Panda Security DLL Hijacking

Hi @ll, the executable installers PANDAIS16.exe, PANDAAP16.exe, PANDAGL16.exe and PANDAGP16.exe available from load and execute at least UXTheme.dll, RichEd20.dll and RichEd32.dll from their "application directory". For software downloaded with a web browser the application directory is typically...

BlueControl 3.5 SR5 Insecure Library Loading Arbitrary Code Execution

Summary Engineering Tool for West Pro Series of controllers KS20-1, KS92-1, TB40-1, KS800, KS816, Dig280-1, KS vario, CI45, KS45, SG45, TB45, RL400, Pro96, CAL4600. Description BlueControl suffers from a DLL Hijacking issue. The vulnerability is caused due to the application loading libraries...

Art Systems FluidDraw P5/S5 5.3n Binary Planting Arbitrary Code Execution

/ Art Systems FluidDraw P5/S5 5.3n Binary Planting Arbitrary Code Execution Vendor: Art Systems Software GmbH | Festo AG & Co. KG Product web page: http://www.art-systems.com | https://www.festo.com Affected version: FluidDraw S5 Starter 5.3n 5.3.385.0 FluidDraw P5 Professional 5.3n 5.3.385.0...

Art Systems FluidDraw P5/S5 5.3n Binary Planting Arbitrary Code Execution

Summary Fluiddraw enables the creation of electrical and pneumatic circuit diagrams. The tool makes it easier to plan complete systems and implement individual components. Users access the Festo catalogue and their own imported databases and can thus benefit from evaluation functions and created...

Python 3.5.1 DLL Hijacking

Hi @ll, the executable installers python-3.5.1-webinstall.exe and python-3.5.1.exe available on load and execute multiple DLLs from their "application directory". For software downloaded with a web browser the application directory is typically the user's "Downloads" directory: see , and for "pri...

Remotely through a browser using Microsoft Office DLL MS15-1 3 2）hijacking vulnerability-vulnerability warning-the black bar safety net

A few weeks ago, security researcher Parvez Anwar, working in their individual tweets posted on a lot of Microsoft Office DLL hijacking vulnerability1. Fig. A few weeks later, Microsoft released MS15-1 3 2 patch, fixed a related vulnerability, while addressing the is Google security research2in a...

TrueCrypt 7.1a / 7.2 DLL Hijacking

Hi @ll, the executable installers "TrueCrypt Setup 7.1a.exe" and TrueCrypt-7.2.exe load and execute USP10.dll, RichEd20.dll, NTMarta.dll and SRClient.dll from their "application directory". For software downloaded with a web browser the application directory is typically the user's "Downloads"...

ZoneAlarm DLL Hijacking

Hi @ll, the executable installers ZASPSetupWeb141011000.exe and zafwSetupWeb141011000.exe load and execute at least UXTheme.dll, WindowsCodecs.dll and ProfAPI.dll from their "application directory". For software downloaded with a web browser the application directory is typically the user's...

Trend Micro DLL Hijacking

Hi @ll, TrendMicroMAX10.0US-enDownloader.exe available from loads and executes ProfAPI.dll and UXTheme.dll and other DLLs too eventually found in the directory it is started from the "application directory". For software downloaded with a web browser the application directory is typically the...

GlassWire: GlassWireSetup.exe subject to EXE planting attack

GlassWire recently fixed a DLL hijacking attack whereby trojan DLLs would be loaded from the user's \Downloads\ folder. However, it appears that GlasswireSetup.exe still uses an unqualified path when running CertUtil.exe and as a consequence a trojaned CertUtil.exe will execute from the \Download...

ESET NOD32 Antivirus DLL Hijacking

Hi @ll, the executable installer ° of ESET's NOD32 antivirus, esetnod32antivirusliveinstaller.exe, loads and executes at least the rogue/bogus/malicious Cabinet.dll and DbgHelp.dll eventually found in the directory it is started from ' the "application directory". For software downloaded with a w...

GlassWire: DLL Hijacking Vulnerability in GlassWireSetup.exe

GlasswireSetup.exe is subject to the attack described here: http://textslashplain.com/2015/12/18/dll-hijacking-just-wont-die/ You can get a simple demo with this harmless DLL: https://bayden.com/dl/shfolder.dll See attached image for proof of execution...

Avira Registry Cleaner DLL Hijacking

Hi @ll, aviraregistrycleaneren.exe, available from to clean up remnants the uninstallers of their snakeoil products fail to remove, is vulnerable: it loads and executes WTSAPI32.dll, UXTheme.dll and RichEd20.dll from its application directory tested and verified under Windows XP SP3 and Windows 7...

Cimon CmnView DLL Hijacking Vulnerability

OVERVIEW Ivan Sanchez of Wise Security has identified a DLL Hijacking vulnerability in the CIMON CmnView.exe application. CIMON, Inc. has produced a patch that mitigates this vulnerability. This vulnerability could be exploited remotely with social engineering and requires local user input...

VLC DLL Hijack

Hi @ll, the executable installers ° of the videolan client VLC, see are vulnerable: 1. They load and execute a rogue/bogus/malicious ShFolder.dll '² and other DLLs like SetupAPI.dll or UXTheme.dll too eventually found in the directory they are started from the "application directory". For softwar...

Rockwell Automation FactoryTalk DLL Hijacking Vulnerabilities

OVERVIEW This advisory was originally posted to the US-CERT secure Portal library on March 3, 2015, and is being released to the NCCIC/ICS-CERT web site. Ivan Sanchez of NullCode & Evilcode Team has identified multiple DLL Hijacking vulnerabilities in a software component included with Rockwell...

PowerTools - Collection Of PowerShell Projects With A Focus On Offensive Operations

Veil's PowerTools are a collection of PowerShell projects with a focus on offensive operations. This collection contains five projects: PowerUp PowerBreach PowerPick PewPewPew PowerView PowerUp PowerUp is a powershell tool to assist with local privilege escalation on Windows systems. It contains...

The old tree opened a new flower: DLL hijacking vulnerability in the new play-vulnerability warning-the black bar safety net

DLL hijacking vulnerabilities is already a trite, without freshness of the topic. DLL hijacking technique has also been is hackers banditry, the robbery necessary weapons. Then, with the Win10 birth, whether Microsoft has fixed this vulnerability? While in the current security environment, the DL...

Open Automation Software OPC Systems NET DLL Hijacking Vulnerability

OVERVIEW Ivan Sanchez from Nullcode Team has identified a DLL Hijacking vulnerability in Open Automation Software’s OPC Systems.NET application. Open Automation Software has reviewed the vulnerability and determined not to patch the issue at this time. This vulnerability could be exploited remote...

Microsoft Office Products Insecure Library Loading Vulnerability

microsoft products is prone to insecure library loading vulnerability. SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...