It seems that the Flexera guys didn't like that we, as a new user, posted about the VulnDetect project, despite them discontinuing the beloved Secunia PSI.

We would very much appreciate if you would gently the spread the word and a few links to vulndetect.org / https://vulndetect.com/?1, it is much needed, so we have a lot of testers once the alpha is ready.

We also feel that it is important to invite all the PSI forum users to come here and join the VulnDetect forum.

We are also very open to creating new Categories and Sub-categories here, where different, related subjects can be discussed and provide moderator privileges to those who want to contribute.

/Tom

group multiple instances of a vulnerable program in the listing and allow me to expand that section when I want

Suggested by @CTaylor

At this point, we believe that we have developed approx. 80% of the core functionality, this includes:

• Binary to collect data on the client system
• Scheduling of the binary
• Data collection and parsing from the binary
• Authentication and account management
• Backend for curating data about software and vulnerabilities
• Infrastructure

ToDo:

• Processing of the collected data / matching with the curated data
• UI
• Optimisation and testing of the binary
• Curating data

And loads of more stuff, but first we need to finish the above and get an alpha version out to you.

/Tom

LibreOffice has been added. It has been added as one product, since the vendor doesn't seem to support the individual apps with individual updates.

@ted OK, this explains, the agent did not yet do an inspection. With the current schedule it will take 10 hours.
Btw. you may want to delete / modify the picture / comment, since it displays your IP.

The agent already has support for this. How we display this, is decided in each rule. Thus, we may treat this independently for each program, but it seems most likely, that we will report individually, since most programs require separate updates for 32 and 64-bit versions.
It is something that we will pay attention to and if you see errors in the results, then it should be reported individually for each program.

Hi Ascendor,

Did you read this, we do link to this during installation:
https://secteer.com/privacy-policy-personal-carma/

SecTeer will collect the following information for CARMA consumer accounts:

Name (optional)
Email / Username (mandatory)
Password (mandatory)
Other personal information is not required to use the product, but you may be encouraged to supply this
IP addresses used to log in and submit data

The SecTeer CARMA products will collect the following information from your PC or device:

Program file names (NOT data files)
Meta data of program files, including, but not limited to size, version information, date, hashes, digital signatures, and other header / meta information
Directory structure i.e location of program files
Registry information related to installed software
Hostname or other unique identifier, to ensure correct correlation in reporting

Unfortunately, we do not offer a way around this nor do we have any plans to offer a different way of detected this and providing the results.

If you are concerned about this, then you can achieve a bit more anonymity, by registering using an alternative email address and perhaps send your data via a VPN (we do not support a proxy yet, but that may be implemented at a later stage).

And, soon, we will start anonymizing the data further i.e. by using placeholders for usernames in e.g. "c:\Users<yourusername>". However, this has NOT been implemented yet.

We've also planned another feature, which will allow you to exclude certain folders or drives.

Nitro PDF Reader and Nitro Pro has been added.

You should note that version 5 went End-of-Life long ago and should be considered insecure.

UI should be GUI not line

Suggested by @Alex-Connolly

In order to uninstall the Adobe Genuine Service (AGS) silently using the Custom Software feature, you need to download the following ZIP file:
https://helpx.adobe.com/content/dam/help/en/enterprise/using/uninstall-creative-cloud-products/jcr_content/root/content/flex/items/position/position-par/procedure/proc_par/step_0/step_par/download_section/download-1/Win_AdobeGenuineCleaner.zip

Once extracted, you need one file:
AdobeGenuineCleaner.exe

This requires one argument --UninstallUserDriven

You are now ready to assign it to one or more hosts in order to uninstall this service.

How to automate tag assignments based on host facts

This guide explains how you can automatically assign VulnDetect tags based on information collected directly from hosts - such as hardware details, OS version, Intune enrollment status, and other system facts.

The approach uses a PowerShell script executed through a Custom Software deployment. The script gathers host information and outputs structured data that our backend service reads and converts into tags.

---

Overview

1. A PowerShell script runs on hosts using Custom Software deployment.
2. The script collects system facts and outputs JSON.
3. A background job processes that output and creates or assigns tags automatically.

---

Step 1 - Create a Custom Software configuration

Create a Custom Software configuration containing:

• The assignMyTags.ps1 script
• The functions.ps1 helper script
  (these scripts are provided as examples, to show how the output should look like, please adjust to your needs).

