voidtools "Everything" vulnerable to HTTP header injection

Overview The HTTP server of Everything provided by voidtools contains an HTTP header injection vulnerability CWE-644. Kusano Kazuhiko reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact On the web browser of a...

CVE-2020-24567

voidtools Everything before 1.4.1 Beta Nightly 2020-08-18 allows privilege escalation via a Trojan horse urlmon.dll file in the installation directory. NOTE: this is only relevant if low-privileged users can write to the installation directory, which may be considered a site-specific configuratio...

CVE-2020-24567

The CVE affects voidtools Everything prior to 1.4.1 Beta Nightly 2020-08-18. A local privilege-escalation exists via a Trojan horse urlmon.dll placed in the installation directory, applicable when low-privilege users can write to that directory. The root cause is a writable installation directory...