Vulnerabilidades do Nullsoft Nullsoft Scriptable Install System
🔔 Criar alerta RSS Verificador de versão
CVEs publicadas que afetam Nullsoft Nullsoft Scriptable Install System: 2 registro(s), com versões afetadas e correções.cpe:2.3:a:nullsoft:nullsoft_scriptable_install_system
CVE-2026-42171
Alta · 7.8
CWE-427 24/04/2026
Uncontrolled Search Path Element em Nullsoft Nullsoft Scriptable Install System
NSIS (Nullsoft Scriptable Install System) 3.06.1 before 3.12 sometimes uses the Low IL temp directory when executing as SYSTEM, allowing local attackers to gain privileges (if they can cause my_GetTempFileName to return 0, as shown in the references).
CVE-2025-43715
Alta · 8.1
CWE-754 17/04/2025
Improper Check for Unusual or Exceptional Conditions em Nullsoft Nullsoft Scriptable Install System
Nullsoft Scriptable Install System (NSIS) before 3.11 on Windows allows local users to escalate privileges to SYSTEM during an installation, because the temporary plugins directory is created under %WINDIR%\temp and unprivileged users can place a crafted executable file by winning a race condition. This occurs because EW_CREATEDIR does not always set the CreateRestrictedDirectory error flag.