CVE-2019-25273

Easy-Hide-IP 5.0.0.3 - 'EasyRedirect' Unquoted Service Path

Easy-Hide-IP 5.0.0.3 contains an unquoted service path vulnerability in the EasyRedirect service that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted path in 'C:\Program Files\Easy-Hide-IP\rdr\EasyRedirect.exe' to inject malicious executables and escalate privileges.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Easy-hide-ip

Products

Easy-hide-ip

CVE-2019-25274

ProShow Producer 9.0.3797 - Unquoted Service Path

ProShow Producer 9.0.3797 contains an unquoted service path vulnerability in the ScsiAccess service that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted binary path to inject malicious executables that will be run with LocalSystem privileges during service startup.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Photodex

Products

Proshow Producer

CVE-2019-25275

BartVPN 1.2.2 - 'BartVPNService' Unquoted Service Path

BartVPN 1.2.2 contains an unquoted service path vulnerability in the BartVPNService that allows local attackers to potentially execute arbitrary code with elevated system privileges. Attackers can exploit the unquoted binary path by placing malicious executables in specific file system locations to hijack the service's execution context.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Filehorse

Products

Bartvpn

CVE-2019-25281

NCP_Secure_Entry_Client 9.2 - Unquoted Service Paths

NCP Secure Entry Client 9.2 contains an unquoted service path vulnerability in multiple Windows services that allows local users to potentially execute arbitrary code. Attackers can exploit the unquoted paths in services like ncprwsnt, rwsrsu, ncpclcfg, and NcpSec to inject malicious code that would execute with LocalSystem privileges during service startup.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Ncp-e

Products

Ncp Secure Entry Client

CVE-2019-25283

Shrew Soft VPN Client 2.2.2 - 'iked' Unquoted Service Path

Shrew Soft VPN Client 2.2.2 contains an unquoted service path vulnerability that allows local users to execute arbitrary code with elevated system privileges. Attackers can place malicious executables in the unquoted service path to gain elevated access during service startup or system reboot.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Shrew

Products

Vpn Client

CVE-2019-25286

_GCafé 3.0 - 'gbClienService' Unquoted Service Path

GCafé 3.0 contains an unquoted service path vulnerability in the gbClientService that allows local attackers to potentially execute arbitrary code with elevated privileges. Attackers can exploit the unquoted path in the service configuration to inject malicious executables that will be run with LocalSystem permissions.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Gcafe

Products

Gcafe

CVE-2019-25287

Adaware Web Companion version 4.8.2078.3950 - 'WCAssistantService' Unquoted Service Path

Adaware Web Companion version 4.8.2078.3950 contains an unquoted service path vulnerability in the WCAssistantService that allows local users to potentially execute code with elevated privileges. Attackers can exploit the unquoted path in C:\Program Files (x86)\Lavasoft\Web Companion\Application\ to inject malicious code that would execute with LocalSystem privileges during service startup.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Lavasoft

Products

Web Companion

CVE-2019-25288

Wacom WTabletService 6.6.7-3 - 'WTabletServicePro' Unquoted Service Path

Wacom WTabletService 6.6.7-3 contains an unquoted service path vulnerability that allows local attackers to execute malicious code with elevated privileges. Attackers can insert an executable file in the service path to run unauthorized code when the service restarts or the system reboots.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Wacom

Products

Wtabletservice

CVE-2019-25292

Alps HID Monitor Service 8.1.0.10 - 'ApHidMonitorService' Unquote Service Path

Alps HID Monitor Service 8.1.0.10 contains an unquoted service path vulnerability that allows local attackers to potentially execute arbitrary code with elevated privileges. Attackers can exploit the unquoted path in C:\Program Files\Apoint2K\HidMonitorSvc.exe to inject malicious executables and gain system-level access.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Alps

Products

Hid Monitor Service

CVE-2019-25302

Acer Launch Manager 6.1.7600.16385 - 'DsiWMIService' Unquoted Service Path

Acer Launch Manager 6.1.7600.16385 contains an unquoted service path vulnerability in the DsiWMIService that allows local users to potentially execute code with elevated privileges. Attackers can exploit the unquoted path in C:\Program Files (x86)\Launch Manager\dsiwmis.exe to insert malicious code that would execute with system-level permissions during service startup.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Acer

