machine...

CVE-2025-13492

HP Image Assistant is affected in versions prior to 5.3.3. The vulnerability stems from a race condition during package installation that could allow a local attacker to escalate privileges (local, high impact). No exploitation details are provided in the documents; exposure depends on attacker a...

CVE-2025-13492 HP Image Assistant - Potential Escalation of Privilege

A potential security vulnerability has been identified in HP Image Assistant for versions prior to 5.3.3. The vulnerability could potentially allow a local attacker to escalate privileges via a race condition when installing packages...

Splunk Enterprise 9.2.0 < 9.2.10, 9.3.0 < 9.3.8, 9.4.0 < 9.4.6, 10.0 < 10.0.2 (SVD-2025-1206)

The version of Splunk installed on the remote host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the SVD-2025-1206 advisory. - In Splunk Universal Forwarder for Windows versions below 10.0.2, 9.4.6, 9.3.8, and 9.2.10, a new installation of or an upgrad...

CVE-2025-64642

NMIS/BioDose V22.02 and previous versions' installation directory paths by default have insecure file permissions, which in certain deployment scenarios can enable users on client workstations to modify the program executables and libraries...

Mautic user without privileged access to the Marketplace can install and uninstall composer packages

Summary A non privileged user can install and remove arbitrary packages via composer for a composer based installed, even if the flag in update settings for enable composer based update is unticked. Impact A low-privileged user of the platform can install malicious code to obtain higher privilege...

GHSA-3FQ7-C5M8-G86X Mautic user without privileged access to the Marketplace can install and uninstall composer packages

Summary A non privileged user can install and remove arbitrary packages via composer for a composer based installed, even if the flag in update settings for enable composer based update is unticked. Impact A low-privileged user of the platform can install malicious code to obtain higher privilege...