Design/Logic Flaw

Barco ClickShare Button R9861500D01 devices before 1.10.0.13 have Missing Support for Integrity Check. The Barco signed 'ClickshareForWindows.exe' binary on the ClickShare Button R9861500D01 loads a number of DLL files dynamically without verifying their integrity...

Jira on Windows was vulnerable to DLL hijacking - CVE-2019-20400

The usage of Tomcat in Jira before version 8.5.2 allows local attackers with permission to write a dll file to a directory in the global path environmental variable can inject code into via a DLL hijacking vulnerability. h3. Acknowledgment We would like to thank Peleg Hadar of SafeBreach Labs for...

Jira on Windows was vulnerable to DLL hijacking - CVE-2019-20400

The usage of Tomcat in Jira before version 8.5.2 allows local attackers with permission to write a dll file to a directory in the global path environmental variable can inject code into via a DLL hijacking vulnerability. h3. Acknowledgment We would like to thank Peleg Hadar of SafeBreach Labs for...

The vulnerability of the ksde.exe executable in Kaspersky Secure Connection, Kaspersky Internet Security, Kaspersky Total Security, Kaspersky Security Cloud anti-virus solutions lies in their lack of access control mechanisms. This allows attackers to execute arbitrary code.

The vulnerability of the ksde.exe executable in Kaspersky Secure Connection, Kaspersky Internet Security, Kaspersky Total Security, and Kaspersky Security Cloud antivirus protection is related to deficiencies in access control. Exploiting this vulnerability allows a hacker to execute arbitrary co...

Calling Local Windows RPC Servers from .NET

Posted by James Forshaw, Project Zero As much as I enjoy finding security vulnerabilities in Windows, in many ways I prefer the challenge of writing the tools to make it easier for me and others to do the hunting. This blog post gives an overview of using some recent tooling I’ve released as part...

VMSA-2019-0023:VMware Workstation and Horizon View Agent updates address a DLL-hijacking issue

VMware Security Advisories Advisory ID| VMSA-2019-0023 ---|--- Advisory Severity| Moderate CVSSv3 Range| 6.3 Synopsis| VMware Workstation and Horizon View Agent updates address a DLL-hijacking issue CVE-2019-5539 Issue Date| 2019-12-20 Updated On| 2019-12-20 Initial Advisory CVEs| CVE-2019-5539 1...

The vulnerability of the Endpoint Security Initial Client for Windows clients involves a lack of mechanisms for secure loading of DLL libraries, allowing attackers to exploit their privileges.

The vulnerability of Endpoint Security Initial Client for Windows involves a lack of a secure loading mechanism for DLL libraries. Exploiting this vulnerability allows an attacker to enhance their privileges by executing malicious software...

CVE-2019-19818

The JBIG2Decode library in npdf.dll in Nitro Free PDF Reader 12.0.0.112 has a CAPPDAnnotHandlerUtils::PDAnnotHandlerDestroyData2+0xa08a Out-of-Bounds Read via crafted Unicode content...

Microsoft Teams Instant Messenger DLL Hijacking

Microsoft Teams Instant Messenger application on Windows 7 SP1 fully patched is vulnerable to remote DLL loading / hijacking because : a The OS does not ship with the affected libraryies b The Teams application does not provide the libraryies So, it performs a search according to the 'PATH'...

CVE-2019-18232

SafeNet Sentinel LDK License Manager, all versions prior to 7.101only Microsoft Windows versions are affected is vulnerable when configured as a service. This vulnerability may allow an attacker with local access to create, write, and/or delete files in system folder using symbolic links, leading...

Privilege escalation

SafeNet Sentinel LDK License Manager, all versions prior to 7.101only Microsoft Windows versions are affected is vulnerable when configured as a service. This vulnerability may allow an attacker with local access to create, write, and/or delete files in system folder using symbolic links, leading...

CVE-2019-18232

SafeNet Sentinel LDK License Manager, all versions prior to 7.101only Microsoft Windows versions are affected is vulnerable when configured as a service. This vulnerability may allow an attacker with local access to create, write, and/or delete files in system folder using symbolic links, leading...

CVE-2019-3667

DLL Search Order Hijacking vulnerability in the Microsoft Windows client in McAfee Tech Check 3.0.0.17 and earlier allows local users to execute arbitrary code via the local folder placed there by an attacker...

CVE-2019-3667

DLL Search Order Hijacking vulnerability in the Microsoft Windows client in McAfee Tech Check 3.0.0.17 and earlier allows local users to execute arbitrary code via the local folder placed there by an attacker...

Spoofing

DLL Search Order Hijacking vulnerability in the Microsoft Windows client in McAfee Tech Check 3.0.0.17 and earlier allows local users to execute arbitrary code via the local folder placed there by an attacker...

CVE-2019-3667

CVE-2019-3667 affects McAfee TechCheck (Windows client) up to version 3.0.0.17, where a DLL search order hijacking vulnerability allows a local attacker to execute arbitrary code by placing a malicious DLL in a local folder. The affected component is McAfee TechCheck’s Windows client; root cause ...

The vulnerability of the Extension.dll library in Intel PROSet/Wireless WiFi networking tools involves operations that go beyond the buffer in memory. This vulnerability allows attackers to exploit their privileges, cause service failures, and disclose sensitive information.

The vulnerability of the Extension.dll library used in Intel PROSet/Wireless WiFi networking tools involves operations that go beyond the buffer in memory. Exploiting this vulnerability can allow attackers to gain elevated privileges, cause service interruptions, and expose sensitive information...

Autodesk Desktop Application code issue vulnerability

Autodesk Desktop Application is a desktop application for downloading, managing, and upgrading Autodesk products from Autodesk, Inc. A code issue vulnerability exists in Autodesk Desktop Application 7.0.16.29 and prior versions, which could be exploited by attackers to The vulnerability can be...

SYSTEM token impersonation through NTLM bits authentication on missing WinRM Service.

This module exploit BITS behavior which tries to connect to the local Windows Remote Management server WinRM every times it starts. The module launches a fake WinRM server which listen on port 5985 and triggers BITS. When BITS starts, it tries to authenticate to the Rogue WinRM server, which allo...

CVE-2019-5098

An exploitable out-of-bounds read vulnerability exists in AMD ATIDXX64.DLL driver, version 26.20.13001.29010. A specially crafted pixel shader can cause out-of-bounds memory read. An attacker can provide a specially crafted shader file to trigger this vulnerability. This vulnerability can be...