The configuration must be named with the following prefix:

assignMyTags: <something>

Example:

assignMyTags: hardwareFacts

The prefix is required because the backend automation looks for deployments using this naming pattern.

Custom Deployment Configuration:

---

Step 2 - Create a Deployment Job

Create a deployment job using the Custom Software configuration.

The deployment job must be named with this prefix:

Custom deployment assignMyTags: <something>

Example:

Custom deployment assignMyTags: hardwareFacts

The backend job relies on this prefix to locate the deployment results.

Custom Deployment Job:

---

Step 3 - Contact Support

Once your deployment job is created and executed on hosts, contact Support.

We will enable a background cron job that:

• retrieves the script output
• creates any missing tags
• assigns the tags to the relevant hosts

The background job can run up to once per hour.

---

Tag naming recommendations

You are free to choose your own tag names, but we recommend using a clear prefix so automated tags are easy to identify.

Example:

auto.cpu-model: Intel Core i7-1260P
auto.tpm-version: 2.0
auto.laptop-model: ThinkPad T14 Gen 3

Only certain characters are allowed in tag names. Any unusual characters will automatically be removed by the background script.

---

Versioning tags

Inside the PowerShell script you will find two settings:

$amtName
$amtVersion

Example:

$amtName = "hardwareTags"
$amtVersion = "2"

These values control tag generations.

When the version number is incremented, the backend automation will automatically remove older tags with the same name.

This makes testing easier and prevents duplicate or outdated tags from accumulating.

Example workflow:

hardwareTags v1
-> test
-> change script
-> hardwareTags v2
-> old v1 tags automatically removed

The version must be an integer.

---

Updating dynamic tags

If your tags represent dynamic values (for example Intune enrollment status or disk encryption state), we can also help configure periodic redeployment of the Custom Software job.

This allows the host facts to be refreshed regularly so tags remain accurate over time.

Contact Support if you would like to enable this.

---

Summary

This mechanism allows you to:

• Automatically tag hosts based on real system data
• Maintain consistent tagging across your environment
• Easily iterate and test tag definitions using versioning
• Keep tags updated through scheduled deployments

If you have questions or want help setting this up, feel free to reach out to Support.

The reported Notepad++ supply-chain incident, as described in public reporting, was limited to the application’s built-in auto-update mechanism.

SecTeer VulnDetect does not use or depend on the Notepad++ auto-updater. All Notepad++ packages distributed through SecTeer are downloaded directly from the official vendor source and processed through SecTeer’s own validation pipeline.

This includes:

• Verification of the Authenticode signature where the vendor provides signed binaries
• Malware scanning using Microsoft Defender
• Additional reputation-based checks as a supplementary control

SecTeer packages are released independently of the vendor’s auto-update channel and are not delivered through the update mechanism involved in the reported incident. As a result, SecTeer did not distribute compromised code, and SecTeer’s distribution infrastructure was not impacted.

A system could only have received the compromised update if the built-in Notepad++ auto-update feature was enabled on the system

In short: SecTeer’s update mechanism was not involved in the incident, and no compromised Notepad++ packages were delivered through the SecTeer platform.

We have started recommending version 1.3.301 due to reports from Customers about failed upgrades when deploying version 1.3.304. This appears to be related to a bug in the installer where upgrading while Greenshot is running can cause the existing install to be removed or fail. You can review the specific issue here:

https://github.com/greenshot/greenshot/issues/732

We will update the Greenshot package when a new version is released.

Custom Software & Advanced Customisation - Technical Usage Guide

These features allow you to deploy Windows installers and supporting files to any Windows device.
Both features work the same way operationally; Advanced Customisation ties into our version-based detection for supported applications.

---

1. What the System Does

Execution Context

Each job runs either as SYSTEM or as the logged-in user.
Advanced Customisation automatically selects the correct context for the target app.

All uploaded files are placed into a temporary working directory controlled by our package wrapper. This directory is cleaned up automatically after execution.

---

2. Primary Installer vs. Additional Files

Primary Installer

Only the primary installer is executed.

Supported primary file types:
• .msi
• .msp
• .exe
• .ps1
• .bat
• adobe*.zip (special handling; primary only)

You can supply arguments for the primary installer.

Additional Files

Additional files are placed in the working directory but are not executed automatically.

