Design/Logic Flaw

The C:\Program Files x86\Splashtop\Splashtop Software Updater\uninst.exe process creates a folder at C:\Windows\Tempnsu.tmp and copies itself to it as Au.exe. The C:\Windows\Tempnsu.tmp\Au.exe file is automatically launched as SYSTEM when the system reboots or when a standard user runs an MSI...

CVE-2023-3181 Insecure Permissions in Splashtop Software Updater

The C:\Program Files x86\Splashtop\Splashtop Software Updater\uninst.exe process creates a folder at C:\Windows\Tempnsu.tmp and copies itself to it as Au.exe. The C:\Windows\Tempnsu.tmp\Au.exe file is automatically launched as SYSTEM when the system reboots or when a standard user runs an MSI...

CVE-2023-3181 Insecure Permissions in Splashtop Software Updater

The C:\Program Files x86\Splashtop\Splashtop Software Updater\uninst.exe process creates a folder at C:\Windows\Tempnsu.tmp and copies itself to it as Au.exe. The C:\Windows\Tempnsu.tmp\Au.exe file is automatically launched as SYSTEM when the system reboots or when a standard user runs an MSI...

CVE-2023-3181

CVE-2023-3181 affects Splashtop Software Updater (uninst.exe). The uninstaller creates a temporary folder at C:\Windows\Temp~nsu.tmp, copies itself as Au_.exe into that folder, and then Au_.exe is launched as SYSTEM on reboot or during an MSI repair via Splashtop Streamer’s Windows Installer. The...

China-backed Hackers Hijack Software Updates to Implant "NSPX30" Spyware

A previously undocumented China-aligned threat actor has been linked to a set of adversary-in-the-middle AitM attacks that hijack update requests from legitimate software to deliver a sophisticated implant named NSPX30. Slovak cybersecurity firm ESET is tracking the advanced persistent threat APT...

PT-2024-12288 · Splashtop · Splashtop Streamer +1

Name of the Vulnerable Software and Affected Versions: Splashtop Software Updater affected versions not specified Description: The issue concerns the creation of a folder at C:WindowsTempnsu.tmp by the C:Program Files x86SplashtopSplashtop Software Updateruninst.exe process, which copies itself t...

CVE-2023-51711

An issue was discovered in Regify Regipay Client for Windows version 4.5.1.0 allows DLL hijacking: a user can trigger the execution of arbitrary code every time the product is executed...

CVE-2023-51711

An issue was discovered in Regify Regipay Client for Windows version 4.5.1.0 allows DLL hijacking: a user can trigger the execution of arbitrary code every time the product is executed...

Design/Logic Flaw

An issue was discovered in Regify Regipay Client for Windows version 4.5.1.0 allows DLL hijacking: a user can trigger the execution of arbitrary code every time the product is executed...

PT-2024-14255 · Regify · Regify Regipay Client For Windows

Name of the Vulnerable Software and Affected Versions: Regify Regipay Client for Windows version 4.5.1.0 Description: An issue was discovered in Regify Regipay Client for Windows that allows DLL hijacking, enabling a user to trigger the execution of arbitrary code every time the product is...

CVE-2023-51711

CVE-2023-51711 affects Regify Regipay Client for Windows, version 4.5.1.0. The issue is a DLL hijacking vulnerability that permits the execution of arbitrary code when the product runs. The Red Hat/CNNVD entries corroborate the DLL hijack description and the target is Regipay Client for Windows 4...

CVE-2023-51711

An issue was discovered in Regify Regipay Client for Windows version 4.5.1.0 allows DLL hijacking: a user can trigger the execution of arbitrary code every time the product is executed...

CVE-2023-51711

An issue was discovered in Regify Regipay Client for Windows version 4.5.1.0 allows DLL hijacking: a user can trigger the execution of arbitrary code every time the product is executed...

DllNotificationInjection - A POC Of A New "Threadless" Process Injection Technique That Works By Utilizing The Concept Of DLL Notification Callbacks In Local And Remote Processes

DllNotificationInection is a POC of a new “threadless” process injection technique that works by utilizing the concept of DLL Notification Callbacks in local and remote processes. An accompanying blog post with more details is available here: https://shorsec.io/blog/dll-notification-injection/ Ho...

Npm Trojan Bypasses UAC, Installs AnyDesk with "Oscompatible" Package

A malicious package uploaded to the npm registry has been found deploying a sophisticated remote access trojan on compromised Windows machines. The package, named "oscompatible," was published on January 9, 2024, attracting a total of 380 downloads before it was taken down. oscompatible included ...

CVE-2024-22410

Creditcoin is a network that enables cross-blockchain credit transactions. The Windows binary of the Creditcoin node loads a suite of DLLs provided by Microsoft at startup. If a malicious user has access to overwrite the program files directory it is possible to replace these DLLs and execute...

CVE-2024-22410

In Creditcoin, the Windows node binary loads a set of Microsoft DLLs at startup. The vulnerability arises if an attacker can overwrite the program files directory, allowing replacement of these DLLs and arbitrary code execution via a binary planting attack. The issue is tied to DLLs from the Wind...

CVE-2023-29445

An uncontrolled search path element vulnerability DLL hijacking has been discovered that could allow a locally authenticated adversary to escalate privileges to SYSTEM...

CVE-2023-29445

An uncontrolled search path element vulnerability DLL hijacking has been discovered that could allow a locally authenticated adversary to escalate privileges to SYSTEM...

CVE-2023-29445

CVE-2023-29445 describes an Uncontrolled Search Path Element (DLL hijacking) in PTC Kepware KepServerEX. The vulnerability affects KepServerEX (and related ThingWorx Kepware Server) when a malicious DLL is loaded via the installer or binary search path, enabling a locally authenticated attacker t...