https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 01 Oct 2026 20:31:02 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-12555 <p>Potential security vulnerabilities have been identified in HP Easy Start for macOS, versions prior to 2.16.7.260722. These potential vulnerabilities may lead to escalation of privilege. HP is releasing updates to mitigate these potential vulnerabilities.</p> <p>Potential security vulnerabilities have been identified in HP Easy Start for macOS, versions prior to 2.16.7.260722. These potential vulnerabilities may lead to escalation of privilege. HP is releasing updates to mitigate these potential vulnerabilities.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-12555 https://vulnerability.circl.lu/vuln/gcve-1988-2026-0184 <p><strong>Affected:</strong> Hp Easy Start</p> <p>Hello Full Disclosure list,</p> <p>Cipher Security Labs has published technical details for three High-severity vulnerabilities affecting HP Easy Start for macOS. The issues were coordinated with HP and are addressed in HP Easy Start 2.16.7.260722 and later under HPSBPI04124.</p> <p>Research title: Rooted in Trust: Breaking HP Easy Start’s macOS Privilege Boundaries</p> <p>Affected product: HP Easy Start for macOS</p> <p>Affected versions: Versions prior to 2.16.7.260722</p> <p>Validated vulnerable sample: 2.16.0 (build 251010)</p> <p>Fixed: 2.16.7.260722 and later</p> <p>CVE-2026-12554 CVSS 4.0: 8.5 High CWE-1104: Use of Unmaintained Third-Party Components</p> <p>The affected software-download path contained an OSPFTP stack wired into component acquisition, including fallback URL-scheme handling. The research does not claim that every installation uses FTP on the normal path; the finding is that an unmaintained FTP-capable component remained active on the privileged software-delivery surface.</p> <p>CVE-2026-12555 CVSS 4.0: 7.7 High CWE-379: Creation of Temporary File in Directory with Insecure Permissions</p> <p>The HP Uninstaller used predictable paths under /tmp and /private/tmp while operating with administrative privileges. An unprivileged local user could prepare a symbolic link before the elevated process opened the path. In our PoC, after the user approved the normal macOS administrative prompt, HP-generated log data was appended through the symlink to an attacker-selected proof file as root.</p> <p>We intentionally describe this…</p> <p><strong>Affected:</strong> Hp Easy Start</p> <p>Hello Full Disclosure list,</p> <p>Cipher Security Labs has published technical details for three High-severity vulnerabilities affecting HP Easy Start for macOS. The issues were coordinated with HP and are addressed in HP Easy Start 2.16.7.260722 and later under HPSBPI04124.</p> <p>Research title: Rooted in Trust: Breaking HP Easy Start’s macOS Privilege Boundaries</p> <p>Affected product: HP Easy Start for macOS</p> <p>Affected versions: Versions prior to 2.16.7.260722</p> <p>Validated vulnerable sample: 2.16.0 (build 251010)</p> <p>Fixed: 2.16.7.260722 and later</p> <p>CVE-2026-12554 CVSS 4.0: 8.5 High CWE-1104: Use of Unmaintained Third-Party Components</p> <p>The affected software-download path contained an OSPFTP stack wired into component acquisition, including fallback URL-scheme handling. The research does not claim that every installation uses FTP on the normal path; the finding is that an unmaintained FTP-capable component remained active on the privileged software-delivery surface.</p> <p>CVE-2026-12555 CVSS 4.0: 7.7 High CWE-379: Creation of Temporary File in Directory with Insecure Permissions</p> <p>The HP Uninstaller used predictable paths under /tmp and /private/tmp while operating with administrative privileges. An unprivileged local user could prepare a symbolic link before the elevated process opened the path. In our PoC, after the user approved the normal macOS administrative prompt, HP-generated log data was appended through the symlink to an attacker-selected proof file as root.</p> <p>We intentionally describe this…</p> https://vulnerability.circl.lu/vuln/gcve-1988-2026-0184 https://vulnerability.circl.lu/vuln/ghsa-9jpq-gp3p-pv2f <p>Potential security vulnerabilities have been identified in HP Easy Start for macOS, versions prior to 2.16.7.260722. These potential vulnerabilities may lead to escalation of privilege. HP is releasing updates to mitigate these potential vulnerabilities.</p> <p>Potential security vulnerabilities have been identified in HP Easy Start for macOS, versions prior to 2.16.7.260722. These potential vulnerabilities may lead to escalation of privilege. HP is releasing updates to mitigate these potential vulnerabilities.</p> https://vulnerability.circl.lu/vuln/ghsa-9jpq-gp3p-pv2f