DllHijackAuditor 3.5 - Stack Overflow Vulnerability

DLL Hijack Auditor is the smart tool to Audit against the Dll Hijacking Vulnerability in any Windows application. This is one of the critical security issue affecting almost all Windows systems. Though most of the apps have been fixed, but still many Windows applications are susceptible to this...

Sublime Text Editor 3 DLL Hijacking

===================================================== Sublime Text Editor 3 - DLL Hijacking ===================================================== Vendor Homepage: https://www.sublimetext.com/ Date: 20 Oct 2016 Software Link : https://download.sublimetext.com/Sublime Text Build 3126 Setup.exe...

SMB Delivery Module

require 'msf/core' require 'msf/core/exploit/powershell' class MetasploitModule "SMB Delivery", 'Description' = %q This module serves payloads via an SMB server and provides commands to retrieve and execute the generated payloads. Currently supports DLLs and Powershell. , 'License' = MSFLICENSE,...

Windows UAC Bypass Hack Leaves Systems Open to Malicious DLLs

Researchers have crafted a stealthy new way of bypassing Windows User Account Controls UAC that opens the door to attacks on targeted systems. According researchers, the bypass technique can fly under the radar of security solutions that monitor for this type of circumvention. The UAC bypass...

CVE-2016-5821

Huawei HiSuite before 4.0.4.204ove Out of China and before 4.0.4.301 China use a weak ACL FILEWRITEDATA for BUILTIN\Users for the HiSuite service directory, which allows local users to gain SYSTEM privileges via a Trojan horse 1 SspiCli.dll or 2 USERENV.dll file or possibly other unspecified DLL...

InstantHMI 6.1 - Local Privilege Escalation

InstantHMI 6.1 - Local Privilege Escalation Title: InstantHMI - EoP: User to ADMIN CWE Class: CWE-276: Incorrect Default Permissions Date: 01/06/2016 Vendor: Software Horizons Product: InstantHMI Version: 6.1 Download link: http://www.instanthmi.com/ihmisoftware.htm Tested on: Windows 7 x86, full...

Hide.Me VPN Client 1.2.4 - Privilege Escalation

Exploit for windows platform in category local exploits Title: Hide.Me VPN Client - EoP: User to SYSTEM CWE Class: CWE-276: Incorrect Default Permissions Date: 01/06/2016 Vendor: eVenture Product: Hide.Me VPN Client Version: 1.2.4 Download link: https://hide.me/en/software/windows Tested on:...

Hide.Me VPN Client 1.2.4 - Local Privilege Escalation

Hide.Me VPN Client 1.2.4 - Local Privilege Escalation Title: Hide.Me VPN Client - EoP: User to SYSTEM CWE Class: CWE-276: Incorrect Default Permissions Date: 01/06/2016 Vendor: eVenture Product: Hide.Me VPN Client Version: 1.2.4 Download link: https://hide.me/en/software/windows Tested on: Window...

InstantHMI 6.1 - Privilege Escalation

Exploit for windows platform in category local exploits Title: InstantHMI - EoP: User to ADMIN CWE Class: CWE-276: Incorrect Default Permissions Date: 01/06/2016 Vendor: Software Horizons Product: InstantHMI Version: 6.1 Download link: http://www.instanthmi.com/ihmisoftware.htm Tested on: Windows...

CURL-CVE-2016-4802 Windows DLL hijacking

libcurl would load Windows system DLLs in a manner that may make it vulnerable to a DLL hijacking aka binary planting attack in certain configurations. libcurl has a unified code base that builds and runs on a multitude of different versions of Windows. To make that possible, when libcurl is buil...

CVE-2016-4349

The CVE-2016-4349 entry describes an Untrusted search path vulnerability in Cisco WebEx Productivity Tools 2.40.5001.10012. The issue allows local privilege escalation by placing one of several DLLs (cryptsp.dll, dwmapi.dll, msimg32.dll, ntmarta.dll, propsys.dll, riched20.dll, rpcrtremote.dll, se...

Emsisoft Anti Malware DLL Hijacking

Hi @ll, EmsisoftAntiMalwareSetup.exe as well as EmsisoftAntiMalwareXPSetup.exe, EmsisoftEmergencyKit.exe and EmsisoftHiJackFreeSetup.exe load and execute UXTheme.dll plus other DLLs like RichEd20.dll and RichEd32.dll eventually found in the directory they are started from the "application...

Elipse E3 Process Control Vulnerability (Update A)

OVERVIEW This updated advisory is a follow-up to the original advisory titled ICSA-15-069-04 Elipse E3 Process Control Vulnerability that was published March 10, 2015, on the NCCIC/ICS-CERT web site. Ivan Sanchez from Nullcode Team has identified a process control vulnerability in the Elipse E3...

Microsoft Blocks Unsigned DLLs in Edge with Update

The security community rejoiced when Microsoft announced earlier this year that it would strip maligned extensions such as ActiveX and VB Script – often bullied in attacks – from its new Edge browser. Now the company claims a recent update to the browser prevents the loading of unsigned DLLs...

Cisco AnyConnect privilege escalation

Privilege escalation via DLLs and DMG files...

Cisco AnyConnect Secure Mobility Client 3.x < 3.1.11004.0 / 4.x < 4.1.6020.0 Privilege Escalation

The Cisco AnyConnect Secure Mobility Client installed on the remote host is version 3.x prior to 3.1.11004.0 or 4.x prior to 4.1.6020.0. It is, therefore, affected by an untrusted search path flaw in the CMainThread::launchDownloader method due to a failure to check the path to the downloader...

WinRAR Settings Import Command Execution

!/usr/bin/python -w Title : WinRar Settings Import Command Execution Date : 02/10/2015 Author : R-73eN Tested on : Windows 7 Ultimate Vulnerable Versions : Winrar 5.30 beta 4 The vulnerability exists in the "Import Settings From File" function. Since Settings file of Winrar are saved as a registr...

WinRar 5.30 Beta 4 - Settings Import Command Execution

WinRar 5.30 Beta 4 - Settings Import Command Execution !/usr/bin/python -w Title : WinRar Settings Import Command Execution Date : 02/10/2015 Author : R-73eN Tested on : Windows 7 Ultimate Vulnerable Versions : Winrar 5.30 beta 4 The vulnerability exists in the "Import Settings From File" functio...

WinRar < 5.30 Beta 4 - Settings Import Command Execution

!/usr/bin/python -w Title : WinRar Settings Import Command Execution Date : 02/10/2015 Author : R-73eN Tested on : Windows 7 Ultimate Vulnerable Versions : Winrar 5.30 beta 4 The vulnerability exists in the "Import Settings From File" function. Since Settings file of Winrar are saved as a registr...

Cisco AnyConnect Secure Mobility Client for Windows Privilege Escalation Vulnerability

A vulnerability in Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to execute an arbitrary executable file with privileges equivalent to the Microsoft Windows operating system SYSTEM account. The vulnerability is due to lack of checks in the code f...