Typical uses:
• Transforms/configs (.mst, .cfg, .xml)
• Supporting content (.zip, .ini, etc.)
• Registry files (.reg)

If a secondary file must be executed, make the primary file a script and orchestrate everything from there.

Example using .mst:
https://vulndetect.org/topic/2382/foxit-phantompdf-to-foxit-pdf-editor-upgrade

---

3. File-Type Behaviour

MSI / MSP / EXE

Executed using the arguments you provide.
All standard environment variables behave as expected for the chosen context (SYSTEM/user).

Example:
https://vulndetect.org/topic/2540/openvpn-install-upgrade
https://vulndetect.org/topic/2382/foxit-phantompdf-to-foxit-pdf-editor-upgrade

Scripts (.ps1, .bat)

Executed as the primary installer.
Scripts run under PowerShell 5.1 or CMD.
If a restricted PowerShell language mode is enforced, execution will fail.

Example:
https://vulndetect.org/topic/2386/running-powershell-scripts

REG Files (.reg)

Automatically imported using:

reg import filename.reg

No additional processing is performed.

Example:
https://vulndetect.org/topic/2388/registry-files-and-the-custom-software-feature

ZIP Files

General ZIP Files
Extracted automatically into the working directory.
Nothing is executed automatically — your script/installer must make use of the extracted content.

Adobe ZIP Archives (adobe*.zip)
When the primary file matches adobe*.zip, the system will:
1. Extract the archive using 7-Zip
2. Locate the Adobe setup installer
3. Execute it automatically

The ZIP must be the unmodified package downloaded from the Adobe Creative Cloud portal.

Example:
https://vulndetect.org/topic/2385/adobe-creative-cloud-install-upgrade

---

4. Working Directory

All uploaded files — primary and additional — are placed in the same temporary folder.

Relative references such as:

myconfig.xml
.\transform.mst

work normally.

Subfolders are not created unless your installer or script creates them.

Example:
https://vulndetect.org/topic/2621/install-autocad-lt

---

5. Detection & Success Criteria

Custom Software
• Accepted success codes: 0, 3010, 1603
• No version-based detection
• Exit codes only determine whether a reboot is required

Advanced Customisation
• Version-based detection tied to the application’s Recommended Version
• Whitelisted success/reboot codes (varies per app)
• More reliable detection overall

---

6. Common Use Cases

MSI with transform/config

Primary: myapp.msi
Additional: custom.mst, config.xml
Arguments:

msiexec /i myapp.msi TRANSFORMS=custom.mst /qn

Script orchestrating secondary actions

Primary: install.ps1
Additional: payload.zip, settings.reg
The script handles extraction, registry import, and any secondary execution.

Adobe Creative Cloud package

Primary: adobe-designteam.zip
The ZIP is extracted automatically and the internal Adobe setup installer is executed.

Installer requiring bundled resources

Primary: setup.exe
Additional: resources.zip
The ZIP is extracted automatically; your installer must reference the extracted content.

---

7. Operational Notes
   • Only the primary installer receives arguments.
   • Use a script as the primary file for multi-step processes.
   • Execution context provides standard environment variables (similar to Task Scheduler).
   • PowerShell 5.1 is always available; restricted modes will break the wrapper.

Today we received a number of reports about issues with Adobe Acrobat / Reader DC Continuous about it failing to start with the error: “Acrobat failed to load its Core DLL” after updating to version 25.001.20982.

This is caused by a faulty Adobe update and is not related to VulnDetect.

Shortly after receiving the first report, we changed the Recommended version to the previous one, thus effectively stopping new update tasks from being created.

Based on customer feedback and claims on various forums, it seems that installing the same architecture of the Microsoft Visual C++ 2015–2022 Redistributable as the installed Adobe Acrobat / Reader fixes the issue (for most). There are also reports that a full uninstall and reinstall of the previous version is required.

If in doubt, deploy the VC++ package first - it solves the issue for the majority.

You can do both things using SecTeer VulnDetect by using Tags and Deployment Jobs.

