Arbitrary Code Execution

squirrel.windows is vulnerable to arbitrary code execution. The vulnerability exists because the MitigateDllHijacking function of winmain.cpp insecurely loads the dynamic link libraries dll, allowing an attacker to inject and execute malicious code...

JVN#29902403: Installers generated by Squirrel.Windows may insecurely load Dynamic Link Libraries

Squirrel.Windows is both a toolset and a library that provides installation and update functionality for Windows desktop applications. Installers generated by Squirrel.Windows contain an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries CWE-427. Impact...

PT-2022-26842 · Foxit · Foxit Reader

Name of the Vulnerable Software and Affected Versions: Foxit Reader version 11.2.118.51569 Description: The issue allows attackers to escalate privileges when searching for DLL libraries without specifying an absolute path. This is due to an uncontrolled search path element in Foxit Software's...

Installer of Ricoh Device Software Manager may insecurely load Dynamic Link Libraries

Overview Installer of Device Software Manager provided by RICOH COMPANY, LTD. contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries CWE-427. Tomohisa Hasegawa of Canon IT Solutions Inc. reported this vulnerability to IPA. JPCERT/CC coordinated wit...

RealNetworks Real Player 安全漏洞

RealNetworks Real Player is a cross-platform player from RealNetworks, Inc. for enjoying a wide variety of online audio and video material. A security vulnerability exists in RealNetworks Real Player version 20.1.0.312 and earlier versions, which can be exploited by an attacker to execute arbitra...

Installer of Trend Micro HouseCall for Home Networks may insecurely load Dynamic Link Libraries

Overview Trend Micro Incorporated has released a security update for HouseCall for Home Networks. Trend Micro Incorporated reported this vulnerability to JPCERT/CC to notify users of the solution through JVN. Impact Installer of Trend Micro HouseCall for Home Networks contains an issue with the D...

JVN#60037444: Installer of Trend Micro Password Manager may insecurely load Dynamic Link Libraries

Installer of Trend Micro Password Manager provided by Trend Micro Incorporated contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries CWE-427. Impact Arbitrary code may be executed with the privilege of the user invoking the installer. Solution Use...

AttacheCase may insecurely load Dynamic Link Libraries

Overview AttacheCase may insecurely load Dynamic Link Libraries. AttacheCase is an open source file encryption software provided by HiBARA Software. AttacheCase contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries CWE-427. Taizoh Tsukamoto of...

Installer of Trend Micro Password Manager may insecurely load Dynamic Link Libraries

Overview Trend Micro Incorporated has released a security update for Trend Micro Password Manager. Trend Micro Incorporated reported this vulnerability to JPCERT/CC to notify users of the solution through JVN. Impact A local attacker may obtain the administrative privilege when the product's...

McAfee TechCheck Code Issues Vulnerabilities

McAfee TechCheck is a software from McAfee USA to keep your computer running smoothly. It is used to diagnose machine problems. A code issue vulnerability exists in versions prior to McAfee TechCheck 4.0.0.2 that allows local administrators to load their own Dynamic Link Library DLL to gain...

CVE-2021-40161

A Memory Corruption vulnerability may lead to code execution through maliciously crafted DLL files through PDFTron earlier than 9.0.7 version...

The vulnerability of the McAfee Agent antivirus software, related to deficiencies in the mechanism for calling system libraries, allows an attacker to execute a preliminary loading attack of DLLs.

The vulnerability of the McAfee Agent antivirus software is related to deficiencies in the mechanism for calling system libraries. Exploiting this vulnerability allows an attacker to execute a preloading attack involving DLLs...

PT-2021-15549

Name of the Vulnerable Software and Affected Versions ajaxpro.2 versions prior to 21.11.29.1 Description This issue involves the deserialization of untrusted data, which occurs when an application deserializes data without sufficient verification, allowing an attacker to control the execution flo...

Nextar C472 POS DLL Hijacking

/ Description: A vulnerability exists in windows that allows other applications dynamic link libraries to execute malicious code without the users consent, in the privelage context of the targeted application. Exploit Title: Nextar C472 POS DLL Hijacking Exploit nxmm.dll - mdmdregistration.dll...

Exploit for CVE-2021-1678

PoC exploit for CVE-2021-1678, an arbitrary code execution vulnerability in the Windows Print Spooler service. The exploit is contained within a Docker container, which can be built and run using the provided Dockerfile. The container includes a Python script, spoolsploit.py, that can be used to...

The vulnerability of the 3D design review package Autodesk Navisworks lies in its ability to record outside the field, allowing a hacker to execute code by loading arbitrary DLL files.

The vulnerability of the 3D design review package Autodesk Navisworks relates to the ability to write code outside the specified field. Exploiting this vulnerability could allow an attacker to execute code by loading arbitrary DLL files...

The vulnerability of the ColdFusion software platform, related to incorrect handling of the path to libraries’ DLL files, allows attackers to escalate their privileges.

The vulnerability of the ColdFusion software platform is related to incorrect handling of the path for accessing DLL libraries. Exploiting this vulnerability can allow an attacker to increase their privileges...

JVN#80288258: The installers of multiple Sony products may insecurely load Dynamic Link Libraries

The installers of multiple Sony products contain an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries CWE-427. Impact Arbitrary code may be executed with the privilege of the user invoking the installer. Solution Use the latest installer by following the...

The vulnerability of VMware ThinApp, a virtualization and portable application creation tool, lies in the insecure loading of DLL libraries, which allows attackers to escalate their privileges.

The vulnerability of VMware ThinApp’s virtualization and portable application creation tools relates to the insecure loading of DLL libraries. Exploiting this vulnerability can allow attackers to gain increased privileges...

CVE-2021-31840 DLL preload vulnerability in McAfee Agent for Windows

A vulnerability in the preloading mechanism of specific dynamic link libraries in McAfee Agent for Windows prior to 5.7.3 could allow an authenticated, local attacker to perform a DLL preloading attack with unsigned DLLs. To exploit this vulnerability, the attacker would need to have valid...