Nullsoft

Nullsoft Scriptable Install System

5 Schwachstellen gefunden.

Hinweis: Diese Liste kann unvollständig sein. Daten werden ohne Gewähr im Ursprungsformat bereitgestellt.
7.8

CVE-2026-42171

  • EPSS 0.01%
  • Veröffentlicht 24.04.2026 21:20:35
  • Zuletzt bearbeitet 27.04.2026 18:57:20

NSIS (Nullsoft Scriptable Install System) 3.06.1 before 3.12 sometimes uses the Low IL temp directory when executing as SYSTEM, allowing local attackers to gain privileges (if they can cause my_GetTempFileName to return 0, as shown in the references)...

8.1

CVE-2025-43715

  • EPSS 0.12%
  • Veröffentlicht 17.04.2025 00:00:00
  • Zuletzt bearbeitet 15.04.2026 00:35:42

Nullsoft Scriptable Install System (NSIS) before 3.11 on Windows allows local users to escalate privileges to SYSTEM during an installation, because the temporary plugins directory is created under %WINDIR%\temp and unprivileged users can place a cra...

5.3

CVE-2023-37378

  • EPSS 0.36%
  • Veröffentlicht 03.07.2023 20:15:09
  • Zuletzt bearbeitet 21.11.2024 08:11:36

Nullsoft Scriptable Install System (NSIS) before 3.09 mishandles access control for an uninstaller directory.

5.5

CVE-2015-9267

Exploit
  • EPSS 0.04%
  • Veröffentlicht 01.10.2018 08:29:00
  • Zuletzt bearbeitet 21.11.2024 02:40:12

Nullsoft Scriptable Install System (NSIS) before 2.49 uses temporary folder locations that allow unprivileged local users to overwrite files. This allows a local attack in which either a plugin or the uninstaller can be replaced by a Trojan horse pro...

9.3

CVE-2015-9268

Exploit
  • EPSS 0.57%
  • Veröffentlicht 01.10.2018 08:29:00
  • Zuletzt bearbeitet 21.11.2024 02:40:12

Nullsoft Scriptable Install System (NSIS) before 2.49 has unsafe implicit linking against Version.dll. In other words, there is no protection mechanism in which a wrapper function resolves the dependency at an appropriate time during runtime.