Microsoft Windows DLL Loading Remote Code Execution (MS16-007: CVE-2016-0018)

A remote code execution vulnerability has been reported in Microsoft Windows. The vulnerability is due to the way Windows improperly validates input before loading libraries. A remote attacker could exploit this vulnerability by enticing a target user to open a specially crafted file...

Microsoft Windows Mapi DLL Loading Elevation of Privilege (MS16-007: CVE-2016-0020)

An elevation of privilege vulnerability has been reported in Microsoft Windows. The vulnerability is due to an error in certain DLL files, which could be abused by attackers to gain higher privileges or bypass sandboxing mechanisms. The attacker must entice the victim to run an executable file to...

Microsoft Internet Explorer NewMessage Protected Mode Sandbox Escape Vulnerability

This vulnerability allows attackers to execute arbitrary code on vulnerable installations of Microsoft Internet Explorer. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the...

TrueCrypt 7.1a / 7.2 DLL Hijacking

Hi @ll, the executable installers "TrueCrypt Setup 7.1a.exe" and TrueCrypt-7.2.exe load and execute USP10.dll, RichEd20.dll, NTMarta.dll and SRClient.dll from their "application directory". For software downloaded with a web browser the application directory is typically the user's "Downloads"...

ZoneAlarm DLL Hijacking

Hi @ll, the executable installers ZASPSetupWeb141011000.exe and zafwSetupWeb141011000.exe load and execute at least UXTheme.dll, WindowsCodecs.dll and ProfAPI.dll from their "application directory". For software downloaded with a web browser the application directory is typically the user's...

Microsoft .NET Framework ASLR Security Bypass (MS15-118: CVE-2015-6115)

A security feature bypass vulnerability exists in Microsoft .NET Framework. The vulnerability is due to a DLL file that was not compiled with Address Space Layout Randomization ASLR enabled. A remote attacker can exploit this vulnerability by enticing a target user to open a crafted document that...

Trend Micro DLL Hijacking

Hi @ll, TrendMicroMAX10.0US-enDownloader.exe available from loads and executes ProfAPI.dll and UXTheme.dll and other DLLs too eventually found in the directory it is started from the "application directory". For software downloaded with a web browser the application directory is typically the...

GlassWire: GlassWireSetup.exe subject to EXE planting attack

GlassWire recently fixed a DLL hijacking attack whereby trojan DLLs would be loaded from the user's \Downloads\ folder. However, it appears that GlasswireSetup.exe still uses an unqualified path when running CertUtil.exe and as a consequence a trojaned CertUtil.exe will execute from the \Download...

F-Secure Online Scanner Arbitrary Code Execution Vulnerability

F-Secure Online Scanner is a suite of software for scanning and cleaning PCs from the Finnish company F-Secure. An arbitrary code execution vulnerability exists in F-Secure Online Scanner. An attacker could exploit this vulnerability by tricking a legitimate user into opening a specially crafted...

CVE-2015-7917

Untrusted search path vulnerability in Open Automation OPC Systems.NET 8.00.0023 and earlier allows local users to gain privileges via a Trojan horse DLL in an unspecified directory...

Design/Logic Flaw

Untrusted search path vulnerability in Open Automation OPC Systems.NET 8.00.0023 and earlier allows local users to gain privileges via a Trojan horse DLL in an unspecified directory...

CVE-2015-7917

Untrusted search path vulnerability in Open Automation OPC Systems.NET 8.00.0023 and earlier allows local users to gain privileges via a Trojan horse DLL in an unspecified directory...

CVE-2015-7917

Untrusted search path vulnerability in Open Automation OPC Systems.NET 8.00.0023 and earlier allows local users to gain privileges via a Trojan horse DLL in an unspecified directory...

Dynamic Shellcode Injection: Shellter

Shellter is a dynamic shellcode injection tool, and probably the first dynamic PE infector ever created. It can be used in order to inject shellcode into native Windows applications currently 32-bit apps only. The shellcode can be something yours or something generated through a framework, such a...

ESET NOD32 Antivirus DLL Hijacking

Hi @ll, the executable installer ° of ESET's NOD32 antivirus, esetnod32antivirusliveinstaller.exe, loads and executes at least the rogue/bogus/malicious Cabinet.dll and DbgHelp.dll eventually found in the directory it is started from ' the "application directory". For software downloaded with a w...

Microsoft Unicode Scripts Processor Arbitrary Code Execution Exploit

On the 8th December 2015, Microsoft released Security Bulletin MS15-130 to fix a vulnerability in Unicode Scripts Processor component found by Secunia Research. The vector for a successful exploitation is a specially crafted "True Type Font" TTF file, which typically can be embedded in e.g...

GlassWire: DLL Hijacking Vulnerability in GlassWireSetup.exe

GlasswireSetup.exe is subject to the attack described here: http://textslashplain.com/2015/12/18/dll-hijacking-just-wont-die/ You can get a simple demo with this harmless DLL: https://bayden.com/dl/shfolder.dll See attached image for proof of execution...

Avira Registry Cleaner DLL Hijacking

Hi @ll, aviraregistrycleaneren.exe, available from to clean up remnants the uninstallers of their snakeoil products fail to remove, is vulnerable: it loads and executes WTSAPI32.dll, UXTheme.dll and RichEd20.dll from its application directory tested and verified under Windows XP SP3 and Windows 7...

Adobe Reader DC AGM Remote Code Execution Vulnerability

Adobe Reader is a PDF document reading software.Acrobat is a PDF document editing software. Acrobat Reader DC in the implementation of AGM.dll security vulnerabilities, with multiple layers of the construction of the PDF will lead to a heap buffer overflow, an attacker can take advantage of this...

Microsoft Office COM Object - DLL Planting with comsvcs.dll Delay Load of mqrt.dll (MS15-132)

Microsoft Office COM Object - DLL Planting with comsvcs.dll Delay Load of mqrt.dll MS15-132 Source: https://code.google.com/p/google-security-research/issues/detail?id=556 It is possible for an attacker to execute a DLL planting attack in Microsoft Office 2010 on Windows 7 x86 with a specially...