CVE-2012-2224: Improper Control of Generation of Code

Xunlei Thunder before 7.2.6 allows remote attackers to execute arbitrary code via a crafted file, related to a "DLL injection vulnerability."...

PT-2012-3891

Name of the Vulnerable Software and Affected Versions Xunlei Thunder versions prior to 7.2.6 Description The issue allows remote attackers to execute arbitrary code via a crafted file, related to a DLL injection vulnerability. Recommendations For versions prior to 7.2.6, update to version 7.2.6 o...

7-Technologies TERMIS Unspecified Path Subversion Arbitrary DLL Injection Code Execution

Binary data scadatermis210.nbin...

7-Technologies AQUIS Unspecified Path Subversion Arbitrary DLL Injection Code Execution

Binary data scadaaquis15.nbin...

THOR : Another P2P Botnet in development with extra stealth features

THOR : Another P2P Botnet in development with extra stealth features The research community is now focusing on the integration of peer-to-peer P2P concepts as incremental improvements to distributed malicious software networks now generically referred to as botnets. Because "botnets" can be used...

More Details of Sykipot Exploits Of Adobe Reader Flaw Surface

More evidence is beginning to emerge that the Adobe Reader zero-day bug revealed recently is being used in targeted attacks against companies and federal agencies. Researchers recently have come across fresh samples of malware exploiting the vulnerability by using files crafted to draw in employe...

Proof of Concept : PuttyHijack – Hijack SSH/PuTTY Sessions

Proof of Concept : PuttyHijack - Hijack SSH/PuTTY Sessions PuttyHijack is a POC tool that injects a dll into the Putty process to hijack an existing, or soon to be created, connection. This can be useful during penetration tests when a windows box that has been compromised is used to SSH/Telnet...

Proof of Concept : PuttyHijack – Hijack SSH/PuTTY Sessions

Proof of Concept : PuttyHijack - Hijack SSH/PuTTY Sessions PuttyHijack is a POC tool that injects a dll into the Putty process to hijack an existing, or soon to be created, connection. This can be useful during penetration tests when a windows box that has been compromised is used to SSH/Telnet...

Ecava IntegraXor Path Subversion Arbitrary DLL Injection Code Execution

Binary data scadaintegraxor3604081.nbin...

Google Picasa < 3.8 Path Subversion Arbitrary DLL Injection Code Execution

The version of Google Picasa running on the remote host is earlier than 3.8. Such versions insecurely look in their current working directory when resolving DLL dependencies. Attackers may exploit the issue by placing a specially crafted DLL file and another file associated with the application i...

(0Day) IBM Lotus Notes cai URI Handler Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of IBM Lotus Notes. User interaction is required to exploit this vulnerability. The specific flaw exists within the handling of malformed strings within cai:// URIs. The '--launcher.library' switch ca...

Windows Escalate UAC Protection Bypass (In Memory Injection)

This module will bypass Windows UAC by utilizing the trusted publisher certificate through process injection. It will spawn a second shell that has the UAC flag turned off. This module uses the Reflective DLL Injection technique to drop only the DLL payload binary instead of three separate binari...

Adobe Illustrator Path Subversion Arbitrary DLL Injection Code Execution (APSB10-29)

The version of Adobe Illustrator installed on the remote host is earlier than 15.0.2. Such versions insecurely look in their current working directory when resolving DLL and file dependencies, such as for 'aires.dll'. If a malicious DLL with the same name as a required DLL is located in the...

BlackBerry Desktop Software < 6.0 B47 Path Subversion Arbitrary DLL Injection Code Execution

BlackBerry Desktop Software has a DLL loading vulnerability that occurs when the program searches for a DLL file in the current working directory. Attackers may exploit the issue by placing a specially crafted DLL file and another file associated with the application in an location controlled by...

TeamViewer Path Subversion Arbitrary DLL Injection Code Execution

The version of TeamViewer installed on the remote Windows host is earlier than 5.0.9104. Such versions insecurely look in their current working directory when resolving DLL dependencies, such as for 'dwmapi.dll'. Attackers may exploit the issue by placing a specially crafted DLL file and another...

Opera < 10.62 Path Subversion Arbitrary DLL Injection Code Execution

The version of Opera installed on the remote host is earlier than 10.62. Such versions insecurely look in their current working directory when resolving DLL dependencies, such as for 'dwmapi.dll' If another application can be made to launch Opera in such a way that it searches for DLLs in the sam...

Wireshark / Ethereal < 1.2.11 / 1.0.16 Path Subversion Arbitrary DLL Injection Code Execution

The installed version of Wireshark or Ethereal is 1.2.0 - 1.2.10 or 0.8.4 - 1.0.15. Such versions are affected by the following vulnerability : - The application uses a fixed path to look for specific files or libraries, such as for 'airpcap.dll', and this path includes directories that may not b...

VLC Media Player < 1.1.4 Patch Subversion Arbitrary DLL Injection Code Execution (deprecated)

Binary data 5651.prm...

VLC Media Player < 1.1.4 Path Subversion Arbitrary DLL Injection Code Execution

The version of VLC media player installed on the remote host is earlier than 1.1.4. Such versions insecurely look in their current working directory when resolving DLL dependencies, such as for 'wintab32.dll'. If a malicious DLL with the same name as a required DLL is located in the application's...

Inside the Black Energy 2 Botnet

By Dmitry Tarakanov Cybercriminals use a variety of bots to conduct DDoS attacks on Internet servers. One of the most popular tools is called Black Energy. To date, Kaspersky Lab has identified and implemented detection for over 4,000 modifications of this malicious program. In mid-2008 malware...