CVE-2022-50914

EaseUS Data Recovery - 'ensserver.exe' Unquoted Service Path

EaseUS Data Recovery 15.1.0.0 contains an unquoted service path vulnerability in the EaseUS UPDATE SERVICE executable. Attackers can exploit the unquoted path to inject and execute malicious code with elevated LocalSystem privileges.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Easeus

Products

Data Recovery

CVE-2022-50913

TCQ - 'ITeCProteccioAppServer.exe' Unquoted Service Path

ITeC ITeCProteccioAppServer contains an unquoted service path vulnerability that allows local attackers to execute code with elevated system privileges. Attackers can insert a malicious executable in the service path to gain elevated access during service restart or system reboot.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Itec

Products

Tcq

CVE-2022-50904

Wondershare UBackit 2.0.5 - 'wsbackup' Unquoted Service Path

Wondershare UBackit 2.0.5 contains an unquoted service path vulnerability that allows local users to potentially execute arbitrary code with elevated system privileges. Attackers can exploit the unquoted path in the wsbackup service to inject malicious executables that would run with LocalSystem permissions during service startup.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Wondershare

Products

Ubackit

CVE-2022-28693

hw: cpu: Intel: information disclosure via local access

Unprotected alternative channel of return branch target prediction in some Intel(R) Processors may allow an authorized user to potentially enable information disclosure via local access.

CVSS 3.1 · 4.7 Medium EPSS < 1% KEV · Not listed

Vendors

Redhat

Products

Enterprise Linux Rhel Eus Rhel Extras Rt and 1 more

CVE-2019-25231

devolo dLAN Cockpit 4.3.1 Unquoted Service Path Privilege Escalation

devolo dLAN Cockpit 4.3.1 contains an unquoted service path vulnerability in the 'DevoloNetworkService' that allows local non-privileged users to potentially execute arbitrary code. Attackers can exploit the insecure service path configuration by inserting malicious code in the system root path to execute with elevated privileges during application startup or system reboot.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2019-25257

LogicalDOC Enterprise 7.7.4 Authenticated Command Execution via Binary Path Manipulation

LogicalDOC Enterprise 7.7.4 contains multiple authenticated OS command execution vulnerabilities that allow attackers to manipulate binary paths when changing system settings. Attackers can exploit these vulnerabilities by modifying configuration parameters like antivirus.command, ocr.Tesseract.path, and other system paths to execute arbitrary system commands with elevated privileges.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed

Vendors

Logicaldoc

Products

Logicaldoc

CVE-2019-25266

Wondershare Application Framework Service 2.4.3.231 - 'WsAppService' Unquote Service Path

Wondershare Application Framework Service 2.4.3.231 contains an unquoted service path vulnerability that allows local attackers to potentially execute arbitrary code with elevated privileges. Attackers can exploit the unquoted service path by placing malicious executables in specific directory locations to hijack the service's execution context.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Wondershare

Products

Application Framework Service

CVE-2019-25268

NREL BEopt 2.8.0 Insecure Library Loading Arbitrary Code Execution

NREL BEopt 2.8.0.0 contains a DLL hijacking vulnerability that allows attackers to load arbitrary libraries by tricking users into opening application files from remote shares. Attackers can exploit insecure library loading of sdl2.dll and libegl.dll by placing malicious libraries on WebDAV or SMB shares to execute unauthorized code.

CVSS 4.0 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

—

Products

—

CVE-2019-25271

NETGATE Data Backup 3.0.620 - 'NGDatBckpSrv' Unquoted Service Path

NETGATE Data Backup 3.0.620 contains an unquoted service path vulnerability in its NGDatBckpSrv Windows service configuration. Attackers can exploit the unquoted path to inject and execute malicious code with LocalSystem privileges by placing executable files in specific directory locations.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Netgate

Products

Data Backup

CVE-2020-37102

Adaware Web Companion 4.9.2159 - 'WCAssistantService' Unquoted Service Path

Adaware Web Companion 4.9.2159 contains an unquoted service path vulnerability in the WCAssistantService that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted binary path to inject malicious executables that will be run with LocalSystem privileges during service startup.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Codeworkweb Lavasoft

