Monthly
Unauthenticated path traversal in ManageEngine OpManager and ManageEngine Network Configuration Manager versions before 12.8.671 allows remote attackers to read arbitrary files from the appliance. Because the CVSS vector is PR:N/UI:N (7.5, AV:N/AC:L), no credentials or user interaction are required against a default-reachable deployment - an attacker with network access to the web console can directly request files outside the intended document root and expose configuration, credential, or key material. Impact is confidentiality-only (C:H with I:N/A:N), so the flaw does not permit modification of data or cause denial of service. No public exploit code has been identified at time of analysis, and the issue is not listed as confirmed actively exploited (CISA KEV); the main limiting factor is exposure, since these are typically internal management consoles rather than internet-facing services.
Local privilege escalation in Dell Inventory Collector Client versions prior to 15.0.0 allows a low-privileged Windows user to place a malicious executable along an unquoted service search path, resulting in code execution in the context of the affected service and elevation of privileges. The attack is not network-reachable and requires an existing local foothold plus write access to a directory that precedes the legitimate binary on the unquoted path, with the vulnerable component restarted or re-launched so the path is re-resolved. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor rates the issue 7.8 High (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); vendor-released patch: 15.0.0.
Unquoted LocalSystem service ImagePath in a Windows component distributed by Ubuntu/Canonical enables local privilege escalation to SYSTEM. When a Windows service ImagePath contains spaces and is not enclosed in quotes, the Windows Service Control Manager attempts to resolve the binary by trying each path segment prefix in order - allowing a lower-privileged local attacker who can write to an intermediate directory to place a malicious executable that runs under LocalSystem context on next service start or system reboot. No patch version, CVSS score, or CWE has been assigned in the input data; no public exploit or KEV listing is present at time of analysis.
Local privilege escalation in Maono Link 3.8.13 on Windows enables any standard user account to gain elevated service-level privileges by writing a malicious payload to C:\ProgramData\Maono. The MaonoAiServices Windows service runs with elevated OS privileges while leaving its data directory writable by unprivileged local users - a classic insecure service directory permission pattern (CWE-428). Vendor patch 4.0.80 is available; no public exploit has been identified at time of analysis.
Privilege escalation to SYSTEM in NetKids iMark (all versions through V5.2.5.0) is achievable by authenticated local attackers exploiting an unquoted Windows service executable path. Because the service path contains spaces but lacks surrounding quotation marks, Windows' path resolution logic will execute an attacker-placed binary at an intermediate path before reaching the legitimate service binary. JPCERT/CC has issued an advisory (JVN#28045338) and the vendor has published remediation PDF guidance; no public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
GeoVision GV-ASManager's unsafe DLL search path resolution allows a local low-privileged attacker who can write to a directory searched by the application to preempt a legitimate library with a crafted DLL, executing arbitrary code under the GV-ASManager process's security privileges when the application is subsequently launched. The root cause is CWE-428 (Unquoted Search Path or Element), where Windows DLL resolution traverses attacker-controllable directories before reaching the intended library location. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the full C:H/I:H/A:H CVSS impact reflects total process compromise upon successful exploitation.
Local arbitrary code execution in Rockwell Automation Studio 5000 Logix Designer arises because the External Tools configuration stores executable paths that contain spaces without quoting (CWE-428). A low-privileged local user who can write a malicious binary into an earlier segment of the resolved search path can have Windows execute it in place of the intended tool, running code with the privileges of the operator using the application. No public exploit has been identified at time of analysis, and the flaw is not listed in CISA KEV; the CVSS 4.0 score is 7.3 (High), tempered by local access, high attack complexity, a present attack requirement, and required active user interaction.
Local privilege escalation in the HP Fan Control App lets a low-privileged local user gain SYSTEM/administrator-level execution on affected HP endpoints. The flaw stems from CWE-428 (Unquoted Search Path or Element), a classic Windows weakness where a privileged service or process resolves an executable or library from an attacker-controllable path. No public exploit has been identified at time of analysis and it is not listed in CISA KEV; EPSS data was not provided.
Local privilege escalation and arbitrary code execution affects Yandex Punto Switcher through version 4.5.0.583 due to an unquoted search path passed to WinExec when launching RunDll32.exe to invoke shell32.dll's Control_RunDLL with input.dll. An authenticated local attacker who can drop an executable into an earlier directory in the Windows search order can hijack execution and run code in the context of the affected user. No public exploit identified at time of analysis, but the technique (CWE-428) is well-understood and trivially weaponized.
Unquoted service path vulnerability in AVACAST by eMPIA Technology enables local privilege escalation from high-privileged user to SYSTEM. Attackers with administrative access can plant malicious executables in unquoted paths, achieving arbitrary code execution with system-level privileges upon service restart. Taiwan CERT (TWCERT) published advisories confirming the vulnerability. No public exploit code identified at time of analysis, and exploitation requires existing administrative privileges, limiting practical risk to environments where privileged user compromise is a concern.
