CVE-2020-5980

CVE-2020-5980 affects NVIDIA Windows GPU Display Driver. The vulnerability is described as a securely loaded system DLL loading its dependencies in an insecure fashion, potentially enabling code execution or denial of service. NVIDIA’s bulletin and security updates indicate fixes across Windows d...

Security Bulletin: Improper DLL loading vulnerability affecting Aspera Connect 3.9.9 and earlier

Summary IBM Aspera Connect could allow a local attacker to execute arbitrary code on the Windows system, caused by improper loading of Dynamic Link Libraries by the import feature. By persuading a victim to open a specially-crafted .DLL file, an attacker could exploit this vulnerability to execut...

CVE-2020-4545

IBM Aspera Connect 3.9.9 could allow a remote attacker to execute arbitrary code on the system, caused by improper loading of Dynamic Link Libraries by the import feature. By persuading a victim to open a specially-crafted .DLL file, an attacker could exploit this vulnerability to execute arbitra...

CVE-2020-24972

The Kleopatra component before 3.1.12 and before 20.07.80 for GnuPG allows remote attackers to execute arbitrary code because openpgp4fpr: URLs are supported without safe handling of command-line options. The Qt platformpluginpath command-line option can be used to load an arbitrary DLL...

Command injection

The Kleopatra component before 3.1.12 and before 20.07.80 for GnuPG allows remote attackers to execute arbitrary code because openpgp4fpr: URLs are supported without safe handling of command-line options. The Qt platformpluginpath command-line option can be used to load an arbitrary DLL...

CVE-2020-24972

The Kleopatra component before 3.1.12 and before 20.07.80 for GnuPG allows remote attackers to execute arbitrary code because openpgp4fpr: URLs are supported without safe handling of command-line options. The Qt platformpluginpath command-line option can be used to load an arbitrary DLL...

CVE-2020-9767

A vulnerability related to Dynamic-link Library “DLL” loading in the Zoom Sharing Service would allow an attacker who had local access to a machine on which the service was running with elevated privileges to elevate their system privileges as well through use of a malicious DLL. Zoom addressed...

Sql injection

A vulnerability related to Dynamic-link Library “DLL” loading in the Zoom Sharing Service would allow an attacker who had local access to a machine on which the service was running with elevated privileges to elevate their system privileges as well through use of a malicious DLL. Zoom addressed...

CVE-2020-9767

CVE-2020-9767 affects Zoom for Windows, involving a DLL-loading vulnerability in the Zoom Sharing Service that could allow a locally authenticated attacker with elevated privileges to run arbitrary code via a malicious DLL. Zoom addressed this in Zoom client 5.0.4 (Windows). As per sources, the i...

CVE-2020-9767

A vulnerability related to Dynamic-link Library “DLL” loading in the Zoom Sharing Service would allow an attacker who had local access to a machine on which the service was running with elevated privileges to elevate their system privileges as well through use of a malicious DLL. Zoom addressed...

CVE-2020-9767: Uncontrolled Search Path Element

A vulnerability related to Dynamic-link Library “DLL” loading in the Zoom Sharing Service would allow an attacker who had local access to a machine on which the service was running with elevated privileges to elevate their system privileges as well through use of a malicious DLL. Zoom addressed...

PT-2020-20744

Name of the Vulnerable Software and Affected Versions Zoom versions prior to 5.0.4 Description A issue related to Dynamic-link Library “DLL” loading in the Zoom Sharing Service allows an attacker with local access and elevated privileges to elevate system privileges using a malicious DLL. This...

CVE-2020-15657

Firefox could be made to load attacker-supplied DLL files from the installation directory. This required an attacker that is already capable of placing files in the installation directory. Note: This issue only affected Windows operating systems. Other operating systems are unaffected.. This...

CVE-2020-15657

Firefox could be made to load attacker-supplied DLL files from the installation directory. This required an attacker that is already capable of placing files in the installation directory. Note: This issue only affected Windows operating systems. Other operating systems are unaffected.. This...

Python DLL Loading Local Privilege Escalation

The version of Python installed on the remote Windows host is 3.6.x prior to 3.6.12, 3.7.x prior to 3.7.9, 3.8.x prior to 3.8.4, or 3.9.x prior to 3.9.0b5. It is, therefore, affected by an elevation of privilege vulnerability. A Trojan horse python3.dll might be used in cases where CPython is...

Security Vulnerabilities fixed in Firefox ESR 78.1 — Mozilla

By observing the stack trace for JavaScript errors in web workers, it was possible to leak the result of a cross-origin redirect. This applied only to content that can be parsed as script. WebRTC used the memory address of a class instance as a connection identifier. Unfortunately, this value is...

Security Vulnerabilities fixed in Thunderbird 78.1 — Mozilla

By observing the stack trace for JavaScript errors in web workers, it was possible to leak the result of a cross-origin redirect. This applied only to content that can be parsed as script. WebRTC used the memory address of a class instance as a connection identifier. Unfortunately, this value is...

PT-2020-14573

Name of the Vulnerable Software and Affected Versions Firefox versions prior to 79 Firefox ESR versions prior to 78.1 Thunderbird versions prior to 78.1 Description The issue allows an attacker to load attacker-supplied DLL files from the installation directory, but this requires the attacker to...

PT-2020-14526

Name of the Vulnerable Software and Affected Versions Trend Micro Secuity 2020 versions 16.0.0.1146 and below Description An untrusted search path remote code execution issue could allow an attacker to run arbitrary code on a vulnerable system. The Trend Micro installer tries to load DLL files fr...

CVE-2020-15602: Untrusted Search Path

An untrusted search path remote code execution RCE vulnerability in the Trend Micro Secuity 2020 v16.0.0.1146 and below consumer family of products could allow an attacker to run arbitrary code on a vulnerable system. As the Trend Micro installer tries to load DLL files from its current directory...