Logo
-

Byte Open Security

(ByteOS Network)

Log In

Sign Up

ByteOS

Security
Vulnerability Details
Registries
Custom Views
Weaknesses
Attack Patterns
Filters & Tools
Vulnerability Details :

CVE-2025-61228

Summary
Assigner-mitre
Assigner Org ID-8254265b-2729-46b6-b9e3-3dfca2d5bfca
Published At-01 Dec, 2025 | 00:00
Updated At-01 Dec, 2025 | 19:49
Rejected At-
Credits

An issue in Shirt Pocket SuperDuper! V.3.10 and before allows a local attacker to execute arbitrary code via the software update mechanism

Vendors
-
Not available
Products
-
Metrics (CVSS)
VersionBase scoreBase severityVector
Weaknesses
Attack Patterns
Solution/Workaround
References
HyperlinkResource Type
EPSS History
Score
Latest Score
-
N/A
No data available for selected date range
Percentile
Latest Percentile
-
N/A
No data available for selected date range
Stakeholder-Specific Vulnerability Categorization (SSVC)
â–¼Common Vulnerabilities and Exposures (CVE)
cve.org
Assigner:mitre
Assigner Org ID:8254265b-2729-46b6-b9e3-3dfca2d5bfca
Published At:01 Dec, 2025 | 00:00
Updated At:01 Dec, 2025 | 19:49
Rejected At:
â–¼CVE Numbering Authority (CNA)

An issue in Shirt Pocket SuperDuper! V.3.10 and before allows a local attacker to execute arbitrary code via the software update mechanism

Affected Products
Vendor
n/a
Product
n/a
Versions
Affected
  • n/a
Problem Types
TypeCWE IDDescription
textN/An/a
Type: text
CWE ID: N/A
Description: n/a
Metrics
VersionBase scoreBase severityVector
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
http://shirt.com
N/A
https://shirt-pocket.com/SuperDuper/SuperDuperDescription.html
N/A
https://www.shirtpocket.com/blog/index.php/shadedgrey/comments/superduper_security_update_v311/
N/A
Hyperlink: http://shirt.com
Resource: N/A
Hyperlink: https://shirt-pocket.com/SuperDuper/SuperDuperDescription.html
Resource: N/A
Hyperlink: https://www.shirtpocket.com/blog/index.php/shadedgrey/comments/superduper_security_update_v311/
Resource: N/A
â–¼Authorized Data Publishers (ADP)
CISA ADP Vulnrichment
Affected Products
Problem Types
TypeCWE IDDescription
CWECWE-494CWE-494 Download of Code Without Integrity Check
Type: CWE
CWE ID: CWE-494
Description: CWE-494 Download of Code Without Integrity Check
Metrics
VersionBase scoreBase severityVector
3.17.8HIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Version: 3.1
Base score: 7.8
Base severity: HIGH
Vector:
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Metrics Other Info
Impacts
CAPEC IDDescription
Solutions
Configurations
Workarounds
Exploits
Credits
Timeline
EventDate
Replaced By
Rejected Reason
References
HyperlinkResource
Information is not available yet
â–¼National Vulnerability Database (NVD)
nvd.nist.gov
Source:cve@mitre.org
Published At:01 Dec, 2025 | 16:15
Updated At:05 Dec, 2025 | 19:45

An issue in Shirt Pocket SuperDuper! V.3.10 and before allows a local attacker to execute arbitrary code via the software update mechanism

CISA Catalog
Date AddedDue DateVulnerability NameRequired Action
N/A
Date Added: N/A
Due Date: N/A
Vulnerability Name: N/A
Required Action: N/A
Metrics
TypeVersionBase scoreBase severityVector
Secondary3.17.8HIGH
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Type: Secondary
Version: 3.1
Base score: 7.8
Base severity: HIGH
Vector:
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CPE Matches
shirt-pocket
shirt-pocket
>>superduper\!>>Versions up to 3.10(inclusive)
cpe:2.3:a:shirt-pocket:superduper\!:*:*:*:*:*:*:*:*
Weaknesses
CWE IDTypeSource
CWE-494Secondary134c704f-9b21-4f2e-91b3-4a467353bcc0
CWE ID: CWE-494
Type: Secondary
Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0
Evaluator Description
Evaluator Impact

Evaluator Solution

Vendor Statements
References
HyperlinkSourceResource
http://shirt.comcve@mitre.org
Not Applicable
https://shirt-pocket.com/SuperDuper/SuperDuperDescription.htmlcve@mitre.org
Product
https://www.shirtpocket.com/blog/index.php/shadedgrey/comments/superduper_security_update_v311/cve@mitre.org
Release Notes
Hyperlink: http://shirt.com
Source: cve@mitre.org
Resource:
Not Applicable
Hyperlink: https://shirt-pocket.com/SuperDuper/SuperDuperDescription.html
Source: cve@mitre.org
Resource:
Product
Hyperlink: https://www.shirtpocket.com/blog/index.php/shadedgrey/comments/superduper_security_update_v311/
Source: cve@mitre.org
Resource:
Release Notes

Change History

0
Information is not available yet

Similar CVEs

7Records found
CVE-2025-61229
Matching Score-8
Assigner-MITRE Corporation
ShareView Details
Matching Score-8
Assigner-MITRE Corporation
CVSS Score-8.4||HIGH
EPSS-0.02% / 3.32%
||
7 Day CHG~0.00%
Published-01 Dec, 2025 | 00:00
Updated-08 Dec, 2025 | 16:15
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

An issue in Shirt Pocket's SuperDuper! 3.10 and earlier allow a local attacker to modify the default task template to execute an arbitrary preflight script with root privileges and Full Disk Access, thus bypassing macOS privacy controls.

