CVE-2017-0317: Incorrect Permission Assignment for Critical Resource

All versions of NVIDIA GPU and GeForce Experience installer contain a vulnerability where it fails to set proper permissions on the package extraction path thus allowing a non-privileged user to tamper with the extracted files, potentially leading to escalation of privileges via code execution...

PT-2017-10520

Name of the Vulnerable Software and Affected Versions NVIDIA GPU and GeForce Experience installer affected versions not specified Description The issue is related to a failure in setting proper permissions on the package extraction path, allowing a non-privileged user to tamper with the extracted...

PuTTY DLL Hijacking Vulnerability - Windows

PuTTY is prone to a dll hijacking vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:putty:putty"; ifdescription...

CVE-2016-5934

CVE-2016-5934 = IBM Tivoli Storage Manager FastBack installer DLL hijacking vulnerability. A specially-crafted DLL placed in the victim’s path could be loaded when the installer runs, allowing an unauthenticated attacker with local access to execute arbitrary code with the victim’s privileges. CV...

SumatraPDF 3.1.2 DLL Hijacking

Hi @ll, the executable installer deg and the "portable" version of SumatraPDF 3.1.2 available from are vulnerable to DLL hijacking ': The executable installers SumatraPDF-3.1.2-install.exe and SumatraPDF-3.1.2-64-install.exe load and execute tested on a fully patched Windows 7 SP1 at least...

CVE-2016-5934: Undefined Security Weakness

IBM Tivoli Storage Manager FastBack installer could allow a remote attacker to execute arbitrary code on the system. By placing a specially-crafted DLL in the victim's path, an attacker could exploit this vulnerability when the installer is executed to run arbitrary code on the system with...

PT-2017-8818

Name of the Vulnerable Software and Affected Versions IBM Tivoli Storage Manager FastBack affected versions not specified Description The issue allows a remote attacker to execute arbitrary code on the system. This can be achieved by placing a specially-crafted DLL in the victim's path. When the...

February 7, 2017, update for Office 2016 (KB3114389)

None None...

CVE-2017-5630

PECL in the download utility class in the Installer in PEAR Base System v1.10.1 does not validate file types and filenames after a redirect, which allows remote HTTP servers to overwrite files via crafted responses, as demonstrated by a .htaccess overwrite...

CVE-2017-5630

PECL in the download utility class in the Installer in PEAR Base System v1.10.1 does not validate file types and filenames after a redirect, which allows remote HTTP servers to overwrite files via crafted responses, as demonstrated by a .htaccess overwrite...

CVE-2017-5630

PECL in the download utility class in the Installer in PEAR Base System v1.10.1 does not validate file types and filenames after a redirect, which allows remote HTTP servers to overwrite files via crafted responses, as demonstrated by a .htaccess overwrite...

CVE-2017-5630

CVE-2017-5630 affects PEAR Base System v1.10.1; PECL in the Installer’s download utility does not validate file types/filenames after redirects, allowing remote HTTP servers to overwrite files via crafted responses (e.g., .htaccess). Documented impact is file overwrite; no patch/remediation detai...

CVE-2017-5630

PECL in the download utility class in the Installer in PEAR Base System v1.10.1 does not validate file types and filenames after a redirect, which allows remote HTTP servers to overwrite files via crafted responses, as demonstrated by a .htaccess overwrite...

CVE-2017-5630

PECL in the download utility class in the Installer in PEAR Base System v1.10.1 does not validate file types and filenames after a redirect, which allows remote HTTP servers to overwrite files via crafted responses, as demonstrated by a .htaccess overwrite. Note: Version 1.10.1 reflects the versi...

CVE-2017-5630: Improper Neutralization of Special Elements in Output Used by a Downstream Component

PECL in the download utility class in the Installer in PEAR Base System v1.10.1 does not validate file types and filenames after a redirect, which allows remote HTTP servers to overwrite files via crafted responses, as demonstrated by a .htaccess overwrite...

Design/Logic Flaw

Untrusted search path vulnerability in the installer for TrueCrypt 7.2 and 7.1a, VeraCrypt before 1.17-BETA, and possibly other products allows local users to execute arbitrary code with administrator privileges and conduct DLL hijacking attacks via a Trojan horse DLL in the "application...

CVE-2016-1281

The CVE-2016-1281 entry describes an untrusted search path/DLL hijacking vulnerability in installers for TrueCrypt 7.2 and 7.1a , and VeraCrypt before 1.17-BETA (and possibly other products). The issue allows local users to execute arbitrary code with administrator privileges by placing a Trojan ...

CVE-2017-5490

Cross-site scripting XSS vulnerability in the theme-name fallback functionality in wp-includes/class-wp-theme.php in WordPress before 4.7.1 allows remote attackers to inject arbitrary web script or HTML via a crafted directory name of a theme, related to...

UBUNTU-CVE-2017-5490

Cross-site scripting XSS vulnerability in the theme-name fallback functionality in wp-includes/class-wp-theme.php in WordPress before 4.7.1 allows remote attackers to inject arbitrary web script or HTML via a crafted directory name of a theme, related to...

CVE-2017-5490

Cross-site scripting XSS vulnerability in the theme-name fallback functionality in wp-includes/class-wp-theme.php in WordPress before 4.7.1 allows remote attackers to inject arbitrary web script or HTML via a crafted directory name of a theme, related to...