CVE-2023-6235

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

An uncontrolled search path element vulnerability has been found in the Duet Display product, affecting version 2.5.9.1. An attacker could place an arbitrary libusk.dll file in the C:\Users\user\AppData\Local\Microsoft\WindowsApps\ directory, which could lead to the execution and persistence of arbitrary code.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-427

Affected software

No affected versions have been published.

Timeline

Published: Nov 21, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-62367.3A flaw was found in Red Hat Enterprise Application Platform 8. When an OIDC app that serves multiple tenants attempts to access the second t CVE-2023-62375.9Issue summary: Checking excessively long invalid RSA public keys may take a long time. Impact summary: Applications that use the function E CVE-2023-62386.7A buffer overflow vulnerability was found in the NVM Express (NVMe) driver in the Linux kernel. Only privileged user could specify a small m CVE-2023-62398.8Under rare conditions, the effective permissions of an object might be incorrectly calculated if the object has a specific configuration of CVE-2023-62406.5A Marvin vulnerability side-channel leakage was found in the RSA decryption operation in the Linux Kernel. This issue may allow a network at CVE-2023-62417.0Use After Free vulnerability in Arm Ltd Midgard GPU Kernel Driver, Arm Ltd Bifrost GPU Kernel Driver, Arm Ltd Valhall GPU Kernel Driver, Arm CVE-2023-62424.3The EventON - WordPress Virtual Event Calendar Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to CVE-2023-62434.3The EventON PRO - WordPress Virtual Event Calendar Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions u CVE-2023-62444.3The EventON - WordPress Virtual Event Calendar Plugin plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to CVE-2023-62457.5The Candid library causes a Denial of Service while parsing a specially crafted payload with 'empty' data type. For example, if the payloa CVE-2023-62467.8A heap-based buffer overflow was found in the __vsyslog_internal function of the glibc library. This function is called by the syslog and vs CVE-2023-62476.5The PKCS#7 parser in OpenVPN 3 Core Library versions through 3.8.3 did not properly validate the parsed data, which would result in the appl