Products

Launch Manager

CVE-2019-25304

Intelligent Security System SecurOS Enterprise 10.2 - 'SecurosCtrlService' Unquoted Service Path

SecurOS Enterprise 10.2 contains an unquoted service path vulnerability in the SecurosCtrlService that allows local users to potentially execute code with elevated privileges. Attackers can exploit the unquoted path in C:\Program Files (x86)\ISS\SecurOS\ to insert malicious code that would execute with system-level permissions during service startup.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Issivs

Products

Securos Enterprise

CVE-2019-25305

JumpStart 0.6.0.0 - 'jswpbapi' Unquoted Service Path

JumpStart 0.6.0.0 contains an unquoted service path vulnerability in the jswpbapi service running with LocalSystem privileges. Attackers can exploit the unquoted path containing spaces to inject and execute malicious code with elevated system permissions.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Hp Inforprograma

Products

Jumpstart Jumpstart

CVE-2019-25306

BlackMoon FTP Server 3.1.2.1731 - 'BMFTP-RELEASE' Unquoted Serive Path

BlackMoon FTP Server 3.1.2.1731 contains an unquoted service path vulnerability that allows local users to potentially execute code with elevated system privileges. Attackers can exploit the unquoted binary path in the service configuration to insert malicious code that would execute with LocalSystem account permissions during service startup.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Blackmoonftpserver

Products

Blackmoon Ftp Server

CVE-2019-25307

WorkgroupMail 7.5.1 - 'WorkgroupMail' Unquoted Service Path

WorkgroupMail 7.5.1 contains an unquoted service path vulnerability in its Windows service configuration that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted binary path to inject malicious executables that will be run with LocalSystem privileges during service startup.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Softalk

Products

Workgroupmail

CVE-2019-25309

Zilab Remote Console Server 3.2.9 - 'Zilab Remote Console Server' Unquoted Service Path

Zilab Remote Console Server 3.2.9 contains an unquoted service path vulnerability that allows local attackers to potentially execute arbitrary code with elevated system privileges. Attackers can exploit the unquoted binary path in the service configuration to inject malicious executables that will be run with LocalSystem permissions.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Zilab Software

Products

Zilab Remote Console Server

CVE-2019-25310

ActiveFax Server 6.92 Build 0316 - 'ActiveFaxServiceNT' Unquoted Service Path

ActiveFax Server 6.92 Build 0316 contains an unquoted service path vulnerability in the ActiveFaxServiceNT service that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted binary path to inject malicious executables that will be launched with elevated administrative privileges.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Actfax

Products

Activefax Server

CVE-2019-25345

RTK IIS Codec Service 6.4.10041.133 - 'RtkI2SCodec' Unquote Service Path

Realtek IIS Codec Service 6.4.10041.133 contains an unquoted service path vulnerability that allows local attackers to potentially execute arbitrary code. Attackers can exploit the unquoted path in the service configuration to inject malicious executables and escalate privileges on the system.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Realtek

Products

Rtk Iis Codec Service

CVE-2020-36879

Flexsense DiskBoss Service Unquoted Service Path Vulnerability

Flexsense DiskBoss 11.7.28 allows unauthenticated attackers to elevate their privileges using any of its services, enabling remote code execution during startup or reboot with escalated privileges. Attackers can exploit the unquoted service path vulnerability by specifying a malicious service name in the 'sc qc' command, allowing them to execute arbitrary system commands.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Flexense Flexsense

Products

Diskboss Diskboss

CVE-2020-36903

Selea CarPlateServer 4.0.1.6 Local Privilege Escalation via Unquoted Service Path

Selea CarPlateServer 4.0.1.6 contains an unquoted service path vulnerability in the Windows service configuration that allows local users to potentially execute code with elevated privileges. Attackers can exploit the service's unquoted binary path by inserting malicious code in the system root path that could execute with LocalSystem privileges during application startup or reboot.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows

CVE-2020-36933

IPTInstaller 4.0.9 - 'PassThru Service' Unquoted Service Path

HTC IPTInstaller 4.0.9 contains an unquoted service path vulnerability in the PassThru Service configuration. Attackers can exploit the unquoted binary path to inject and execute malicious code with elevated LocalSystem privileges.

CVSS 4.0 · 8.5 High EPSS < 1% KEV · Not listed

Vendors

Htc

Products

Iptinstaller