Daniel.Soriano

**Name of the Vulnerable Software and Affected Versions** IObit Driver Booster version 11.0.0.0 **Description** A critical issue affects some unknown functionality in the library VCL120.BPL of the component BPL Handler, leading to an uncontrolled search path. The manipulation requires a local attack. The vendor was contacted about this disclosure but did not respond. **Recommendations** For IObit Driver Booster version 11.0.0.0, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** IObit DualSafe Password Manager version 1.4.0.3 **Description** The issue is related to an uncontrolled search path element in the BPL Handler component of the IObit DualSafe Password Manager. This could allow an attacker to execute arbitrary commands. The attack can be launched on the local host. **Recommendations** For IObit DualSafe Password Manager version 1.4.0.3, consider restricting access to the BPL Handler component until a patch is available. As a temporary workaround, avoid using the RTL120.BPL library in the BPL Handler component to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** IObit iTop Data Recovery Pro version 4.4.0.687 **Description** The issue is related to an uncontrolled search path element in the BPL Handler component of the IObit iTop Data Recovery Pro. This can be exploited to execute arbitrary commands. Local access is required for the attack. The vulnerability affects an unknown functionality in the madbasic .bpl library. **Recommendations** For IObit iTop Data Recovery Pro version 4.4.0.687, patch immediately to prevent exploitation of sensitive data on affected systems. As a temporary workaround, consider restricting access to the madbasic .bpl library until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Mp3tag versions up to 3.26d **Description** A vulnerability has been found in the library tak deco lib.dll of the component DLL Handler, leading to an uncontrolled search path. The manipulation can be launched on the local host. It is possible to exploit this issue, and the exploit has been disclosed to the public. The vendor was contacted and responded professionally, releasing a fixed version of the affected product. **Recommendations** For Mp3tag versions up to 3.26d, upgrade to version 3.26e to address this issue. As a temporary workaround, consider restricting access to the `tak deco lib.dll` library until the upgrade is applied.