CVE-2017-2225

CVE-2017-2225 affects EbidSettingChecker.exe v1.0.0.0, introducing an untrusted DLL search path vulnerability (CWE-427) that an attacker can exploit to gain privileges via a Trojan horse DLL in an unspecified directory. Multiple sources (NVD/CNVD/PRION/CVE records; JVN entries) confirm the vulner...

CVE-2017-2225

Untrusted search path vulnerability in EbidSettingChecker.exe version 1.0.0.0 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory...

CVE-2017-2220

Untrusted search path vulnerability in Installer of CASL II simulator self-extract format allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory...

CVE-2017-2215

Untrusted search path vulnerability in Installer of "Setup file of advance preparation" jizensetup.exe The version which was available on the website prior to 2017 June 12 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory...

CVE-2017-2229

CVE-2017-2229: Untrusted search path vulnerability in Douroshisetu Kihon Data Sakusei System Ver1.0.2 and earlier allows privilege escalation via a Trojan horse DLL in an untrusted directory. Root cause: insecure DLL search path (CWE-427) related to the installer/load process. Affected product: D...

CVE-2017-2232

The CVE-2017-2232 issue affects the Installer of Shinseiyo Sogo Soft (4.8A) and earlier. The vulnerability is an untrusted search path (CWE-427) in the installer that can allow an attacker to cause arbitrary code execution by placing a Trojan horse DLL in an untrusted directory, gaining privilege...

CVE-2017-2188

The CVE-2017-2188 entry concerns the Installer of Denshinouhin Check System (Ministry of Agriculture, Forestry and Fisheries Nouson Seibi Jigyou). The vulnerability is an untrusted search path in the installer that can allow arbitrary code execution by loading a Trojan DLL from an unspecified dir...

CVE-2017-2220

CVE-2017-2220 concerns the Installer of the CASL II simulator (self-extract format) from IPA Japan. The vulnerability is a DLL search path issue (untrusted search path) that can be exploited to gain privileges via a Trojan DLL placed in an unspecified directory. The practical impact is arbitrary ...

CVE-2017-2232

Untrusted search path vulnerability in Installer of Shinseiyo Sogo Soft 4.8A and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory...

Mail.ru: [FG-VD-17-115] Mail.ru's Amigo Browser DLL Pre-Loading Vulnerability Notification

Amigo browser installer before version 2.0.0.257 was vulnerable to DLL planting vulnerability. Amigo browser is not currently in the scope of the Mail.Ru Bug Bounty program...

JVN#20409270: Installer of Douroshisetu Kihon Data Sakusei System may insecurely load Dynamic Link Libraries

The installer of Douroshisetu Kihon Data Sakusei System provided by National Institute for Land and Infrastructure Management contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries CWE-427. Impact Arbitrary code may be executed with the privilege o...

JVN#82120115: Installer of Douro Kouji Kanseizutou Check Program may insecurely load Dynamic Link Libraries

Installer of Kouji Kanseizutou Check Program provided by National Institute for Land and Infrastructure Management contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries CWE-427. Impact Arbitrary code may be executed with the privilege of the user...

Schneider Electric Pro-Face WinGP Arbitrary Code Execution Vulnerability

Pro-Face GP Pro-Server EX is the HMI development software of choice for supporting dedicated and open HMI PC-based solutions. An arbitrary code execution vulnerability exists in Schneider Electric Pro-Face WinGP, which can be exploited by an attacker to force the process to load an arbitrary DLL...

JVN#06337557: Installer and self-extracting archive containing the installer of MLIT DenshiSeikabutsuSakuseiShienKensa system may insecurely load Dynamic Link Libraries

The installer and the self-extracting archive including the installer of MLIT DenshiSeikabutsuSakuseiShienKensa system contain an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries CWE-427. Impact Arbitrary code may be executed with the privilege of the us...

Dell Precision Optimizer Local Privilege Escalation Vulnerability

Summary An exploitable dll hijacking vulnerability exists in the poaService.exe service component of the Dell Precision Optimizer software version 3.5.5.0. A specifically named malicious dll file located in one of directories pointed to by the PATH environment variable will lead to privilege...

JVN#45134765: Installer of PDF Digital Signature Plugin provided by the Ministry of Justice may insecurely load Dynamic Link Libraries

Installer of PDF Digital Signature Plugin provided by the Ministry of Justice contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries CWE-427. Impact Arbitrary code may be executed with the privilege of the user invoking the installer. Solution Use...

Microsoft Machine Debug Manager (mdm) DLL Hijacking

Microsoft Machine Debug Manager mdm DLL side loading vulnerability Vulnerability: DLL Hijacking / DLL Side Loading Advisory URL: https://ipositivesecurity.com/2017/06/15/microsoft-machine-debug-manager-mdm-insecure-library-loading-allows-code-execution/ ------------------------ ABOUT...

JVN#23389212: Installer of Shinseiyou Sougou Soft provided by The Ministry of Justice may insecurely load Dynamic Link Libraries

Installer of Shinseiyou Sougou Soft provided by The Ministry of Justice contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries CWE-427. Impact Arbitrary code may be executed with the privilege of the user invoking the installer. Solution Use the...

Installer of Setup file of advance preparation for e-Tax software (WEB version) may insecurely load Dynamic Link Libraries

Overview Installer of Setup file of advance preparation for e-Tax software WEB version provided by National Tax Agency contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries. BlackWingCat of Pink Flying Whale reported this vulnerability to IPA...

JVN#79451345: Installer of Setup file of advance preparation for e-Tax software (WEB version) may insecurely load Dynamic Link Libraries

Installer of Setup file of advance preparation for e-Tax software WEB version provided by National Tax Agency contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries. Impact Arbitrary code may be executed with the privilege of the user invoking the...