Eran Shimony

تسمح هذه الثغرة للمهاجم بتنفيذ أوامر عشوائية باستخدام امتيازات العملية التي تقوم بتشغيل Langflow. وقد يؤدي ذلك إلى الكشف عن متغيرات بيئية حساسة، مثل مفاتيح واجهة برمجة التطبيقات (API) وبيانات اعتماد قاعدة البيانات، فضلاً عن تعديل الملفات أو شن هجمات أخرى على الشبكة الداخلية.

Name of the Vulnerable Software and Affected Versions: Intel(R) Graphics DCH Drivers for Windows 10 versions prior to 27.20.100.9316 Description: The issue is related to improper initialization in the installer for some Intel(R) Graphics DCH Drivers, which may allow an authenticated user to potentially enable denial of service via local access. Recommendations: For versions prior to 27.20.100.9316, update to version 27.20.100.9316 or later to resolve the issue.

The issue is related to an untrusted search path in the AMD Radeon settings Installer, which may lead to privilege escalation or unauthorized code execution.

Name of the Vulnerable Software and Affected Versions: Intel(R) NUC Pro Chassis Element AverMedia Capture Card drivers versions prior to 3.0.64.143 Description: The issue is related to an uncontrolled search path in some Intel(R) NUC Pro Chassis Element AverMedia Capture Card drivers. This may allow an authenticated user to potentially enable escalation of privilege via local access. Recommendations: For versions prior to 3.0.64.143, update to version 3.0.64.143 or later to resolve the issue.

Name of the Vulnerable Software and Affected Versions: Intel(R) NUC 9 Extreme Laptop Kit LAN Drivers versions prior to 10.42 Description: The issue concerns insecure inherited permissions that may allow an authenticated user to potentially enable escalation of privilege via local access. Recommendations: For versions prior to 10.42, update to version 10.42 or later to resolve the issue.

Name of the Vulnerable Software and Affected Versions: Windows Hyper-V (affected versions not specified) Description: The issue is related to insufficient access controls in the Windows Hyper-V hardware virtualization system, allowing an attacker to potentially elevate their privileges. An elevation-of-privilege issue affects the system, enabling attackers to impact it. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue concerns a vulnerability in the installer package of the software. This vulnerability can be exploited by placing a malicious DLL in a local directory, potentially leading to the obtainment of administrative privileges during the product's installation.

The issue concerns a vulnerability in the installer package of the software. This vulnerability can be exploited by placing a specific file in a Windows system directory, potentially leading to the obtainment of administrative privileges during the product's installation.

The issue concerns a vulnerability in the installer package that can be exploited through a symlink attack. This involves placing a malicious DLL in a non-protected location with high privileges, potentially leading to the obtainment of administrative privileges during the product's installation.

A vulnerability exists that can hijack a DLL file loaded during the installation of certain LG Electronics products. This issue is due to missing support for integrity checks in a component of the affected products, allowing an attacker to cause an impact.

Name of the Vulnerable Software and Affected Versions: Intel Computing Improvement Program versions prior to 2.4.5718 Description: The issue is caused by improper access control in the Intel Computing Improvement Program, which may allow an authenticated user to potentially enable escalation of privilege via local access. This is due to errors in privilege management. Recommendations: For versions prior to 2.4.5718, update to version 2.4.5718 or later to resolve the issue. As a temporary workaround, consider restricting local access to the Intel Computing Improvement Program to minimize the risk of exploitation.

The issue is related to insufficient access control, which could allow an attacker to delete the content of any file in the system. This could provide an opportunity for arbitrary file corruption.

The issue is related to errors in the mechanism for checking the path to dynamically loaded libraries (DLL), which can be exploited to elevate privileges in the system. This can allow an attacker to perform a DLL hijacking attack.

The issue is related to insufficient access control in the installer, which could allow an attacker to delete any file in the system. This is due to a vulnerability in the installation file that enables arbitrary file deletion.

The issue exists due to improper loading of a DLL file by HiSuite, allowing an attacker to load a DLL file of their choice. This is a result of a DLL hijacking vulnerability.

The issue is related to a lack of proper access control in the Windows group policy, allowing a remote attacker to potentially elevate their privileges and execute arbitrary code using a specially crafted application. This can affect the system, enabling attackers to impact it.

A denial of service issue exists due to improper handling of filesystem operations by the Windows Registry. This can be exploited by an attacker to cause a denial of service by running a specially crafted application. The vulnerability is related to the incorrect processing of filesystem operations, which can lead to system disruption.

Name of the Vulnerable Software and Affected Versions: Intel(R) CSME versions prior to 11.8.77, 11.12.77, 11.22.77, 12.0.64, 13.0.32, 14.0.33 Intel(R) TXE versions prior to 3.1.75, 4.0.25 Description: The issue is related to a path traversal vulnerability in the Intel Dynamic Application Loader (DAL) subsystem for Intel Converged Security and Manageability Engine (CSME) and Intel Trusted Execution Engine (TXE) software. This vulnerability may allow an unprivileged user to potentially enable denial of service via local access. The vulnerability is caused by incorrect restriction of access to a directory with limited access. Recommendations: For Intel(R) CSME versions prior to 11.8.77, 11.12.77, 11.22.77, 12.0.64, 13.0.32, 14.0.33, update to version 11.8.77 or later, 11.12.77 or later, 11.22.77 or later, 12.0.64 or later, 13.0.32 or later, 14.0.33 or later. For Intel(R) TXE versions prior to 3.1.75, 4.0.25, update to version 3.1.75 or later, 4.0.25 or later. As a temporary workaround, consider restricting access to the vulnerable subsystem until a patch is available.

The issue is related to improper permission management of specific files, allowing local attackers with low permissions to inject commands and potentially cause privilege escalation. This can be exploited by attackers to gain elevated access.

The issue is related to a possible out of bounds read in the `l2c link process num completed pkts` function of `l2c link.cc` due to a missing bounds check. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.