CVE-2022-20005

In validateApkInstallLocked of PackageInstallerSession.java, there is a way to force a mismatch between running code and a parsed APK . This could lead to local escalation of privilege with User execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions:...

coreos-installer bug fix and enhancement update

For detailed information on changes in this release, see the AlmaLinux Release Notes linked from the References section...

coreos-installer bug fix and enhancement update

An update is available for coreos-installer. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list For detailed information on changes in this release, see the Rocky...

Zoom Client Link Following Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Zoom Client. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the installer. By creati...

Zoom Client Link Following Local Privilege Escalation Vulnerability

This vulnerability allows local attackers to escalate privileges on affected installations of Zoom Client. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the installer. By creati...

USB-based Wormable Raspberry Robin Malware Targeting Windows Installer

By Deeba Ahmed The malware Raspberry Robin is distributed via external drives and uses Microsoft Standard installer to execute malicious commands.… This is a post from HackRead.com Read the original post: USB-based Wormable Raspberry Robin Malware Targeting Windows Installer...

CVE-2021-27765

The BigFix Server API installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local user to perform a privilege escalation. This vulnerability was resolved by updating to an InstallShield version with the underlying vulnerability fixed...

CVE-2021-27767

The BigFix Console installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local user to perform a privilege escalation. This vulnerability was resolved by updating to an InstallShield version with the underlying vulnerability fixed...

Privilege escalation

The BigFix Client installer is created with InstallShield, which was affected by CVE-2021-41526, a vulnerability that could allow a local user to perform a privilege escalation. This vulnerability was resolved by updating to an InstallShield version with the underlying vulnerability fixed...

CVE-2021-27767

CVE-2021-27767 stems from the BigFix Console installer built with InstallShield, which is linked to CVE-2021-41526 (InstallScript-based privilege escalation). The connected sources note that InstallShield-related flaws can enable local privilege escalation and, in some reports (CWE-427), may allo...

CVE-2021-27766

CVE-2021-27766 and CVE-2021-27767 relate to the installers used by HCL BigFix: the BigFix Client and Console installers, both built with InstallShield. Connected sources corroborate that the underlying issue is the InstallShield/InstallScript vulnerability CVE-2021-41526, which can allow local pr...

CVE-2021-27765

The CVE-2021-27765 entry relates to BigFix components packaged with InstallShield. Concrete details from connected documents show that BigFix Server API installer (and related BigFix Console/Client installers) use InstallShield and are affected by CVE-2021-41526, which involves InstallScript acti...

USB-based Wormable Malware Targets Windows Installer

Credit: Red Canary Wormable malware dubbed Raspberry Robin has been active since last September and is wriggling its way through USB drives onto Windows machines to use Microsoft Standard Installer and other legitimate processes to install malicious files, researchers have found. Researchers at...

Researchers Warn of 'Raspberry Robin' Malware Spreading via External Drives

Cybersecurity researchers have discovered a new Windows malware with worm-like capabilities and is propagated by means of removable USB devices. Attributing the malware to a cluster named "Raspberry Robin," Red Canary researchers noted that the worm "leverages Windows Installer to reach out to...

USU Oracle Optimization Information Disclosure Vulnerability

USU Oracle Optimization is used to improve Oracle query performance. versions prior to USU Oracle Optimization 5.17.5 contain an information disclosure vulnerability that could be exploited by an attacker to discover quantum credentials via a proxy installer download...

PT-2022-11422 · Microsoft · Windows Installer

Name of the Vulnerable Software and Affected Versions: Windows Installer MSI built with InstallScript custom action affected versions not specified Description: A vulnerability has been reported in the Windows Installer MSI built with InstallScript custom action, which may allow privilege...

CVE-2022-29263

On F5 BIG-IP APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, as well as F5 BIG-IP APM Clients 7.x versions prior to 7.2.1.5, the BIG-IP Edge Client Component...

CVE-2022-28714

On F5 BIG-IP APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, as well as F5 BIG-IP APM Clients 7.x versions prior to 7.2.1.5, a DLL Hijacking vulnerability exists in...

Design/Logic Flaw

On F5 BIG-IP APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and all versions of 12.1.x and 11.6.x, as well as F5 BIG-IP APM Clients 7.x versions prior to 7.2.1.5, a DLL Hijacking vulnerability exists in...

The vulnerability of the Windows Installer installation service on Microsoft Windows operating systems allows a perpetrator to trigger a service failure.

The vulnerability of the Windows Installer installation service on Microsoft Windows operating systems is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to cause a service failure...