Samsung Smart Switch for Windows Installer 安全漏洞

SAMSUNG Smart Switch PC is a Windows software from Samsung South Korea. It is used for data transfer. A security vulnerability exists in Samsung Smart Switch for Windows Installer prior to version 4.3.230433, which stems from an improper privilege management vulnerability that could allow an...

BlackCat Operators Distributing Ransomware Disguised as WinSCP via Malvertising

Threat actors associated with the BlackCat ransomware have been observed employing malvertising tricks to distribute rogue installers of the WinSCP file transfer application. "Malicious actors used malvertising to distribute a piece of malware via cloned webpages of legitimate organizations," Tre...

The vulnerabilities in the configuration of FortiClient installer distributions and the FortiConverter migration service allow a hacker to replace files in the software installation directory.

The vulnerability of the Fortinet FortiClient installer and the FortiConverter configuration and policy transfer tool is related to errors in the use of standard permissions. Exploiting this vulnerability could allow an attacker to replace files in the software installation directory...

CISA Releases Nine Industrial Control Systems Advisories

CISA released nine Industrial Control Systems ICS advisories on June 29, 2023. These advisories provide timely information about current security issues, vulnerabilities, and exploits surrounding ICS. ICSA-23-180-01 Delta Electronics InfraSuite Device Master ICSA-23-180-02 Schneider Electric...

Node.js 安全漏洞

Node.js is an open source, cross-platform JavaScript runtime environment. A security vulnerability exists in Node.js that stems from the ability to elevate privileges via a malicious registry key operation during an installer fix...

Terraform Enterprise, Docker Engine, and Go’s CVE-2023-24540

Summary Up until June 2023, Docker Engine 20.10 was the highest release officially supported by Terraform Enterprise TFE. However, that version is no longer supported by Docker and was built using a version of Go that has since had a number of CVEs disclosed. While these CVEs are unlikely to be...

CVE-2023-20178

A vulnerability in the client update process of Cisco AnyConnect Secure Mobility Client Software for Windows and Cisco Secure Client Software for Windows could allow a low-privileged, authenticated, local attacker to elevate privileges to those of SYSTEM. The client update process is executed aft...

SupremeBot and Mario cross the finish line together

Researchers have reported how popular game installers like Super Mario Games are being used to deliver malware. The malicious components include cryptominers, the SupremeBot mining client, and the open-source Umbral stealer. The game installers route offers some very distinct advantages to the...

CVE-2023-27908

A maliciously crafted DLL file can be forced to write beyond allocated boundaries in the Autodesk installer when parsing the DLL files and could lead to a Privilege Escalation vulnerability...

CVE-2023-27908

A maliciously crafted DLL file can be forced to write beyond allocated boundaries in the Autodesk installer when parsing the DLL files and could lead to a Privilege Escalation vulnerability...

Privilege escalation

A maliciously crafted DLL file can be forced to write beyond allocated boundaries in the Autodesk installer when parsing the DLL files and could lead to a Privilege Escalation vulnerability...

CVE-2023-27908

A maliciously crafted DLL file can be forced to write beyond allocated boundaries in the Autodesk installer when parsing the DLL files and could lead to a Privilege Escalation vulnerability...

Autodesk Installer 代码问题漏洞

Autodesk installer is an installation program from the American company Autodesk. A security vulnerability exists in Autodesk Installer. An attacker can exploit the vulnerability to elevate privileges...

CVE-2023-27908

CVE-2023-27908 targets the Autodesk Installer. A malicious DLL can be parsed in a way that causes writes beyond allocated boundaries, enabling a local privilege escalation . The NVD entry lists exploit conditions as LOCAL with user interaction required, and a high impact on confidentiality, integ...

CVE-2023-27908

A maliciously crafted DLL file can be forced to write beyond allocated boundaries in the Autodesk installer when parsing the DLL files and could lead to a Privilege Escalation vulnerability...

SUSE CVE-2023-30585

A vulnerability has been identified in the Node.js .msi version installation process, specifically affecting Windows users who install Node.js using the .msi installer. This vulnerability emerges during the repair operation, where the "msiexec.exe" process, running under the NT AUTHORITY\SYSTEM...

The vulnerability of the Python programming language’s pip module lies in the insufficient validation of input data, which allows attackers to compromise the integrity of data.

The vulnerability of the Python programming language’s pip module is related to insufficient validation of input data. Exploiting this vulnerability can allow an attacker to compromise the integrity of data...

IBM SPSS Modeler Subscription Installer 安全漏洞

IBM SPSS Modeler Subscription Installer is a software application from International Business Machines IBM, Inc. Used for a set of data mining, the tools allow the adoption of business techniques to quickly build predictive models and apply them to business activities, thus improving the...

CVE-2023-32274

Enphase Installer Toolkit versions 3.27.0 has hard coded credentials embedded in binary code in the Android application. An attacker can exploit this and gain access to sensitive information...

CVE-2023-32274

Enphase Installer Toolkit versions 3.27.0 has hard coded credentials embedded in binary code in the Android application. An attacker can exploit this and gain access to sensitive information...