Unauthenticated path traversal in ManageEngine OpManager and ManageEngine Network Configuration Manager versions before 12.8.671 allows remote attackers to read arbitrary files from the appliance. Because the CVSS vector is PR:N/UI:N (7.5, AV:N/AC:L), no credentials or user interaction are required against a default-reachable deployment - an attacker with network access to the web console can directly request files outside the intended document root and expose configuration, credential, or key material. Impact is confidentiality-only (C:H with I:N/A:N), so the flaw does not permit modification of data or cause denial of service. No public exploit code has been identified at time of analysis, and the issue is not listed as confirmed actively exploited (CISA KEV); the main limiting factor is exposure, since these are typically internal management consoles rather than internet-facing services.
Local privilege escalation in Dell Inventory Collector Client versions prior to 15.0.0 allows a low-privileged Windows user to place a malicious executable along an unquoted service search path, resulting in code execution in the context of the affected service and elevation of privileges. The attack is not network-reachable and requires an existing local foothold plus write access to a directory that precedes the legitimate binary on the unquoted path, with the vulnerable component restarted or re-launched so the path is re-resolved. No public exploit code or confirmed active exploitation has been identified at time of analysis, and the vendor rates the issue 7.8 High (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H); vendor-released patch: 15.0.0.
Unquoted LocalSystem service ImagePath in a Windows component distributed by Ubuntu/Canonical enables local privilege escalation to SYSTEM. When a Windows service ImagePath contains spaces and is not enclosed in quotes, the Windows Service Control Manager attempts to resolve the binary by trying each path segment prefix in order - allowing a lower-privileged local attacker who can write to an intermediate directory to place a malicious executable that runs under LocalSystem context on next service start or system reboot. No patch version, CVSS score, or CWE has been assigned in the input data; no public exploit or KEV listing is present at time of analysis.
Local privilege escalation in Maono Link 3.8.13 on Windows enables any standard user account to gain elevated service-level privileges by writing a malicious payload to C:\ProgramData\Maono. The MaonoAiServices Windows service runs with elevated OS privileges while leaving its data directory writable by unprivileged local users - a classic insecure service directory permission pattern (CWE-428). Vendor patch 4.0.80 is available; no public exploit has been identified at time of analysis.
Privilege escalation to SYSTEM in NetKids iMark (all versions through V5.2.5.0) is achievable by authenticated local attackers exploiting an unquoted Windows service executable path. Because the service path contains spaces but lacks surrounding quotation marks, Windows' path resolution logic will execute an attacker-placed binary at an intermediate path before reaching the legitimate service binary. JPCERT/CC has issued an advisory (JVN#28045338) and the vendor has published remediation PDF guidance; no public exploit code has been identified at time of analysis, and this vulnerability is not listed in the CISA KEV catalog.
GeoVision GV-ASManager's unsafe DLL search path resolution allows a local low-privileged attacker who can write to a directory searched by the application to preempt a legitimate library with a crafted DLL, executing arbitrary code under the GV-ASManager process's security privileges when the application is subsequently launched. The root cause is CWE-428 (Unquoted Search Path or Element), where Windows DLL resolution traverses attacker-controllable directories before reaching the intended library location. No public exploit code has been identified and the vulnerability is not listed in CISA KEV, but the full C:H/I:H/A:H CVSS impact reflects total process compromise upon successful exploitation.
Local arbitrary code execution in Rockwell Automation Studio 5000 Logix Designer arises because the External Tools configuration stores executable paths that contain spaces without quoting (CWE-428). A low-privileged local user who can write a malicious binary into an earlier segment of the resolved search path can have Windows execute it in place of the intended tool, running code with the privileges of the operator using the application. No public exploit has been identified at time of analysis, and the flaw is not listed in CISA KEV; the CVSS 4.0 score is 7.3 (High), tempered by local access, high attack complexity, a present attack requirement, and required active user interaction.
Local privilege escalation in the HP Fan Control App lets a low-privileged local user gain SYSTEM/administrator-level execution on affected HP endpoints. The flaw stems from CWE-428 (Unquoted Search Path or Element), a classic Windows weakness where a privileged service or process resolves an executable or library from an attacker-controllable path. No public exploit has been identified at time of analysis and it is not listed in CISA KEV; EPSS data was not provided.
Local privilege escalation and arbitrary code execution affects Yandex Punto Switcher through version 4.5.0.583 due to an unquoted search path passed to WinExec when launching RunDll32.exe to invoke shell32.dll's Control_RunDLL with input.dll. An authenticated local attacker who can drop an executable into an earlier directory in the Windows search order can hijack execution and run code in the context of the affected user. No public exploit identified at time of analysis, but the technique (CWE-428) is well-understood and trivially weaponized.
Unquoted service path vulnerability in AVACAST by eMPIA Technology enables local privilege escalation from high-privileged user to SYSTEM. Attackers with administrative access can plant malicious executables in unquoted paths, achieving arbitrary code execution with system-level privileges upon service restart. Taiwan CERT (TWCERT) published advisories confirming the vulnerability. No public exploit code identified at time of analysis, and exploitation requires existing administrative privileges, limiting practical risk to environments where privileged user compromise is a concern.