Description of the Security Only update for .NET Framework 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, and 4.7.2 for Windows Server 2012 (KB 4338604)

Description of the Security Only update for .NET Framework 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, and 4.7.2 for Windows Server 2012 KB 4338604 Summary This security update resolves the following vulnerabilities: A "remote code execution" vulnerability exists when .NET Framework does not validate input...

Description of the Security Only update for .NET Framework 4.6, 4.6.1, 4.6.2, 4.7, 4.7.1, and 4.7.2 for Windows 7 SP1 and Server 2008 R2 SP1, and for .NET Framework 4.6 for Server 2008 (KB 4338606)

None None...

APSB18-22 Security update available for Adobe Connect

Adobe has released a security update for Adobe Connect. This update resolves an important authentication bypass vulnerability CVE-2018-4994, which could result in sensitive information disclosure if successfully exploited. This update also resolves an important session management vulnerability du...

IBM DB2 power lifting vulnerability (CNVD-2018-13457)

IBM DB2 is a set of relational database management system from IBM in the United States. The main execution environments for this system are UNIX, Linux, IBM i, z/OS, and Windows server versions. An untrustworthy search path vulnerability exists in IBM DB2 including DB2 Connect Server based on...

The installers of multiple Logicool software programs may insecurely load Dynamic Link Libraries

Overview The installers of multiple software programs provided by Logicool Co. Ltd contain an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries CWE-427 . Yuji Tounai of NTT Communications Corporation reported this vulnerability to IPA. JPCERT/CC coordinat...

PolarisOffice 2017 8 - Remote Code Execution

Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/POLARISOFFICE-2017-v8-REMOTE-CODE-EXECUTION.txt + ISR: Apparition Security Vendor: ============= www.polarisoffice.com Product: =========== PolarisOffice 2017 v8 Polaris...

PolarisOffice 2017 8 - Remote Code Execution Exploit

Exploit for windows platform in category remote exploits + Credits: John Page aka hyp3rlinx Vendor: ============= www.polarisoffice.com Product: =========== PolarisOffice 2017 v8 Polaris Document Solution is an integrated solution for corporate document life cycle from document creation, use,...

Mikrotik Winbox 任意文件访问漏洞

In April 23rd 2018, Mikrotik fixed a vulnerability “that allowed gaining access to an unsecured router”. myself and @yalpanian of BASU CERT reverse engineering lab tried to figure out what exactly got fixed, what was the problem in the first place and how severe was the impact of it. UPDATE: full...

CVE-2018-13102

AnyDesk before "12.06.2018 - 4.1.3" on Windows 7 SP1 has a DLL preloading vulnerability...

Security feature bypass

AnyDesk before "12.06.2018 - 4.1.3" on Windows 7 SP1 has a DLL preloading vulnerability...

CVE-2018-13102

AnyDesk before "12.06.2018 - 4.1.3" on Windows 7 SP1 has a DLL preloading vulnerability...

CVE-2018-13102

CVE-2018-13102 affects AnyDesk on Windows (pre-4.1.3, i.e., before 12.06.2018). The issue is DLL preloading in AnyDesk on Windows 7 SP1, enabling local privilege escalation. The OpenVAS entry and related records describe it as a privilege-escalation vulnerability, with the root cause being DLL pr...

Installer of Glary Utilities may insecurely load Dynamic Link Libraries

Overview Installer of Glary Utilities provided by Glarysoft Ltd. contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries CWE-427. Eili Masami reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Ear...

JVN#84967039: Installer of Glary Utilities may insecurely load Dynamic Link Libraries

Installer of Glary Utilities provided by Glarysoft Ltd. contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries CWE-427. Impact Arbitrary code may be executed with the privilege of the user invoking the installer. Solution Use the latest installer U...

Ikeext-Privesc - Windows IKEEXT DLL Hijacking Exploit Tool

This tool is intended for automatically detecting and exploiting the IKE and AuthIP IPsec Keyring Modules Service IKEEXT Missing DLL vulnerability. Description A major weakness is present in Windows Vista, 7, 8, Server 2008, Server 2008 R2 and Server 2012, which allows any authenticated user to...

Polaris Office 2017 8.1 Remote Code Execution Exploit

Polaris Office 2017 version 8.1 allows attackers to execute arbitrary code via a trojan horse "puiframeworkproresenu.dll" file in the current working directory, due to a search order flaw vulnerability. + Credits: John Page aka hyp3rlinx + Website: hyp3rlinx.altervista.org + Source:...

KYOCERA Multi-Set Template Editor 3.4 Out-Of-Band XML External Entity Injection

Summary KYOCERA Net Admin is Kyocera's unified device management software that uses a web-based platform to give network administrators easy and uncomplicated control to handle a fleet for up to 10,000 devices. Tasks that used to require multiple programs or walking to each printer can now be...

Microsoft OneDrive untrustworthy search path vulnerability

Microsoft OneDrive is a cloud backup application from Microsoft USA. The program features automatic backup of photo albums, online office and file sharing. An untrustworthy search path vulnerability exists in Microsoft OneDrive. An attacker can exploit this vulnerability with a malicious DLL in t...

AXON PBX DLL Hijacking Vulnerability

AXON PBX is a suite of virtual telephone exchange software for use in business environments. The software is mainly used to manage telephone call centers and implements the functions of a telephone exchange in a software way. A DLL hijacking vulnerability exists in AXON PBX version 2.02, which...

Microsoft Skype for Windows Untrustworthy Search Path Vulnerability

Microsoft Skype for Windows is a set of instant messaging software based on the Windows platform from Microsoft. The program supports video chat, multi-person chat and file transfer. An untrusted search path vulnerability exists in Microsoft Skype for Windows. An attacker can exploit this...