7663 matches found
CVE-2022-3421
An attacker can pre-create the /Applications/Google\ Drive.app/Contents/MacOS directory which is expected to be owned by root to be owned by a non-root user. When the Drive for Desktop installer is run for the first time, it will place a binary in that directory with execute permissions and set i...
CVE-2022-3421
An attacker can pre-create the /Applications/Google\ Drive.app/Contents/MacOS directory which is expected to be owned by root to be owned by a non-root user. When the Drive for Desktop installer is run for the first time, it will place a binary in that directory with execute permissions and set i...
Code injection
An attacker can pre-create the /Applications/Google\ Drive.app/Contents/MacOS directory which is expected to be owned by root to be owned by a non-root user. When the Drive for Desktop installer is run for the first time, it will place a binary in that directory with execute permissions and set i...
CVE-2022-3421
CVE-2022-3421 (Google Drive for Desktop on macOS) is a privilege-escalation vulnerability affecting versions prior to 64.0. An attacker can pre-create the directory /Applications/Google Drive.app/Contents/MacOS, which should be root-owned. On first install, the installer places a binary in that d...
The installer of Sony Content Transfer may insecurely load Dynamic Link Libraries
Overview The installer of Content Transfer for Windows provided by Sony Corporation contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries CWE-427. Tomohisa Hasegawa of Canon IT Solutions Inc. reported this vulnerability to IPA. JPCERT/CC coordinat...
Sony Content Transfer 代码问题漏洞
SONY Content Transfer is a file transfer software from Sony Japan. It is suitable for customers who manage music, video, photo, and podcast content using iTunes, etc. SONY Content Transfer suffers from a code issue vulnerability that stems from the installer containing a DLL search path issue tha...
PT-2022-5833 · Unknown · Content Transfer
Name of the Vulnerable Software and Affected Versions: Content Transfer for Windows versions 1.3 and prior Description: The issue is related to an untrusted search path vulnerability in the installer. This could allow an attacker to elevate privileges by using a specially crafted DLL. The...
Popular YouTube Channel Caught Distributing Malicious Tor Browser Installer
A popular Chinese-language YouTube channel has emerged as a means to distribute a trojanized version of a Windows installer for the Tor Browser. Kaspersky dubbed the campaign OnionPoison, with all of the victims located in China. The scale of the attack remains unclear, but the Russian...
Comm100 Chat Provider Hijacked to Spread Malware in Supply Chain Attack
A threat actor likely with associations to China has been attributed to a new supply chain attack that involves the use of a trojanized installer for the Comm100 Live Chat application to distribute a JavaScript backdoor. Cybersecurity firm CrowdStrike said the attack made use of a signed Comm100...
CVE-2022-41975
RealVNC VNC Server before 6.11.0 and VNC Viewer before 6.22.826 on Windows allow local privilege escalation via MSI installer Repair mode...
CVE-2022-41975
RealVNC VNC Server before 6.11.0 and VNC Viewer before 6.22.826 on Windows allow local privilege escalation via MSI installer Repair mode...
Privilege escalation
RealVNC VNC Server before 6.11.0 and VNC Viewer before 6.22.826 on Windows allow local privilege escalation via MSI installer Repair mode...
CVE-2022-41975
CVE-2022-41975 – RealVNC Server/Viewer local privilege escalation : RealVNC VNC Server prior to 6.11.0 and VNC Viewer prior to 6.22.826 on Windows are vulnerable due to insecure privilege management in MSI installer Repair mode, enabling local privilege escalation. Affected components: RealVNC VN...
CVE-2022-41975
RealVNC VNC Server before 6.11.0 and VNC Viewer before 6.22.826 on Windows allow local privilege escalation via MSI installer Repair mode...
CVE-2022-41975
RealVNC VNC Server before 6.11.0 and VNC Viewer before 6.22.826 on Windows allow local privilege escalation via MSI installer Repair mode...
The vulnerability of the implementation of executable files of the IntelliJ IDEA software installer allows a perpetrator to execute arbitrary code.
The vulnerability of the executable file installation mechanism of the IntelliJ IDEA integrated development environment is related to an uncontrollable element in the search process. Exploiting this vulnerability can allow attackers to execute arbitrary code...
RealVNC VNC Server 安全漏洞
RealVNC VNC Server is a VNC server for remote access software from RealVNC UK. A security vulnerability exists in RealVNC VNC Server versions prior to 6.11.0 and VNC Viewer versions prior to 6.22.826. An attacker has exploited the vulnerability to perform a local elevation of privilege via MSI...
PT-2022-5791 · Realvnc +1 · Realvnc Viewer +2
Name of the Vulnerable Software and Affected Versions: RealVNC VNC Server versions prior to 6.11.0 RealVNC VNC Viewer versions prior to 6.22.826 on Windows Description: The issue is related to insecure privilege management in RealVNC, allowing an attacker to escalate their privileges by exploitin...