CVE-2018-25359
Splinterware System Scheduler Pro 5.12 contains an insecure file permissions vulnerability that allows low-privilege users to escalate privi
CVSS
8.4
Alto
EPSS
0.2%
p6
KEV
—
Exploit Today
2
0-100
Publicado: 25 may 2026 · Última mod.: 23 jul 2026 · CWE-276
0.2%EPSS · 30 días0.2%
2026-07-032026-07-31
Splinterware System Scheduler Pro 5.12 contains an insecure file permissions vulnerability that allows low-privilege users to escalate privileges by modifying service executable files. Attackers can rename the WService.exe file in the installation directory and replace it with a malicious executable that executes with LocalSystem privileges when the service is triggered.
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-398757.8 ALT6.6%
——2A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. A malicious app may be able to gain root privileges.3dCVE-2026-398747.8 ALT1.5%
——0A permissions issue was addressed with additional restrictions. This issue is fixed in macOS Sequoia 15.7.8, macOS Sonoma 14.8.8, macOS Tahoe 26.6. A malicious app may be able to gain root privileges.3dCVE-2026-174978.3 ALT37.3%
——11NoteGen before 0.32.0 grants the Tauri shell plugin shell:allow-execute capability for bash, python, and python3 with arbitrary arguments in the default desktop capabilities. JavaScript running in the application webview can therefore invoke plugin:shell|execute to run attacker-controlled operating system commands with the privileges of the NoteGen process. In combination with script execution in the webview (for example via chat XSS), this enables full remote code execution on the user's machine.5dCVE-2026-162477.3 ALT1.2%
——0In _connect.BRAIN versions prior to 5.06,
the application LogPathConfig.exe is executed during setup. During this
process, existing permissions on %ProgramData% are deleted and replaced,
granting the Windows group Everyone full control instead of restricting
access to %ProgramData%\Bizerba\_connect.BRAIN or %ProgramData%\Bizerba\BCT.
Starting with _connect.BRAIN 5.06,
the setup no longer executes this tool.11dCVE-2026-162467.3 ALT1.7%
——1In BRAIN2 versions prior to 3.09, the
application LogPathConfig.exe is executed during setup. As a result, the
Windows group Everyone is granted full control over %ProgramData% instead of
being restricted to %ProgramData%\Bizerba\BRAIN2\.
Starting with BRAIN2 3.09, the setup no
longer executes this tool.
However, the optional component Bizerba ScriptService still executes it.
Bizerba ScriptService is being
deprecated and will no longer be included starting with BRAIN2 version 3.11.11dCVE-2024-58356—18.3%
——6SurrealDB before 2.1.4 silently fails to overwrite table definitions when the DEFINE TABLE ... OVERWRITE clause is used on tables defined with TYPE RELATION. Because table definitions include the PERMISSIONS clause, an attempt to tighten a table's permissions via OVERWRITE does not take effect, and the administrator may incorrectly believe the change was applied. As a result, a client authorized to run queries may continue to access data in that table that the updated (but unapplied) permissions were intended to restrict.11d