Microsoft Windows Installer backend link vulnerability

Microsoft Windows Installer is a component of the Windows operating system from Microsoft Corporation USA. It provides a standard basis for installing and uninstalling software. A backlink vulnerability exists in Microsoft Windows Installer. An attacker could exploit the vulnerability to obtain...

CVE-2025-29837: Improper Link Resolution Before File Access

Improper link resolution before file access 'link following' in Windows Installer allows an authorized attacker to disclose information locally...

SUSE CVE-2025-2759

GStreamer Incorrect Permission Assignment Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of GStreamer. An attacker must first obtain the ability to execute low-privileged code on the target system in order to...

PT-2025-20059 · Unknown · Package Installer

Name of the Vulnerable Software and Affected Versions: PackageInstallerCN versions prior to 15.0.11.0 Description: The issue is related to the improper handling of insufficient permission in PackageInstallerCN, allowing a local attacker to bypass user interaction for requested installations...

Google ChromeOS Component Installation Privilege Escalation

The vulnerability of the Google ChromeOS operating system’s component installation mechanisms components/componentupdater/componentinstaller.cc is related to the use of memory after it is freed. Exploiting this vulnerability can allow a remote attacker to bypass security restrictions and gain...

PT-2025-18342 · Gstreamer +2 · Gstreamer +1

Name of the Vulnerable Software and Affected Versions: GStreamer affected versions not specified Description: This issue allows local attackers to escalate privileges on affected installations. An attacker must first obtain the ability to execute low-privileged code on the target system. The flaw...

CVE-2025-3840

An improper neutralization of input vulnerability was identified in the End of Life EOL OVA based connect installer component which is deployed for installation purposes in a customer network. This EOL component was deprecated in September 2023 with end of support extended till January 2024. An...

FAS - Upgrade of FAS server failed with error "Unable to complete the installation"

1 Attempting to upgrade FAS server component fails with below error- 2 Reinstallation attempt fails with the same error. 3 Event viewer shows below error : Log Name: Application Source: MsiInstaller Event ID: 11722 Task Category: None Level: Error Description: Product: Citrix Federated...

[SECURITY] Fedora 41 Update: uv-0.6.14-3.fc41

An extremely fast Python package installer and resolver, written in Rust. Designed as a drop-in replacement for common pip and pip-tools workflows. Highlights: =E2=80=A2 =E2=9A=96=EF=B8=8F Drop-in replacement for common pip, pip-tools, and virtualenv commands. =E2=80=A2 =E2=9A=A1=EF=B8=8F 10-100x...

[SECURITY] Fedora 40 Update: uv-0.6.14-3.fc40

An extremely fast Python package installer and resolver, written in Rust. Designed as a drop-in replacement for common pip and pip-tools workflows. Highlights: =E2=80=A2 =E2=9A=96=EF=B8=8F Drop-in replacement for common pip, pip-tools, and virtualenv commands. =E2=80=A2 =E2=9A=A1=EF=B8=8F 10-100x...

PT-2025-17432 · Unknown · Ova Connect Installer

Name of the Vulnerable Software and Affected Versions: OVA Connect Installer affected versions not specified Description: An improper neutralization of input issue was identified in the End of Life EOL OVA based connect installer component. This component was deprecated in September 2023 with end...

CVE-2025-3840: Improper Neutralization of Input During Web Page Generation

An improper neutralization of input vulnerability was identified in the End of Life EOL OVA based connect installer component which is deployed for installation purposes in a customer network. This EOL component was deprecated in September 2023 with end of support extended till January 2024. An...

[SECURITY] Fedora 42 Update: uv-0.6.14-3.fc42

An extremely fast Python package installer and resolver, written in Rust. Designed as a drop-in replacement for common pip and pip-tools workflows. Highlights: =E2=80=A2 =E2=9A=96=EF=B8=8F Drop-in replacement for common pip, pip-tools, and virtualenv commands. =E2=80=A2 =E2=9A=A1=EF=B8=8F 10-100x...

CVE-2025-1688

Milestone Systems has discovered a security vulnerability in Milestone XProtect installer that resets system configuration password after the upgrading from older versions using specific installers. The system configuration password is an additional, optional protection that is enabled on the...

Node.js Malware Campaign Targets Crypto Users with Fake Binance and TradingView Installers

Microsoft is calling attention to an ongoing malvertising campaign that makes use of Node.js to deliver malicious payloads capable of information theft and data exfiltration. The activity, first detected in October 2024, uses lures related to cryptocurrency trading to trick users into installing ...

CVE-2025-1688: Use of Default Cryptographic Key

Milestone Systems has discovered a security vulnerability in Milestone XProtect installer that resets system configuration password after the upgrading from older versions using specific installers. The system configuration password is an additional, optional protection that is enabled on the...

Windows Installer Privilege Escalation

The vulnerability of the Windows Installer component in Windows operating systems is related to an incorrect definition of the reference before accessing the file. Exploiting this vulnerability can allow an attacker to increase their privileges...

qBittorrent 5.0.1 - MITM RCE

Exploit Title: qBittorrent 5.0.1 MITM RCE Date: 01/02/2025 Exploit Author: Jordan Sharp Vendor Homepage: https://github.com/qbittorrent/qBittorrent Software Link: https://www.qbittorrent.org/download Version: 5.0.1 Tested on: Windows 10 CVE : CVE-2024-51774 Run the PoC on a MITM machine...

CVE-2025-27727

Improper link resolution before file access 'link following' in Windows Installer allows an authorized attacker to elevate privileges locally...

Check Point Response to CVE-2024-24916 - DLL HiJacking

Cause The installer relies on the default Windows DLL search order, which includes the current working directory. If required DLLs are missing or not explicitly loaded from a secure path, this can lead to DLL hijacking. Symptoms - Untrusted DLLs in the installer's directory may be loaded and...