Threats tagged 'ghsa-c6xr-x2jw-73rp'

CodeMeter Runtime versions 8.40 up to but not including 8.41a and 9.00 up to but not including 9.10 contain a vulnerability where the cmu.exe process creates a predictable temporary file under C:\CM-Stick without properly checking for NTFS reparse points such as junctions or symbolic links. This improper link resolution can allow a local attacker to create a junction pointing to an arbitrary system path, potentially causing deletion of arbitrary files with System privileges and enabling local privilege escalation.