shakeitoff

shakeitoff A smaller, minimized, and cleaner version of InstallerFileTakeOver aka the zero-day exploit that is a "variation" of CVE-2021-41379 later assigned CVE-2021-43883. This version does not pop a shell like InstallerFileTakeOver. The point of this code was to create a simpler proof of conce...

qlikview-poc-CVE-2024-29863

Applicazione interessata: QlikView Piattaforma: Windows Problema: Escalation dei privilegi locale tramite l'installer MSI race condition di DLL hijacking Scoperto e segnalato da: Pawel Karwowski e Julian Horoszkiewicz Eviden Red Team Dettagli: Sui sistemi con QuikView12 installato, è possibile pe...

CVE-2023-32353-PoC

CVE-2023-32353 प्रूफ ऑफ कॉन्सेप्ट अस्वीकरण यह प्रूफ ऑफ कॉन्सेप्ट कोड शैक्षिक उद्देश्यों के लिए प्रकाशित किया गया है। इसका उद्देश्य अन्य लोगों को समान कमजोरियां खोजने, उन्हें जिम्मेदारी से रिपोर्ट करने और उन्हें ठीक करने के लिए प्रोत्साहित करना है। 23 मई, 2023 को एप्पल ने इस कमजोरी के लिए एक फिक्स...

msiscan

Analizzatore MSI Questo script Python per Linux può analizzare i file di installazione Microsoft Windows .msi e segnalare potenziali vulnerabilità. È stato sviluppato da Michael Baer @derbaer0 nel SEC Consult Vulnerability Lab. Attualmente, è adatto principalmente a un'escalation di privilegi...

Tsundere Botnet Expands Using Game Lures and Ethereum-Based C2 on Windows

Cybersecurity researchers have warned of an actively expanding botnet dubbed Tsundere that's targeting Windows users. Active since mid-2025, the threat is designed to execute arbitrary JavaScript code retrieved from a command-and-control C2 server, Kaspersky researcher Lisandro Ubiedo said in an...

CVE-2025-11535 MongoDB Connector for BI installation MSI leave ACLs unset on custom installation directories

MongoDB Connector for BI installation via MSI on Windows leaves ACLs unset on custom install directories allows Privilege Escalation.This issue affects MongoDB Connector for BI: from 2.0.0 through 2.14.24...

EUVD-2020-5032

Malware in sbrugna...

EUVD-2020-8229

Malware in sbrugna...

EUVD-2024-35262

Malicious code in bioql PyPI...

EUVD-2024-47737

Malicious code in bioql PyPI...

EUVD-2024-33163

Malicious code in bioql PyPI...

EUVD-2022-45079

Malicious code in bioql PyPI...

CVE-2025-10491 MongoDB Windows installation MSI may leave ACLs unset on custom installation directories

The MongoDB Windows installation MSI may leave ACLs unset on custom installation directories allowing a local attacker to introduce executable code to MongoDB's process via DLL hijacking. This issue affects MongoDB Server v6.0 version prior to 6.0.25, MongoDB Server v7.0 version prior to 7.0.21 a...

CVE-2023-1314

A vulnerability has been discovered in cloudflared's installer = 2023.3.0 for Windows 32-bits devices that allows a local attacker with no administrative permissions to escalate their privileges on the affected device. This vulnerability exists because the MSI installer used by cloudflared relied...

CVE-2022-41975

RealVNC VNC Server before 6.11.0 and VNC Viewer before 6.22.826 on Windows allow local privilege escalation via MSI installer Repair mode...

CVE-2024-42050

The MSI installer for Splashtop Streamer for Windows before 3.7.0.0 uses a temporary folder with weak permissions during installation. A local user can exploit this to escalate privileges to SYSTEM via an oplock on CredProviderInst.reg...

CVE-2024-10526

Rapid7 Velociraptor MSI Installer versions below 0.73.3 suffer from a vulnerability whereby it creates the installation directory with WRITEDACL permission to the BUILTIN\Users group. This allows local users who are not administrators to grant themselves the Full Control permission on...

CVE-2024-10526

The provided data confirms CVE-2024-10526 affects Rapid7 Velociraptor MSI Installer before version 0.73.3. The issue stems from the installer creating the installation directory with WRITE_DACL permissions for BUILTIN\Users, enabling non-admin local users to grant themselves Full Control on Veloc...

Rapid7 Velociraptor MSI Installer 安全漏洞

Rapid7 Velociraptor MSI Installer is a unique, advanced, open source endpoint monitoring, digital forensics, and cyber response platform from Rapid7 USA. A security vulnerability exists in Rapid7 Velociraptor MSI Installer prior to version 0.73.3 that originates from the execution of arbitrary co...

CVE-2024-35288

Nitro PDF Pro before 13.70.8.82 and 14.x before 14.26.1.0 allows Local Privilege Escalation in the MSI Installer because custom actions occur unsafely in repair mode. CertUtil is run in a conhost.exe window, and there is a mechanism allowing CTRL+o to launch cmd.exe as NT AUTHORITY\SYSTEM...