CVE-2017-15913

The CVE-2017-15913 entry concerns Whale’s Installer, where the Installer module is susceptible to DLL hijacking. The affected component is the Whale Installer, and the root cause is a DLL search-order hijack during installation. According to NVD, the CVSS3 base score is 7.8 ( HIGH ) with LOCAL at...

CVE-2017-15913: Untrusted Search Path

The Installer in Whale allows DLL hijacking...

PT-2018-6028

Name of the Vulnerable Software and Affected Versions: Whale affected versions not specified Description: The issue in Whale allows for DLL hijacking through its Installer. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability...

January 3, 2018—KB4056899 (Security-only update)

None None...

Fortinet Installer Client 5.6 DLL Hijacking

Affected Product: Fortinet Installer Client 5.6 for Windows PC Credit: Souhardya Sardar and Rohit Bankoti Contact : github.com/Souhardya Summary: Fortinet Installer contains a privilege escalation vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary code on the...

Cambium ePMP1000 - 'get_chart' Shell via Command Injection (Metasploit)

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule "Cambium ePMP1000 'getchart' Shell via Command Injection v3.1-3.5-RC7", 'Description' = % This module exploits an OS Command Injection vulnerabilit...

MGASA-2017-0482 Updated ruby-RubyGems packages fix security vulnerabilities

An ANSI escape sequence vulnerability CVE-2017-0899. A DoS vulnerability in the query command CVE-2017-0900. A vulnerability in the gem installer that allowed a malicious gem to overwrite arbitrary files CVE-2017-0901. A DNS request hijacking vulnerability CVE-2017-0902. An unsafe object...

Cambium ePMP1000 2.5 ping Shell via Command Injection Exploit

This Metasploit module exploits an OS Command Injection vulnerability in Cambium ePMP1000 device management portal. It requires any one of the following login credentials - admin/admin, installer/installer, home/home - to set up a reverse netcat shell. This module requires Metasploit:...

The installer of Music Center for PC may insecurely load Dynamic Link Libraries

Overview Music Center for PC provided by Sony Video & Sound Products Inc. is a file management tool. The installer of Music Center for PC contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries CWE-427. Note that this vulnerability is different from...

The installer of Content Manager Assistant for PlayStation may insecurely load Dynamic Link Libraries

Overview Content Manager Assistant for PlayStation provided by Sony Interactive Entertainment Inc. is a data transfer tool. The installer of Content Manager Assistant for PlayStation contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries CWE-427...

JVN#60695371: The installer of Music Center for PC may insecurely load Dynamic Link Libraries

Music Center for PC provided by Sony Video & Sound Products Inc. is a file management tool. The installer of Music Center for PC contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries CWE-427. Impact Arbitrary code may be executed with the privileg...

JVN#95423049: The installer of Content Manager Assistant for PlayStation may insecurely load Dynamic Link Libraries

Content Manager Assistant for PlayStation provided by Sony Interactive Entertainment Inc. is a data transfer tool. The installer of Content Manager Assistant for PlayStation contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries CWE-427. Impact...

PT-2017-16422

Name of the Vulnerable Software and Affected Versions Cambium Networks ePMP firmware versions prior to 3.5 Description The issue allows non-administrative users, specifically 'installer' and 'home', to change passwords for other accounts, including administrative ones, by bypassing a client-side...

CVE-2017-5254: Improper Access Control

In version 3.5 and prior of Cambium Networks ePMP firmware, the non-administrative users 'installer' and 'home' have the capability of changing passwords for other accounts, including admin, after disabling a client-side protection mechanism...

Mobile Menace Monday: upping the ante on Adups

Adups is back on our radar. The same China-based company caught collecting an abundance of user data and creating a backdoor on mobile devices in 2016 has another malicious card to throw down. This time, it's an auto installer we detect as Android/PUP.Riskware.Autoins.Fota. We thought they cleane...

Fedora Update for fedora-arm-installer FEDORA-2017-0e4021062c

The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora Update for fedora-arm-installer FEDORA-2017-62f44716bb

The remote host is missing an update for the SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fedora 26 : fedora-arm-installer (2017-0e4021062c)

Update to 2.1 ---- Update to 2.0, Initial support for aarch64 images and associated SBCs Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible...

Fedora 25 : fedora-arm-installer (2017-62f44716bb)

Update to 2.1 ---- Update to 2.0, Initial support for aarch64 images and associated SBCs Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and format it as much as possible...

[SECURITY] Fedora 26 Update: fedora-arm-installer-2.1-1.fc26

Allows one to first select a source image local or remote. The image must be a binary file containing: MBR + Partitions + File Systems + Data. A destination block device should then be selected for final installation...