Adobe Acrobat Reader DC Continuous (x32)
https://corporate.vulndetect.com/#/applications/hosts?channelTag=adobe.acrobatreaderdc.default&title=Adobe Acrobat Reader DC Continuous (x32)

Adobe Acrobat Reader DC Continuous (x64)
https://corporate.vulndetect.com/#/applications/hosts?channelTag=adobe.acrobat.reader.dc&title=Adobe Acrobat Reader DC Continuous (x64)

Adobe Acrobat DC Continuous
https://corporate.vulndetect.com/#/applications/hosts?channelTag=adobe.acrobat.default&title=Adobe Acrobat DC Continuous

Note: Due to the way we detected Reader vs. Acrobat initially, and the way Adobe decided to handle 64-bit Reader, we ended up with architecture-specific detections for Reader, whereas Acrobat still covers both 32/64-bit.

On each of these links, you should select the hosts you need to “fix” and click Manage Tags for Selected Hosts, then assign a new tag that indicates the need to install the Visual C++ 2015–2022 Redistributable.

Under Deployment:
https://corporate.vulndetect.com/#/deployment/create-job

You should select Microsoft Visual C++ 2015–2022 Redistributable as appropriate and click Configure Deployment Job With X Application, then Select Tags, Groups or Hosts, find the newly created tag, click Set Job Name, adjust as you see fit, and finally click Create Deployment Job.

To speed up the deployment, you may want to go to Tags:
https://corporate.vulndetect.com/#/tags

Then click X Hosts and select as many hosts as you wish to initiate deployment to immediately. Note that clicking Inspect and Update Selected Hosts will initiate the deployment on all online hosts within a few minutes.

If you need to roll back Adobe Acrobat / Reader, you can also use Tags in a similar way to create a Deployment Job that uninstalls Adobe Acrobat / Reader, and then create a new one which installs it. Ensure that the Uninstall Job is set to “Install or uninstall once” and that it is attempted before you assign the Install Job. The Install Job may be set to “Always install or uninstall.”

Once Adobe publishes a fixed build, we will set it as the Recommended version so upgrades resume automatically.

The release notes are out:
https://www.adobe.com/devnet-docs/acrobatetk/tools/ReleaseNotesDC/continuous/dccontinuoussept2025qfe.html#dccontinuoussepttwentytwentyfiveqfe

This is the official fix for the printing issue:

4529876: Data loss in printing PDF on Reader and Acrobat

The packages for Acrobat/Reader in VulnDetect and PatchPro was released earlier this morning.

It appears that Adobe released version 25.001.20756 yesterday, however, it is not yet accompanied by release notes, we advice that you upgrade to 25.001.20756 on a few hosts and test this, before upgrading on a large scale.

We are currently testing this upgrade, and will release it once it passes the regular testing.

While reviewing detection for Avast Free Antivirus and Avast Business Security, we were unable to find reliable information confirming whether the following vulnerabilities have been fixed:

CVE-2025-3500
https://www.zerodayinitiative.com/advisories/ZDI-25-256/
This ZDI advisory specifies a fix; we have decided to rely on this information.

CVE-2024-7227
https://www.zerodayinitiative.com/advisories/ZDI-24-1003/
We have found no public documentation that this privilege-escalation vulnerability has been fixed.

Therefore, we have flagged both Avast Free Antivirus and Avast Business Security as Untracked. If no fixes are documented soon, we may escalate this status to Insecure / 0-day.

@OLLI_S This should have been solved on 2nd December, can you confirm?

And thank you for reporting it.

During testing of the Google Chrome 131.0.6778.109 MSI package, we found that it was broken, resulting in Exit Code 1603 after attempting to spawn a UAC prompt as the SYSTEM user.

This issue occurs both when upgrading via VulnDetect and Intune. In some cases, it even breaks the existing installation during rollback of the failed update.

As a result, we pulled the update before releasing it to customers.

Once Google has fixed the Enterprise "ready" MSI installer, we will update the package and make it available after thorough testing.

Please "upvote" the following post by Mikhail Gurin if you are affected by this and have a Google account. Hopefully, this will help make Google prioritize the fix: https://support.google.com/chrome/thread/311347547

For reference, we use the following installers:

https://dl.google.com/tag/s/dl/chrome/install/googlechromestandaloneenterprise.msi
https://dl.google.com/tag/s/dl/chrome/install/googlechromestandaloneenterprise64.msi

We also tested the EXE-based installers for offline deployment but found that these are incompatible with MSI-based installations.

It should be noted that the MSI works if launched interactively as a regular user who can approve the UAC prompt.