Recherche « Microsoft powershell »

Microsoft PowerShell 7.4 · Microsoft PowerShell 7.5 · Microsoft PowerShell 7.6 · Microsoft powershell

Reliance on untrusted inputs in a security decision in Microsoft PowerShell allows an unauthorized attacker to execute code over a network.

Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2

Reliance on untrusted inputs in a security decision in Windows PowerShell allows an unauthorized attacker to execute code over a network.

Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2

Protection mechanism failure in Windows PowerShell allows an authorized attacker to bypass a security feature locally.

Microsoft Windows 11 Version 23H2 · Microsoft Windows 11 Version 24H2 · Microsoft Windows 11 Version 25H2 · Microsoft Windows 11 version 26H1

Integer overflow or wraparound in Windows PowerShell allows an authorized attacker to execute code locally.

netdata

Netdata is an open source observability tool. From rom 2.0.0 until 2.10.4, during Netdata Windows Agent MSI repair, powershell.exe runs as SYSTEM without -NoProfile and loads %USERPROFILE%\Documents\WindowsPowerShell\Microsoft.PowerShell_profile.ps1 from the low-privileged user who initiated repair. Commands placed in that profile before repair therefore execute with SYSTEM privileges. This vulnerability is fixed in 2.10.4.

Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809 · Microsoft Windows 10 Version 21H2 · Microsoft Windows 10 Version 22H2

Improper limitation of a pathname to a restricted directory ('path traversal') in Windows PowerShell allows an authorized attacker to elevate privileges over a network.

OpenAI Codex CLI · OpenAI Codex Desktop · OpenAI Codex Desktop (Microsoft Store package)

OpenAI Codex CLI for Windows, macOS, and Linux and Codex Desktop for Windows and macOS misclassified certain PowerShell commands as safe because their command-safety parser interpreted PowerShell's stop-parsing token (--%) differently than PowerShell itself. If a user opens an attacker-prepared repository and Codex follows its instructions, Codex can run a file-writing Git command without requesting user approval. On macOS and Linux, exploitation additionally requires separately installed PowerShell Core (pwsh) to be invoked. If filesystem protections permit the write, the command can modify Codex's configuration. If Codex later loads the modified configuration, it can launch an attacker-controlled MCP server and execute code with the user's privileges, allowing it to read, change, or delete files accessible to that account. The approval bypass does not disable filesystem sandboxing; the default filesystem sandbox on macOS and Linux can prevent writes outside permitted locations.

Microsoft PowerShell 7.4 · Microsoft PowerShell 7.5 · Microsoft PowerShell 7.6 · Microsoft powershell

Improper neutralization of special elements used in a command ('command injection') in Microsoft PowerShell allows an authorized attacker to execute code locally.

Microsoft PowerShell 7.4 · Microsoft PowerShell 7.5 · Microsoft PowerShell 7.6 · Microsoft powershell

Improper control of generation of code ('code injection') in Microsoft PowerShell allows an unauthorized attacker to bypass a security feature locally.

Microsoft PowerShell 7.4 · Microsoft PowerShell 7.5 · Microsoft PowerShell 7.6 · Microsoft powershell

Relative path traversal in Microsoft PowerShell Core allows an unauthorized attacker to execute code over a network.

Microsoft PowerShell 7.4 · Microsoft PowerShell 7.5 · Microsoft PowerShell 7.6 · Microsoft powershell

Incorrect default permissions in Microsoft PowerShell allows an authorized attacker to elevate privileges locally.

Microsoft PowerShell 7.4 · Microsoft PowerShell 7.5 · Microsoft PowerShell 7.6 · Microsoft powershell

Server-side request forgery (ssrf) in Microsoft PowerShell Core allows an unauthorized attacker to disclose information over a network.

Lenovo XClarity Integrator for Microsoft Windows Admin Center

The Lenovo XClarity Integrator for Windows Admin Center plugin version 5.1.1 and below running on the WAC Gateway is vulnerable to Powershell Command Injection when establishing remote PowerShell commands.

Microsoft PowerShell 7.5 · Microsoft PowerShell 7.6 · Microsoft Windows 10 Version 1607 · Microsoft Windows 10 Version 1809

Relative path traversal in Windows PowerShell allows an authorized attacker to execute code over a network.