Action-Not Available
Vendor-shirt-pocketn/a
Product-superduper\!n/a
CWE ID-CWE-276
Incorrect Default Permissions
CWE ID-CWE-284
Improper Access Control
CVE-2025-69604
Matching Score-8
Assigner-MITRE Corporation
ShareView Details
Matching Score-8
Assigner-MITRE Corporation
CVSS Score-7.8||HIGH
EPSS-0.01% / 1.76%
||
7 Day CHG~0.00%
Published-29 Jan, 2026 | 00:00
Updated-13 Feb, 2026 | 20:32
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

An issue in Shirt Pocket's SuperDuper! 3.11 and earlier allow a local attacker to modify the default task template to install an arbitrary package that can run shell scripts with root privileges and Full Disk Access, thus bypassing macOS privacy controls.

Action-Not Available
Vendor-shirt-pocketn/a
Product-superduper\!n/a
CWE ID-CWE-276
Incorrect Default Permissions
CVE-2021-44168
Matching Score-4
Assigner-Fortinet, Inc.
ShareView Details
Matching Score-4
Assigner-Fortinet, Inc.
CVSS Score-3.3||LOW
EPSS-1.43% / 80.41%
||
7 Day CHG~0.00%
Published-04 Jan, 2022 | 12:38
Updated-24 Oct, 2025 | 12:53
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
Known KEV||Action Due Date - 2021-12-24||Apply updates per vendor instructions.

A download of code without integrity check vulnerability in the "execute restore src-vis" command of FortiOS before 7.0.3 may allow a local authenticated attacker to download arbitrary files on the device via specially crafted update packages.

Action-Not Available
Vendor-Fortinet, Inc.
Product-fortiosFortinet FortiOSFortiOS
CWE ID-CWE-494
Download of Code Without Integrity Check
CVE-2019-9534
Matching Score-4
Assigner-CERT/CC
ShareView Details
Matching Score-4
Assigner-CERT/CC
CVSS Score-7.8||HIGH
EPSS-0.06% / 19.07%
||
7 Day CHG~0.00%
Published-10 Oct, 2019 | 20:09
Updated-17 Sep, 2024 | 00:15
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available
The Cobham EXPLORER 710, firmware version 1.07, does not validate its firmware image

The Cobham EXPLORER 710, firmware version 1.07, does not validate its firmware image. Development scripts left in the firmware can be used to upload a custom firmware image that the device runs. This could allow an unauthenticated, local attacker to upload their own firmware that could be used to intercept or modify traffic, spoof or intercept GPS traffic, exfiltrate private data, hide a backdoor, or cause a denial-of-service.

Action-Not Available
Vendor-cobhamCobham plc
Product-explorer_710_firmwareexplorer_710Explorer 710
CWE ID-CWE-494
Download of Code Without Integrity Check
CVE-2023-22635
Matching Score-4
Assigner-Fortinet, Inc.
ShareView Details
Matching Score-4
Assigner-Fortinet, Inc.
CVSS Score-6.9||MEDIUM
EPSS-0.05% / 14.54%
||
7 Day CHG~0.00%
Published-11 Apr, 2023 | 16:05
Updated-23 Oct, 2024 | 14:30
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

A download of code without Integrity check vulnerability [CWE-494] in FortiClientMac version 7.0.0 through 7.0.7, 6.4 all versions, 6.2 all versions, 6.0 all versions, 5.6 all versions, 5.4 all versions, 5.2 all versions, 5.0 all versions and 4.0 all versions may allow a local attacker to escalate their privileges via modifying the installer upon upgrade.

Action-Not Available
Vendor-Fortinet, Inc.
Product-forticlientFortiClientMac
CWE ID-CWE-494
Download of Code Without Integrity Check
CVE-2020-7817
Matching Score-4
Assigner-KrCERT/CC
ShareView Details
Matching Score-4
Assigner-KrCERT/CC
CVSS Score-5.5||MEDIUM
EPSS-0.06% / 19.90%
||
7 Day CHG~0.00%
Published-06 Aug, 2020 | 16:57
Updated-04 Aug, 2024 | 09:41
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

MyBrowserPlus downloads the files needed to run the program through the setup file (Setup.inf). At this time, there is a vulnerability in downloading arbitrary files due to insufficient integrity verification of the files.

Action-Not Available
Vendor-RAONWIZ (Laonwiz Co., Ltd.)Microsoft CorporationActiveSoft (Active Soft Co., Ltd.)
Product-windowsk_uploadMyBrowserPlus
CWE ID-CWE-494
Download of Code Without Integrity Check
CVE-2018-4009
Matching Score-4
Assigner-Talos
ShareView Details
Matching Score-4
Assigner-Talos
CVSS Score-8.8||HIGH
EPSS-0.02% / 4.55%
||
7 Day CHG~0.00%
Published-15 Apr, 2019 | 19:46
Updated-05 Aug, 2024 | 04:57
Rejected-Not Available
Known To Be Used In Ransomware Campaigns?-Not Available
KEV Added-Not Available
KEV Action Due Date-Not Available

An exploitable privilege escalation vulnerability exists in the Shimo VPN helper service due to improper validation of code signing. A user with local access can use this vulnerability to raise their privileges to root. An attacker would need local access to the machine to successfully exploit this bug.

Action-Not Available
Vendor-shimovpnn/a
Product-shimo_vpnShimo VPN
CWE ID-CWE-494
Download of Code Without Integrity Check
Details not found