MSI Data Breach: Private Code Signing Keys Leaked on the Dark Web

The threat actors behind the ransomware attack on Taiwanese PC maker MSI last month have leaked the company's private code signing keys on their dark website. "Confirmed, Intel OEM private key leaked, causing an impact on the entire ecosystem," Alex Matrosov, founder and CEO of firmware security...

Taiwanese PC Company MSI Falls Victim to Ransomware Attack

Taiwanese PC company MSI short for Micro-Star International officially confirmed it was the victim of a cyber attack on its systems. The company said it "promptly" initiated incident response and recovery measures after detecting "network anomalies." It also said it alerted law enforcement agenci...

New Money Message Ransomware Gang Hits MSI, Threatens of Data Leak

By Waqas The Money Message ransomware group has reportedly demanded a ransom of $4 million from MSI. This is a post from HackRead.com Read the original post: New Money Message Ransomware Gang Hits MSI, Threatens of Data Leak...

CVE-2023-0652

Due to a hardlink created in the ProgramData folder during the repair process of the software, the installer MSI of WARP Client for Windows = 2022.12.582.0 allowed a malicious attacker to forge the destination of the hardlink and escalate privileges, overwriting SYSTEM protected files. As...

CVE-2023-0652

CVE-2023-0652 is a Local Privilege Escalation in Cloudflare WARP Installer (Windows). The issue stems from a hardlink created in the ProgramData folder during the repair process, where the MSI-based installer could forge the hardlink’s destination, enabling privilege escalation and overwriting SY...

CVE-2023-1412

An unprivileged non-admin user can exploit an Improper Access Control vulnerability in the Cloudflare WARP Client for Windows = 2022.12.582.0 to perform privileged operations with SYSTEM context by working with a combination of opportunistic locks oplock and symbolic links which can both be creat...

Improper access control

An unprivileged non-admin user can exploit an Improper Access Control vulnerability in the Cloudflare WARP Client for Windows = 2022.12.582.0 to perform privileged operations with SYSTEM context by working with a combination of opportunistic locks oplock and symbolic links which can both be creat...

CVE-2023-1412

An unprivileged non-admin user can exploit an Improper Access Control vulnerability in the Cloudflare WARP Client for Windows = 2022.12.582.0 to perform privileged operations with SYSTEM context by working with a combination of opportunistic locks oplock and symbolic links which can both be creat...

CVE-2023-1412

The CVE-2023-1412 issue affects Cloudflare WARP Client for Windows (versions ≤ 2022.12.582.0). The root cause is an Improper Access Control in the MSI installer repair function stored under C:\Windows\Installer, exploitable by an unprivileged user to execute privileged SYSTEM context operations v...

Race condition

An issue was discovered in Acuant AcuFill SDK before 10.22.02.03. Multiple MSI's get executed out of a standard-user writable directory. Through a race condition and OpLock manipulation, these files can be overwritten by a standard user. They then get executed by the elevated installer. This give...

CVE-2022-48221

An issue was discovered in Acuant AcuFill SDK before 10.22.02.03. Multiple MSI's get executed out of a standard-user writable directory. Through a race condition and OpLock manipulation, these files can be overwritten by a standard user. They then get executed by the elevated installer. This give...

CVE-2021-41526

A vulnerability has been reported in the windows installer MSI built with InstallScript custom action. This vulnerability may allow privilege escalation when invoked ‘repair’ of the MSI which has an InstallScript custom action...

CVE-2021-41526

CVE-2021-41526 affects Windows Installer (MSI) built with InstallScript actions from InstallShield. The issue allows local privilege escalation when an MSI repair triggers an InstallScript custom action, enabling elevation to Administrator in affected installs. Public reports and mappings (e.g., ...

Privilege Escalation

github.com/cloudflare/cloudflared is vulnerable to Privilege Escalation. A local attacker with no administrative permissions may use symbolic links to manipulate the MSI installer's repair functionality to delete important system files or replace them with malicious files, potentially leading to...

cloudflared's Installer has Local Privilege Escalation Vulnerability

Impact A vulnerability has been discovered in cloudflared's installer = 2023.3.0 for Windows 32-bits devices that allows a local attacker with no administrative permissions to escalate their privileges on the affected device. This vulnerability exists because the MSI installer used by cloudflared...

CVE-2023-1314

A vulnerability has been discovered in cloudflared's installer = 2023.3.0 for Windows 32-bits devices that allows a local attacker with no administrative permissions to escalate their privileges on the affected device. This vulnerability exists because the MSI installer used by cloudflared relied...

Design/Logic Flaw

A vulnerability has been discovered in cloudflared's installer = 2023.3.0 for Windows 32-bits devices that allows a local attacker with no administrative permissions to escalate their privileges on the affected device. This vulnerability exists because the MSI installer used by cloudflared relied...

CVE-2023-1314

Cloudflared’s Windows 32-bit installer (≤ 2023.3.0) is affected by a Local Privilege Escalation. The MSI installer relied on a world-writable directory, enabling a local non-admin user to exploit symbolic links and trick the installer’s repair function into deleting or overwriting files, potentia...

CVE-2023-1314 Local Privilege Escalation Vulnerability in cloudflared's Installer

A vulnerability has been discovered in cloudflared's installer = 2023.3.0 for Windows 32-bits devices that allows a local attacker with no administrative permissions to escalate their privileges on the affected device. This vulnerability exists because the MSI installer used by cloudflared relied...

CVE-2023-1314 Local Privilege Escalation Vulnerability in cloudflared's Installer

A vulnerability has been discovered in cloudflared's installer = 2023.3.0 for Windows 32-bits devices that allows a local attacker with no administrative permissions to escalate their privileges on the affected device. This vulnerability exists because the MSI installer used by cloudflared relied...