CVE-2022-48225

An issue was discovered in Acuant AcuFill SDK before 10.22.02.03. It is used to install drivers from several different vendors. The Gemalto Document Reader child installation process is vulnerable to DLL hijacking, because it attempts to execute with elevated privileges multiple non-existent DLLs...

CVE-2022-48226

An issue was discovered in Acuant AcuFill SDK before 10.22.02.03. During installation, an EXE gets executed out of C:\Windows\Temp. A standard user can create the path file ahead of time and obtain elevated code execution. Permissions need to be modified to prevent manipulation...

CVE-2022-48223

An issue was discovered in Acuant AcuFill SDK before 10.22.02.03. During SDK repair, certutil.exe is called by the Acuant installer to repair certificates. This call is vulnerable to DLL hijacking due to a race condition and insecure permissions on the executing directory...

Acuant AcuFill SDK 安全漏洞

Acuant AcuFill SDK is a data capture technology from the American company Acuant. All major data fields can be extracted from documents. A security vulnerability exists in Acuant AcuFill SDK. No information about this vulnerability is available at this time, please stay tuned to CNNVD or the...

Acuant AcuFill SDK 代码问题漏洞

Acuant AcuFill SDK is a data capture technology from the American company Acuant. All major data fields can be extracted from documents. A security vulnerability exists in the Acuant AcuFill SDK that stems from a call to certutil.exe by the Acuant installer to repair certificates during SDK repai...

CVE-2022-48221

An issue was discovered in Acuant AcuFill SDK before 10.22.02.03. Multiple MSI's get executed out of a standard-user writable directory. Through a race condition and OpLock manipulation, these files can be overwritten by a standard user. They then get executed by the elevated installer. This give...

CVE-2022-48226

CVE-2022-48226 affects Acuant AcuFill SDK prior to 10.22.02.03. During installation, an EXE is executed from the C:\Windows\Temp directory, allowing a standard user to pre-create a file path and achieve elevated code execution. The root cause is improper handling of installer-extracted files in t...

PT-2023-15623 · Acuant · Acuant Acufill Sdk

Name of the Vulnerable Software and Affected Versions: Acuant AcuFill SDK versions prior to 10.22.02.03 Description: An issue was discovered in the Acuant AcuFill SDK. During installation, an executable file gets executed out of the C:WindowsTemp directory. A standard user can create the path fil...

CVE-2022-48225

An issue was discovered in Acuant AcuFill SDK before 10.22.02.03. It is used to install drivers from several different vendors. The Gemalto Document Reader child installation process is vulnerable to DLL hijacking, because it attempts to execute with elevated privileges multiple non-existent DLLs...

CVE-2022-48224

An issue was discovered in Acuant AcuFill SDK before 10.22.02.03. It is installed with insecure permissions full write access within Program Files. Standard users can replace files within this directory that get executed with elevated privileges, leading to a complete arbitrary code execution...

CVE-2022-48224

The CVE-2022-48224 issue affects Acuant AcuFill SDK versions prior to 10.22.02.03. It involves insecure permissions in the Program Files directory, enabling standard users to replace files that execute with elevated privileges, which can lead to complete arbitrary code execution (privilege escala...

CVE-2022-48223

Summary (CVE-2022-48223): A DLL hijacking race condition in Acuant AcuFill SDK (pre-10.22.02.03) during certificate repair via certutil.exe called by the installer. Causes insecure permissions on the executing directory, enabling potential unauthorized code execution or data compromise. Impact de...

The vulnerability of the JavaScript and TypeScript matrix-js-sdk development tools lies in the uncontrolled modification of prototype properties of objects, allowing attackers to trigger a service failure.

The vulnerability of the JavaScript and TypeScript matrix-js-sdk development tools is related to uncontrolled changes to prototype attributes of objects. Exploiting this vulnerability can allow a malicious actor, operating remotely, to cause service failures by using specially created input data...

Security Bulletin: Multiple vulnerabilities in IBM® Java SDK affect IBM WebSphere Application Server and IBM WebSphere Application Server Liberty due to January 2023 CPU plus deferred CVE-2022-21426

Summary There are multiple vulnerabilities in the IBM® SDK, Java™ Technology Edition that is shipped with IBM WebSphere Application Server and IBM WebSphere Application Server Liberty. The CVEs listed in this document might affect some configurations of IBM WebSphere Application Server traditiona...

Malicious code in @12build/product-api-ts-axios-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 336e30b4abb921976acb4a16517a2a6f2ad668fafe7e41d16b63dbba221feaa4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2023-21 Malicious code in @12build/product-api-ts-axios-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 336e30b4abb921976acb4a16517a2a6f2ad668fafe7e41d16b63dbba221feaa4 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @12build/account-api-ts-axios-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware cc5c5465a393a23f776128754b0543c03787f78e563b7142645453e912068ff6 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in @12build/segment-js-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 856e63ff9eebaf0c3443eeee789588cf844ca28e1810394d67c01e5f5a4aa601 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Security Bulletin: Trusteer SDK for Mobile vulnerable to file upload (CVE-2022-42443)

Summary Security improvements were made to the Trusteer Mobile SDKs for iOS and Android. No code changes are required to take advantage of the improvements, but mobile application creators must rebuild using the latest SDK version and redeploy their mobile apps to take advantage of these...

Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to sensitive information exposure in AWS SDK for Go (CVE-2022-2582)

Summary IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to sensitive information exposure in AWS SDK for Go caused by the sending of an unencrypted hash of the plaintext alongside the ciphertext as a metadata field. CVE-2022-2582. AWS SDK for Go is included as part o...