CVE-2022-50924

CVE-2022-50924 affects Private Internet Access 3.3, specifically the pia-service unquoted service path. The unquoted path in the service configuration allows a local attacker to inject code that would run with LocalSystem privileges during service startup, enabling potentially arbitrary code exec...

CVE-2022-50923 Cobian Backup 0.9 - Unquoted Service Path

Cobian Backup 0.9 contains an unquoted service path vulnerability that allows local users to execute arbitrary code with elevated system privileges. Attackers can exploit the unquoted binary path in the CobianReflectorService to inject malicious code that will execute with LocalSystem permissions...

CVE-2022-50921

WOW21 5.0.1.9 contains an unquoted service path vulnerability that can let local attackers execute arbitrary code with elevated privileges by leveraging the unquoted binary path during service startup. The weakness affects the WOW21 service (WOW21_Service) and enables LocalSystem-level execution ...

CVE-2022-50918

The CVE concerns VIVE Runtime Service 1.0.0.4, where an unquoted service path enables local users to run arbitrary code with elevated privileges during service startup. Attackers could place a malicious executable in affected directories to gain LocalSystem access. The vulnerability is local in s...

CVE-2022-50918 VIVE Runtime Service - 'ViveAgentService' Unquoted Service Path

VIVE Runtime Service 1.0.0.4 contains an unquoted service path vulnerability that allows local users to execute arbitrary code with elevated system privileges. Attackers can exploit the unquoted binary path by placing malicious executables in specific system directories to gain LocalSystem access...

CVE-2022-50901

Wondershare Dr.Fone 11.4.9 has an unquoted service path in the DFWSIDService located at C:\Program Files (x86)\Wondershare\Wondershare Dr.Fone, enabling local users to potentially execute arbitrary code with LocalSystem privileges. The CVE is documented with public references and an exploit in Ex...

CVE-2022-50901 Wondershare Dr.Fone 11.4.9 - 'DFWSIDService' Unquoted Service Path

Wondershare Dr.Fone 11.4.9 contains an unquoted service path vulnerability in the DFWSIDService that allows local users to potentially execute arbitrary code. Attackers can exploit the unquoted path in C:\Program Files x86\Wondershare\Wondershare Dr.Fone\ to inject malicious executables that woul...

CVE-2022-50900 Wondershare Dr.Fone 12.0.18 - 'Wondershare InstallAssist' Unquoted Service Path

Wondershare Dr.Fone 12.0.18 contains an unquoted service path vulnerability that allows local users to execute arbitrary code with elevated system privileges. Attackers can exploit the misconfigured service path to insert malicious code that will be executed with LocalSystem permissions during...

CVE-2026-0859 TYPO3 CMS Allows Insecure Deserialization via Mailer File Spool

TYPO3's mail‑file spool deserialization flaw lets local users with write access to the spool directory craft a malicious file that is deserialized during the mailer:spool:send command, enabling arbitrary PHP code execution on the web server. This issue affects TYPO3 CMS versions 10.0.0-10.4.54,...

BIT-MASTODON-2026-22246 Local Mastodon users can enumerate and access severed relationships of every other local user

Mastodon is a free, open-source social network server based on ActivityPub. Mastodon 4.3 added notifications of severed relationships, allowing end-users to inspect the relationships they lost as the result of a moderation action. The code allowing users to download lists of severed relationships...

PT-2026-2426

Name of the Vulnerable Software and Affected Versions Mediconta version 3.7.27 Description Mediconta version 3.7.27 contains an unquoted service path vulnerability within the servermedicontservice. This allows local users to potentially execute code with elevated privileges. The vulnerability...

PT-2026-2638

Name of the Vulnerable Software and Affected Versions TYPO3 versions 10.0.0 through 10.4.54 TYPO3 versions 11.0.0 through 11.5.48 TYPO3 versions 12.0.0 through 12.4.40 TYPO3 versions 13.0.0 through 13.4.22 TYPO3 versions 14.0.0 through 14.0.1 Description A flaw exists in TYPO3 that allows local...

PT-2026-2379

Name of the Vulnerable Software and Affected Versions Wondershare MobileTrans version 3.5.9 Description The software contains an unquoted service path vulnerability within the ElevationService. This allows local users to potentially execute code with elevated system privileges. Exploitation...

PT-2026-2400

Private Internet Access 3.3 contains an unquoted service path vulnerability that allows local users to potentially execute arbitrary code with elevated system privileges. Attackers can exploit the unquoted path in the service configuration to inject malicious code that would execute with...

PT-2026-2377

Name of the Vulnerable Software and Affected Versions Wondershare Dr.Fone version 11.4.9 Description Wondershare Dr.Fone version 11.4.9 has an issue with an unquoted service path in the DFWSIDService. This could allow local users to potentially run arbitrary code. The unquoted path is located at...

PT-2026-2394

Name of the Vulnerable Software and Affected Versions VIVE Runtime Service version 1.0.0.4 Description The VIVE Runtime Service contains a flaw due to an unquoted service path. This allows local users to potentially execute arbitrary code with elevated system privileges. An attacker can exploit t...

AZL-74271 CVE-2025-68276 affecting package avahi for versions less than 0.8-5

Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, an unprivileged local users can crash avahi-daemon with wide-area disabled by creating record browsers with the AVAHILOOKUPUSEWIDEAREA flag set via D-Bus. This can ...

CVE-2025-68276

Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, an unprivileged local users can crash avahi-daemon with wide-area disabled by creating record browsers with the AVAHILOOKUPUSEWIDEAREA flag set via D-Bus. This can ...

CVE-2025-68276

Avahi is a system which facilitates service discovery on a local network via the mDNS/DNS-SD protocol suite. In 0.9-rc2 and earlier, an unprivileged local users can crash avahi-daemon with wide-area disabled by creating record browsers with the AVAHILOOKUPUSEWIDEAREA flag set via D-Bus. This can ...

PT-2026-2281

Name of the Vulnerable Software and Affected Versions Avahi versions prior to 0.9-rc2 Description Avahi, a system for service discovery on a local network using the mDNS/DNS-SD protocol suite, is susceptible to a denial-of-service condition. An unprivileged local user can cause the avahi-daemon t...