CVE-2016-0160

Microsoft Internet Explorer 11 mishandles DLL loading, which allows local users to gain privileges via a crafted application, aka "DLL Loading Remote Code Execution Vulnerability."...

DLL Loading Remote Code Execution Vulnerability

A remote code execution vulnerability exists when Internet Explorer improperly validates input before loading dynamic link library DLL files. An attacker who successfully exploited this vulnerability could take control of an affected system. An attacker could then install programs; view, change, ...

Microsoft .NET Framework mscoreei DLL Planting Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Microsoft .NET Framework. User interaction is required to exploit this vulnerability in that the target must visit a malicious web page or open a malicious directory or device. The specific flaw...

Adobe Flash Player Insecure Library Loading (APSB16-10: CVE-2016-1014)

A remote code execution vulnerability has been reported in Adobe Flash Player. The vulnerability is due to insecure library loading while handling certain files. A remote attacker could exploit this issue by enticing a user to open a legitimate file that will insecurely load a specially crafted D...

IDA SDK 6.9 Demo / IDA 5.0 Freeware DLL Hijacking

Software : Interactive DisAssembler IDA PRO Version: = IDA SDK 6.9 demo IDA 5.0 Freeware Software Link: https://www.hex-rays.com/products/ida/support/download.shtml Tested on: WINDOWS XP SP3 - 32 bit, WINDOWS 7 SP1 - 32 bit, Windows 8.1 32 bit IDA Pro suffers from DLL HIJACK Vulnerability from .i...

JPEGSnoop 1.7.3 DLL Hijacking

Software : JPEGSnoop Software Link: https://sourceforge.net/projects/jpegsnoop/ Version: LPORT=4444 JPEGSnoopENU.dll Exploit: Place a dummy or original JPEG file having .jpeg extension file with the malicious dll. When the file is opened in JPEGSnoop you can get machines access and even the shell...

In-depth analysis DLL hijacking vulnerability-vulnerability warning-the black bar safety net

0×0 1. DLL hijacking vulnerability description 1.1 vulnerability profile If the process tries to load a DLL without specifying the DLL's absolute path, then Windows will try to go to the specified directory to find the DLL; if the attacker is able to control which of a certain directory, and put ...

Comodo DLL Hijacking

Hi @ll, the executable installers cispro30dayinstaller11508d.exe, cispremiuminstaller610008.exe, cavinstaller595160.exe, cavinstaller.exe and cfwinstaller.exe available from load and execute several DLLs from their "application directory". For software downloaded with a web browser the applicatio...

Comodo - Integer Overflow Leading to Heap Overflow in Win32 Emulation

Comodo - Integer Overflow Leading to Heap Overflow in Win32 Emulation Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=738 A major component of Comodo Antivirus is the x86 emulator, which includes a number of shims for win32 API routines so that common API calls work in emulated...

Comodo - Integer Overflow Leading to Heap Overflow in Win32 Emulation

Source: https://bugs.chromium.org/p/project-zero/issues/detail?id=738 A major component of Comodo Antivirus is the x86 emulator, which includes a number of shims for win32 API routines so that common API calls work in emulated programs CreateFile, LoadLibrary, etc. The emulator itself is located ...

Al-Khaser - Public Malware Techniques Used In The Wild

al-khaser is a PoC malware with good intentions that aimes to stress your anti-malware system. It performs a bunch of nowadays malwares tricks and the goal is to see if you catch them all. Possible uses You are making an anti-debug plugin and you want to check its effectiveness. You want to ensur...

AbsoluteTelnet 10.14 DLL Hijacking

Credits: hyp3rlinx + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/ABSOLUTETELNET-DLL-HIJACK.txt Vendor: ========================== www.celestialsoftware.net Product: ===================== AbsoluteTelnet 10.14 AbsoluteTelnet / SSH is a telnet and SSH...

CVE-2016-2281

Untrusted search path vulnerability in ABB Panel Builder 800 5.1 allows local users to gain privileges via a Trojan horse DLL in the current working directory...

Design/Logic Flaw

Untrusted search path vulnerability in ABB Panel Builder 800 5.1 allows local users to gain privileges via a Trojan horse DLL in the current working directory...

CVE-2016-2281

Untrusted search path vulnerability in ABB Panel Builder 800 5.1 allows local users to gain privileges via a Trojan horse DLL in the current working directory...

ABB Panel Builder 800 DLL Hijacking Vulnerability (Update A)

OVERVIEW This updated advisory is a follow-up to the original advisory titled ICSA-16-077-01 ABB Panel Builder 800 DLL Hijacking Vulnerability that was published March 17, 2016, on the NCCIC/ICS-CERT web site. Ivan Sanchez from Nullcode Team has identified a DLL Hijacking vulnerability in the ABB...

KLA10777 Code execution vulnerability in ABB Panel Builder 800

An unspecified vulnerability was found in ABB Panel Builder 800. By exploiting this vulnerability malicious users can execute arbitrary code. This vulnerability can be exploited remotely via a DLL hijack. Technical details This vulnerability can be mitigated via disabling .pba files associations...

Adobe Reader < 11.0.15 / 15.006.30121 / 15.010.20060 Multiple Vulnerabilities (APSB16-09) (Mac OS X)

The version of Adobe Reader installed on the remote Mac OS X host is prior to 11.0.15, 15.006.30121, or 15.010.20060. It is, therefore, affected by multiple vulnerabilities : - A memory corruption issue exists due to the use of uninitialized memory when handling annotation gestures. A remote...

Adobe Acrobat < 11.0.15 / 15.006.30121 / 15.010.20060 Multiple Vulnerabilities (APSB16-09) (Mac OS X)

The version of Adobe Acrobat installed on the remote Mac OS X host is prior to 11.0.15, 15.006.30121, or 15.010.20060. It is, therefore, affected by multiple vulnerabilities : - A memory corruption issue exists due to the use of uninitialized memory when handling annotation gestures. A remote...

Adobe Acrobat < 11.0.15 / 15.006.30121 / 15.010.20060 Multiple Vulnerabilities (APSB16-09)

The version of Adobe Acrobat installed on the remote Windows host is a version prior to 11.0.15, 15.006.30121, or 15.010.20060. It is, therefore, affected by multiple vulnerabilities. - Adobe Reader and Acrobat before 11.0.15, Acrobat and Acrobat Reader DC Classic before 15.006.30121, and Acrobat...