CVE-2022-42945

DWG TrueViewTM 2023 version has a DLL Search Order Hijacking vulnerability. Successful exploitation by a malicious attacker could result in remote code execution on the target system...

Design/Logic Flaw

DWG TrueViewTM 2023 version has a DLL Search Order Hijacking vulnerability. Successful exploitation by a malicious attacker could result in remote code execution on the target system...

CVE-2022-42945

DWG TrueViewTM 2023 version has a DLL Search Order Hijacking vulnerability. Successful exploitation by a malicious attacker could result in remote code execution on the target system...

CVE-2022-42945

DWG TrueView 2023 contains a DLL search order hijacking vulnerability leading to remote code execution (CVE-2022-42945). Root cause: DLL search order manipulation. Affected product: Autodesk DWG TrueView 2023. Evidence from multiple sources confirms the issue; exploitation is described as remote ...

PT-2022-26672 · Autodesk · Dwg Trueview

Name of the Vulnerable Software and Affected Versions: DWG TrueViewTM version 2023 Description: The issue is related to a DLL Search Order Hijacking vulnerability. Successful exploitation by a malicious attacker could result in remote code execution on the target system. Recommendations: For DWG...

CVE-2022-42945

DWG TrueViewTM 2023 version has a DLL Search Order Hijacking vulnerability. Successful exploitation by a malicious attacker could result in remote code execution on the target system...

Spoofing

IBM i Access Family 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.0 could allow a local authenticated attacker to execute arbitrary code on the system, caused by DLL search order hijacking vulnerability. By placing a specially crafted file in a compromised folder, an attacker could exploit this...

CVE-2022-40746

IBM i Access Family 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.0 could allow a local authenticated attacker to execute arbitrary code on the system, caused by DLL search order hijacking vulnerability. By placing a specially crafted file in a compromised folder, an attacker could exploit this...

CVE-2022-40746

CVE-2022-40746 affects IBM i Access Client Solutions (IBM i Access Family) versions 1.1.2–1.1.4 and 1.1.4.3–1.1.9.0. The root cause is a DLL search order hijacking vulnerability that could allow a local authenticated attacker to execute arbitrary code by placing a specially crafted file in a comp...

Security Bulletin: Multiple vulnerabilities in Node.js affect IBM Event Streams

Summary There are a number of vulnerabilities in Node.js that is used by IBM Event Streams. Vulnerability Details CVEID:CVE-2022-32222 DESCRIPTION: Node.js could allow a remote attacker to bypass security restrictions. By attempting to read openssl.cnf from /home/iojs/build/ upon startup, an...

Security Bulletin: Multiple Vulnerabilities in node.js

Summary Security Vulnerabilities in node.js affect IBM Watson Assistant for IBM Cloud Pak for Data. Refer to details for additional information.. Vulnerability Details CVEID:CVE-2022-32213 DESCRIPTION: Node.js is vulnerable to HTTP request smuggling, caused by the failure to correctly parse and...

Security Bulletin: CVE-2019-4732 vulnerabilitiy in IBM Java Runtime affects IBM Process Designer used in IBM Business Automation Workflow and IBM Business Process Manager

Summary A vulnerabilitiy exists in IBM® Runtime Environment Java™ Versions 6 and 7 used by the desktop version of IBM Process Designer. IBM Process Designer has addressed the applicable CVE. Vulnerability Details CVEID:CVE-2019-4732 DESCRIPTION: IBM SDK, Java Technology Edition Version could allo...

CVE-2021-45492

In Sage 300 ERP formerly accpac through 6.8.x, the installer configures the C:\Sage\Sage300\Runtime directory to be the first entry in the system-wide PATH environment variable. However, this directory is writable by unprivileged users because the Sage installer fails to set explicit permissions...

CVE-2021-45492

CVE-2021-45492 affects Sage 300 ERP (through 6.8.x). The installer places C:\Sage\Sage300\Runtime at the front of the system PATH, and this directory is writable by unprivileged users due to weak C:\ permissions inherited by the installer. Because PATH entries are used for DLL search order, an at...

CVE-2022-32223

Node.js is vulnerable to Hijack Execution Flow: DLL Hijacking under certain conditions on Windows platforms.This vulnerability can be exploited if the victim has the following dependencies on a Windows machine: OpenSSL has been installed and “C:\Program Files\Common Files\SSL\openssl.cnf”...

CVE-2021-20051

SonicWall Global VPN Client 4.10.7.1117 installer 32-bit and 64-bit and earlier versions have a DLL Search Order Hijacking vulnerability in one of the installer components. Successful exploitation via a local attacker could result in command execution in the target system...

CVE-2021-20051

SonicWall Global VPN Client DLL Search Order Hijacking vulnerability (CVE-2021-20051) affects the 4.10.7.1117 installer and earlier. The issue arises in an installer component where improper search/order handling could allow a local attacker to place a malicious file and achieve command execution...

State-backed hacking group from China is targeting the Russian military

In an unexpected turn of events, research has surfaced about a Chinese APT advanced persistent threat group targeting the Russian military in recent cyberattacks. Tracked as Bronze President, Mustang Panda, RedDelta, and TA416, the group has focused mainly on Southeast Asian targets—and more...

Chinese Hackers Caught Exploiting Popular Antivirus Products to Target Telecom Sector

A Chinese-aligned cyberespionage group has been observed striking the telecommunication sector in Central Asia with versions of malware such as ShadowPad and PlugX. Cybersecurity firm SentinelOne tied the intrusions to an actor it tracks under the name "Moshen Dragon," with tactical overlaps...

SonicWall Global VPN Client DLL Search Order Hijacking via Application Installer

SonicWall Global VPN Client 4.10.7 installer 32-bit and 64-bit and earlier have a DLL Search Order Hijacking vulnerability in one of the installer components. Successful exploitation via a local attacker could result in command execution in the target system. CVE: CVE-2021-20051 Last updated: Apr...