CVE-2025-5335

The CVE-2025-5335 case involves Autodesk Installer, where an untrusted search path in the installer could allow a local attacker to escalate privileges to NT AUTHORITY/SYSTEM and potentially execute code. Documented impact is privilege escalation with code execution risk; exploitation status and ...

Windows Installer Elevation of Privilege Vulnerability

Improper link resolution before file access 'link following' in Windows Installer allows an authorized attacker to elevate privileges locally...

Windows Installer Elevation of Privilege Vulnerability

Improper access control in Windows Installer allows an authorized attacker to elevate privileges locally...

PT-2025-24668

Name of the Vulnerable Software and Affected Versions Autodesk Installer affected versions not specified Description A maliciously crafted binary file, when downloaded, could lead to escalation of privileges to NT AUTHORITY/SYSTEM due to an untrusted search path being utilized in the Autodesk...

Microsoft Windows Installer 访问控制错误漏洞

Microsoft Windows Installer is a component of the Windows operating system from Microsoft Corporation USA. It provides a standard basis for installing and uninstalling software. An access control error vulnerability exists in Microsoft Windows Installer. An attacker could exploit the vulnerabilit...

PT-2025-24858 · Microsoft · Windows Installer +1

Name of the Vulnerable Software and Affected Versions: Windows Installer affected versions not specified Description: The issue is related to improper link resolution before file access, also known as 'link following', which allows an authorized attacker to elevate privileges locally. There is no...

Microsoft Windows Installer Service Link Following Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Microsoft Windows. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the Windows...

Microsoft Windows Installer 后置链接漏洞

Microsoft Windows Installer is a component of the Windows operating system from Microsoft Corporation USA. It provides a standard basis for installing and uninstalling software. A backlink vulnerability exists in Microsoft Windows Installer. An attacker could exploit the vulnerability to elevate...

Autodesk Installer 安全漏洞

Autodesk installer is an installer program from Autodesk USA. A security vulnerability exists in Autodesk Installer that stems from the use of an untrusted search path that could result in elevation of privilege to NT AUTHORITY/SYSTEM...

PT-2025-24828 · Microsoft · Windows Installer +1

Name of the Vulnerable Software and Affected Versions: Windows Installer affected versions not specified Description: The issue is related to improper access control in Windows Installer, allowing an authorized attacker to elevate privileges locally. Recommendations: At the moment, there is no...

PT-2025-25562

Name of the Vulnerable Software and Affected Versions Apache Tomcat versions 11.0.0-M1 through 11.0.7 Apache Tomcat versions 10.1.0 through 10.1.41 Apache Tomcat versions 9.0.23 through 9.0.105 Description The issue is related to an Untrusted Search Path vulnerability in the Apache Tomcat install...

Fixed in Apache Tomcat 11.0.8

Moderate: Session fixation possible via rewrite valve CVE-2025-55668 If the rewrite valve was enabled for a web application, an attacker was able to craft a URL that, if a victim clicked on it, would cause the victim's interaction with that resource to occur in the context of the attacker's...

Fixed in Apache Tomcat 10.1.42

Moderate: Session fixation possible via rewrite valve CVE-2025-55668 If the rewrite valve was enabled for a web application, an attacker was able to craft a URL that, if a victim clicked on it, would cause the victim's interaction with that resource to occur in the context of the attacker's...

CVE-2025-48940

CVE-2025-48940 affects MyBB pre-1.8.39 where the upgrade component does not validate input, enabling local file inclusion (LFI) via a crafted parameter when the installer is unlocked and the upgrade script is accessible (e.g., reinstall or admin-authenticated scenarios). MyBB 1.8.39 resolves the ...

CVE-2025-48742

The installer in SIGB PMB before and fixed in v.8.0.1.2 allows remote code execution...

XenServer and Citrix Hypervisor Security Update for CVE-2025-27462, CVE-2025-27463, CVE-2025-27464

Description of Problem Issues have been identified in the XenServer VM Tools for Windows that allow an attacker who has the ability to execute arbitrary unprivileged code within a guest Windows VM to compromise that same VM. This issue affects Windows VMs running on either XenServer 8.4 and Citri...

CVE-2025-5180

A vulnerability, which was classified as critical, has been found in Wondershare Filmora 14.5.16. Affected by this issue is some unknown functionality in the library CRYPTBASE.dll of the file NFWCHK.exe of the component Installer. The manipulation leads to uncontrolled search path. Attacking...

CVE-2025-5180

A vulnerability, which was classified as critical, has been found in Wondershare Filmora 14.5.16. Affected by this issue is some unknown functionality in the library CRYPTBASE.dll of the file NFWCHK.exe of the component Installer. The manipulation leads to uncontrolled search path. Attacking...

CVE-2025-5180

CVE-2025-5180 affects Wondershare Filmora 14.5.16. The issue is in the Installer component, specifically the NFWCHK.exe’s interaction with the CRYPTBASE.dll library, which enables an uncontrolled search path. This allows a local attacker to exploit the vulnerability, with attack complexity descri...

CVE-2024-31203

A “CWE-121: Stack-based Buffer Overflow” in the wd210std.dll dynamic library packaged with the ThermoscanIP installer allows a local attacker to possibly trigger a Denial-of-Service DoS condition on the target component...