Improper authentication of library files in the Eaton UPS Companion software installer could lead to arbitrary code execution of an attacker with the access to the software package. This security issue has been fixed in the latest version of EUC which is available on the Eaton download center.
Soda PDF Desktop Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Soda PDF Desktop. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability.
The specific flaw exists within the configuration of OpenSSL. The product loads an OpenSSL configuration file from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-25793.
PDFsam Enhanced Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows phyiscally-present attackers to escalate privileges on affected installations of PDFsam Enhanced. An attacker must first obtain the ability to mount a malicious drive onto the target system in order to exploit this vulnerability.
The specific flaw exists within the configuration of OpenSSL. The product loads an OpenSSL configuration file from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of SYSTEM. Was ZDI-CAN-27867.
CVE-2025-14498 is a high-severity local privilege escalation vulnerability in TradingView Desktop version 2.11.0.7073, caused by an uncontrolled search path element in the Electron framework configuration. An attacker with low-privileged code execution on the target system can exploit this flaw to escalate privileges and execute arbitrary code with higher user rights. The vulnerability arises because the application loads a script from an unsecured location, enabling code injection. No user interaction is required, but initial low-level code execution is a prerequisite. There are no known exploits in the wild yet, and no patches have been released at the time of publication. European organizations using TradingView Desktop, especially in financial sectors, are at risk. Mitigation involves restricting local code execution capabilities, monitoring for suspicious script loading, and applying vendor updates once available.
The nbconvert tool, jupyter nbconvert, converts Jupyter notebooks to various other formats via Jinja templates. Versions of nbconvert up to and including 7.16.6 on Windows have a vulnerability in which converting a notebook containing SVG output to a PDF results in unauthorized code execution. Specifically, a third party can create a `inkscape.bat` file that defines a Windows batch script, capable of arbitrary code execution. When a user runs `jupyter nbconvert --to pdf` on a notebook containing SVG output to a PDF on a Windows platform from this directory, the `inkscape.bat` file is run unexpectedly. This issue has been patched in version 7.17.0.
Uncontrolled Search Path Element vulnerability in Altera High Level Synthesis Compiler on Windows allows Search Order Hijacking.This issue affects High Level Synthesis Compiler: from 19.1 through 24.3.
A privilege escalation vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Exchange-NomadClientHealth-ConfigureGeneralSetting instruction prior V3.4. Improper protection of the execution path on the local device allows attackers, with local access to the device during execution, to hijack the process and execute arbitrary code with SYSTEM privileges.
A privilege escalation vulnerability was discovered in TeamViewer DEX (former 1E DEX), specifically within the 1E-Nomad-SetWorkRate instruction prior V17.1. The improper handling of executable search paths could allow local attackers with write access to a PATH directory on a device to escalate privileges and execute arbitrary code as SYSTEM.
CVE-2025-13152 is a high-severity DLL hijacking vulnerability in Lenovo One Client that allows a local authenticated user to execute code with elevated privileges. The flaw arises from an uncontrolled search path element, enabling attackers to load malicious DLLs. Exploitation requires local access and no user interaction, but no known exploits are currently in the wild. The vulnerability impacts confidentiality, integrity, and availability due to privilege escalation potential. European organizations using Lenovo One Client are at risk, especially in countries with high Lenovo market penetration and critical infrastructure reliance on this software. Mitigation involves applying vendor patches once available, restricting local user permissions, and monitoring for suspicious DLL loads. Given the CVSS 8.5 score, this vulnerability demands prompt attention to prevent potential lateral movement or system compromise. No authentication bypass or remote exploitation is possible, but the elevated privileges gained can lead to significant damage.
A DLL hijacking vulnerability was reported in the Lenovo App Store and Lenovo Browser applications that could allow a local authenticated user to execute code with elevated privileges under certain conditions.
CVE-2025-33208 is a high-severity vulnerability in NVIDIA TAO version 6.25.7 involving an uncontrolled search path element (CWE-427). This flaw allows an attacker to influence resource loading paths, potentially leading to privilege escalation, data tampering, denial of service, and information disclosure. Exploitation requires no privileges but does require user interaction. The vulnerability impacts confidentiality, integrity, and availability with a CVSS score of 8.8. No known exploits are currently reported in the wild. European organizations using NVIDIA TAO, especially in AI and machine learning deployments, should prioritize patching and implement strict path validation controls. Countries with significant AI research and technology sectors, such as Germany, France, and the UK, are most likely to be affected.
A carefully crafted DLL, copied to
C:\ProgramData\Synaptics
folder, allows a local user to execute
arbitrary code with elevated privileges during driver installation.
When the service of ABP and AES is installed in a directory writable by non-administrative users, an attacker can replace or plant a DLL with the same name as one loaded by the service. Upon service restart, the malicious DLL is loaded and executed under the LocalSystem account, resulting in unauthorized code execution with elevated privileges.
This issue affects ABP and AES: from ABP 2.0 through 2.0.7.9050, from AES 1.0 through 1.0.6.8290.