Products

Cww Companion Web Companion

CVE-2020-37101

VPN unlimited 6.1 - Unquoted Service Path

VPN Unlimited 6.1 contains an unquoted service path vulnerability that allows local attackers to inject malicious executables into the service binary path. Attackers can exploit the unquoted path in 'C:\Program Files (x86)\VPN Unlimited\' to replace the service executable and gain elevated system privileges.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Keepsolid Vpnunlimitedapp

Products

Vpn Unlimited Vpn Unlimited

CVE-2020-37099

Disk Savvy Enterprise 12.3.18 - 'disksvs.exe' Unquoted Service Path

Disk Savvy Enterprise 12.3.18 contains an unquoted service path vulnerability in its service configuration that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted path in 'C:\Program Files\Disk Savvy Enterprise\bin\disksvs.exe' to inject malicious executables and escalate privileges.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Disksavvy

Products

Disksavvy Enterprise

CVE-2020-37098

Disk Sorter Enterprise 12.4.16 - Unquoted Service Path

Disk Sorter Enterprise 12.4.16 contains an unquoted service path vulnerability that allows local attackers to execute arbitrary code with elevated system privileges. Attackers can exploit the unquoted path in the service configuration to inject malicious executables that will be launched with LocalSystem permissions.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Disksorter

Products

Disk Sorter

CVE-2020-37064

EPSON EasyMP Network Projection 2.81 - 'EMP_NSWLSV' Unquoted Service Path

EPSON EasyMP Network Projection 2.81 contains an unquoted service path vulnerability in the EMP_NSWLSV service that allows local users to potentially execute arbitrary code. Attackers can exploit the unquoted path in C:\Program Files (x86)\EPSON Projector\EasyMP Network Projection V2\ to inject malicious code that would execute with LocalSystem privileges.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Epson

Products

Easymp

CVE-2020-37063

TFTP Turbo 4.6.1273 - 'TFTP Turbo 4' Unquoted Service Path

TFTP Turbo 4.6.1273 contains an unquoted service path vulnerability that allows local attackers to potentially execute arbitrary code with elevated privileges. Attackers can exploit the unquoted path in the service configuration to inject malicious executables that will be launched with LocalSystem permissions.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Weird Solutions

Products

Tftp Turbo

CVE-2020-37062

DHCP Turbo 4.6.1298- 'DHCP Turbo 4' Unquoted Service Path

DHCP Turbo 4.61298 contains an unquoted service path vulnerability that allows local attackers to potentially execute arbitrary code by exploiting the service binary path. Attackers can place malicious executables in the service path to gain elevated privileges when the service starts.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Weird Solutions

Products

Dhcp Turbo

CVE-2020-37061

BOOTP Turbo 2.0.1214 - 'BOOTP Turbo' Unquoted Service Path

BOOTP Turbo 2.0.1214 contains an unquoted service path vulnerability that allows local attackers to potentially execute arbitrary code with elevated system privileges. Attackers can exploit the unquoted executable path to inject malicious code that will be executed when the service starts with LocalSystem permissions.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Weird Solutions

Products

Bootpturbo

CVE-2020-37060

Atomic Alarm Clock x86 6.3 - 'AtomicAlarmClock' Unquoted Service Path

Atomic Alarm Clock 6.3 contains a local privilege escalation vulnerability in its service configuration that allows attackers to execute arbitrary code with SYSTEM privileges. Attackers can exploit the unquoted service path by placing a malicious executable named 'Program.exe' to gain persistent system-level access.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Drive-software

Products

Atomic Alarm Clock X86

CVE-2020-37059

Popcorn Time 6.2 - 'Update service' Unquoted Service Path

Popcorn Time 6.2.1.14 contains an unquoted service path vulnerability that allows local non-privileged users to potentially execute code with elevated system privileges. Attackers can insert malicious executables in Program Files (x86) or system root directories to be executed with SYSTEM-level permissions during service startup.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Getpopcorntime Popcorn Time Project

Products

Popcorn Time Popcorn Time

CVE-2020-37058

Andrea ST Filters Service 1.0.64.7 - Unquoted service path

Andrea ST Filters Service 1.0.64.7 contains an unquoted service path vulnerability in its Windows service configuration. Local attackers can exploit the unquoted path to inject malicious code that will execute with elevated LocalSystem privileges during service startup.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Andrea Electronics

Products

Andrea St Filters Service