Description of the security update for Excel 2013: May 9, 2023 (KB5002384)

Description of the security update for Excel 2013: May 9, 2023 KB5002384 Summary This security update resolves a Microsoft Excel remote code execution vulnerability. To learn more about the vulnerability, see ​​Microsoft Common Vulnerabilities and Exposures CVE-2023-24953. Note: To apply this...

PT-2023-2695 · Microsoft · Windows Installer +1

Name of the Vulnerable Software and Affected Versions: Windows Installer affected versions not specified Description: The issue is related to errors in memory object handling mechanisms in the Windows Installer component of Windows operating systems. This can allow an attacker to elevate their...

Microsoft Windows Installer 安全漏洞

Microsoft Windows Installer is a component of the Windows operating system from Microsoft. It provides a standard basis for installing and uninstalling software. A security vulnerability exists in Microsoft Windows Installer. Windows Server 2008 for x64-based Systems Service Pack 2,Windows Server...

Intel® oneAPI Toolkit and Component Software Installers Advisory

Summary: A potential security vulnerability in some Intel® oneAPI Toolkit and component software installers may allow escalation of privilege. Intel is releasing software updates to mitigate this potential vulnerability. Vulnerability Details: CVEID: CVE-2023-22355 Description: Uncontrolled searc...

Fedora: Security Advisory for rust-coreos-installer (FEDORA-2023-cc21019773)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 38 Update: rust-coreos-installer-0.17.0-3.fc38

coreos-installer installs Fedora CoreOS or RHEL CoreOS to bare-metal machines or, occasionally, to virtual machines...

Dragon Breath APT Group Using Double-Clean-App Technique to Target Gambling Industry

An advanced persistent threat APT actor known as Dragon Breath has been observed adding new layers of complexity to its attacks by adopting a novel DLL side-loading mechanism. "The attack is based on a classic side-loading attack, consisting of a clean application, a malicious loader, and an...

F5 BIG-IP Edge Client Windows Component Installer < 7.2.4.1 MITM (K000132522)

The version of the Big-IP Edge Client Windows Component Installer installed on the remote Windows host is before 7.2.4.1. In the pre connection stage, an improper enforcement of message integrity vulnerability exists in BIG-IP Edge Client for Windows. An unauthenticated attacker with a...

May 2, 2023, update for Office 2013 (KB5002297)

May 2, 2023, update for Office 2013 KB5002297 This article describes update 5002297 for Microsoft Office 2013 that was released on May 2, 2023. This update also applies to Office Home and Student 2013 RT.Be aware that the update in the Microsoft Download Center applies to the Microsoft Installer...

May 2, 2023, update for PowerPoint 2013 (KB4504725)

May 2, 2023, update for PowerPoint 2013 KB4504725 This article describes update 4504725 for Microsoft PowerPoint 2013 that was released on May 2, 2023. This update also applies to Office Home and Student 2013 RT.Be aware that the update in the Microsoft Download Center applies to the Microsoft...

Chinese Hackers Using MgBot Malware to Target International NGOs in Mainland China

The advanced persistent threat APT group referred to as Evasive Panda has been observed targeting an international non-governmental organization NGO in Mainland China with malware delivered via update channels of legitimate applications like Tencent QQ. The attack chains are designed to distribut...

CVE-2023-21099

In multiple methods of PackageInstallerSession.java, there is a possible way to start foreground services from the background due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for...

CVE-2023-21081

In multiple functions of PackageInstallerService.java and related files, there is a possible way to bypass background activity launch restrictions due to a logic error in the code. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is...

CVE-2022-34755

A CWE-427 - Uncontrolled Search Path Element vulnerability exists that could allow an attacker with a local privileged account to place a specially crafted file on the target machine, which may give the attacker the ability to execute arbitrary code during the installation process initiated by a...

CVE-2022-34755

A CWE-427 - Uncontrolled Search Path Element vulnerability exists that could allow an attacker with a local privileged account to place a specially crafted file on the target machine, which may give the attacker the ability to execute arbitrary code during the installation process initiated by a...

Path traversal

A CWE-427 - Uncontrolled Search Path Element vulnerability exists that could allow an attacker with a local privileged account to place a specially crafted file on the target machine, which may give the attacker the ability to execute arbitrary code during the installation process initiated by a...

CVE-2022-34755

A CWE-427 - Uncontrolled Search Path Element vulnerability exists that could allow an attacker with a local privileged account to place a specially crafted file on the target machine, which may give the attacker the ability to execute arbitrary code during the installation process initiated by a...

CVE-2022-34755

A CWE-427 - Uncontrolled Search Path Element vulnerability exists that could allow an attacker with a local privileged account to place a specially crafted file on the target machine, which may give the attacker the ability to execute arbitrary code during the installation process initiated by a...

CVE-2022-34755

CVE-2022-34755 affects Schneider Electric Easergy Builder Installer (versions ≤ 1.7.23). It is caused by an uncontrolled search path element, allowing a locally privileged attacker to place a crafted file and potentially execute arbitrary code during the installation process initiated by a valid ...

CVE-2023-28143

CVE-2023-28143 affects Qualys Cloud Agent for macOS (versions 2.5.1-75 before 3.7). The installer allows a local escalation of privilege bounded to the installation window on macOS 10.15 and older. Attackers may exploit incorrect file permissions during PKG extraction/cromotion (copying files to ...