Code injection

SAP Business Client, version 7.0, allows an attacker after a successful social engineering attack to inject malicious code as a DLL file in untrusted directories that can be executed by the application, due to uncontrolled search path element. An attacker could thereby control the behavior of the...

CVE-2020-6244

SAP Business Client 7.0 is affected by CVE-2020-6244. The issue arises from an uncontrolled search path element that allows a social-engineering attacker to place a DLL in untrusted directories, which can then be executed by the application and enable the attacker to control its behavior. Exploit...

CVE-2020-6244

SAP Business Client, version 7.0, allows an attacker after a successful social engineering attack to inject malicious code as a DLL file in untrusted directories that can be executed by the application, due to uncontrolled search path element. An attacker could thereby control the behavior of the...

Security Only Update for .NET Framework 3.5, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, 4.7.2, 4.8 for Windows Server 2012 (KB4556404)

Security Only Update for .NET Framework 3.5, 4.5.2, 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, 4.7.2, 4.8 for Windows Server 2012 KB4556404 Applies to: Microsoft .NET Framework 3.5 Microsoft .NET Framework 4.5.2 Microsoft .NET Framework 4.6 Microsoft .NET Framework 4.6.1 Microsoft .NET Framework 4.6.2...

DLL Injection

kerberos is vulnerable to DLL Injection. Loading of DLLs without specifying a full path allows an attacker to create a file with the same name in a folder that precedes the intended file in the DLL path search, leading to an arbitrary code execution...

PT-2020-19040 · Sap · Sap Business Client

Name of the Vulnerable Software and Affected Versions: SAP Business Client version 7.0 Description: The issue allows an attacker, after a successful social engineering attack, to inject malicious code as a DLL file in untrusted directories that can be executed by the application, due to an...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect IBM WebSphere Cast Iron Solution & App Connect Professional

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology used by IBM Cast Iron. These issues were disclosed as part of the IBM Java SDK updates in January 2020. IBM Cast Iron has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2020-2593 DESCRIPTION: An unspecified...

Service Tracing Privilege Escalation Exploit

This Metasploit module leverages a trusted file overwrite with a dll hijacking vulnerability to gain SYSTEM-level access on vulnerable Windows 10 x64 targets. This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect Rational Performance Tester

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 1.8 and IBM® Runtime Environment Java™ Version 1.8 used by Rational Performance Tester. Rational Performance Tester has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2019-4732 DESCRIPTION: I...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK affect Rational Service Tester

Summary There are multiple vulnerabilities in IBM® SDK Java™ Technology Edition, Version 1.8 and IBM® Runtime Environment Java™ Version 1.8 used by Rational Service Tester. Rational Service Tester has addressed the applicable CVEs. Vulnerability Details CVEID: CVE-2019-4732 DESCRIPTION: IBM SDK,...

Service Tracing Privilege Escalation

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core/post/common' require 'msf/core/post/windows/priv' require 'msf/core/post/windows/registry' require 'msf/core/exploit/exe' require...

Blue Mockingbird Monero-Mining Campaign Exploits Web Apps

A Monero cryptocurrency-mining campaign has emerged that exploits a known vulnerability in public-facing web applications built on the ASP.NET open-source web framework. The campaign has been dubbed Blue Mockingbird by the analysts at Red Canary that discovered the activity. Research uncovered th...

Security Bulletin: A vulnerability in IBM Java Runtime affects IBM SPSS Statistics Subscription

Summary There is a vulnerability in IBM® Runtime Environment Java™ Versions 7.0, 7.1, and 8.0 used by IBM SPSS Statistics Subscription. IBM SPSS Statistics Subscription has addressed the applicable CVE. This CVE affects the windows platform only. Vulnerability Details CVEID: CVE-2019-4732...

CVE-2019-19166

Tobesoft XPlatform v9.1, 9.2.0, 9.2.1 and 9.2.2 have a vulnerability that can load unauthorized DLL files. It allows attacker to cause remote code execution...

CVE-2019-19166

Tobesoft XPlatform v9.1, 9.2.0, 9.2.1 and 9.2.2 have a vulnerability that can load unauthorized DLL files. It allows attacker to cause remote code execution...

CVE-2019-19166 Tobesoft XPlatform Arbitrary File Execution Vulnerability

Tobesoft XPlatform v9.1, 9.2.0, 9.2.1 and 9.2.2 have a vulnerability that can load unauthorized DLL files. It allows attacker to cause remote code execution...

CVE-2019-19166

CVE-2019-19166 affects Tobesoft XPlatform versions 9.1, 9.2.0, 9.2.1 and 9.2.2, where it can load unauthorized DLL files and cause remote code execution. The provided connected documents confirm the vulnerability exists in these XPlatform builds and that the attack outcome is remote execution via...

Security Bulletin: Vulnerability in IBM Java Runtime affects IBM Spectrum Protect for Enterprise Resource Planning on Windows (CVE-2019-4732)

Summary Multiple vulnerabilities in IBM Java Runtime Environment were disclosed as part of the IBM Java SDK updates in January 2020. IBM Java Runtime Environment, used by IBM Spectrum Protect formerly Tivoli Storage Manager for Enterprise Resource Planning. has addressed the applicable CVE which...

Security Bulletin: A vulnerability in IBM Java Runtime affect Financial Transaction Manager for Digital Payments (CVE-2019-4732)

Summary There is vulnerability in IBM® Runtime Environment Java™ Version 8 used by Financial Transaction Manager for Digital Payments. Financial Transaction Manager for Digital Payments FTM DP has addressed the applicable CVE.brIf you run your own Java code using the IBM Java Runtime delivered wi...

Security Bulletin: Windows DLL injection vulnerability in IBM Java Runtime affects Collaboration and Deployment Services

Summary There is a Windows DLL injection vulnerability in IBM® Runtime Environment Java™ Version JRE71SR4FP15, JRE71SR4FP45 and JRE8SR5FP36 used by Collaboration and Deployment Services on windows platform. This issue was disclosed as part of the IBM Java SDK updates in January 2020. Vulnerabilit...