CVE-2018-0656

The CVE-2018-0656 entry concerns the Digital Paper App installer (v1.4.0.16050 and earlier). A DLL search-path vulnerability (untrusted search path) exists in the installer, allowing privilege elevation by placing a Trojan horse DLL in an unspecified directory. Affected component: the installer f...

CVE-2018-0619

Untrusted search path vulnerability in the installer of Glarysoft Glary Utilities Glary Utilities 5.99 and earlier and Glary Utilities Pro 5.99 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory...

CVE-2018-0621

CVE-2018-0621 affects LOGICOOL CONNECTION UTILITY SOFTWARE prior to 2.30.9. The issue is an untrusted search path (CWE-427) that can enable privilege escalation via a malicious DLL in an unspecified directory. CNVD-2019-19054 confirms the vulnerable versions and impact; JVN entries corroborate th...

beep External Control Filename Path Vulnerability Vulnerability

beep is a command line tool for controlling the sound of speakers on Linux. A security vulnerability exists in the --device option in beep 1.3 and later versions. A local attacker can exploit this vulnerability to prohibit other users from executing arbitrary programs...

Microsoft OneDrive untrustworthy search path vulnerability

Microsoft OneDrive is a cloud backup application from Microsoft USA. The program features automatic backup of photo albums, online office and file sharing. An untrustworthy search path vulnerability exists in Microsoft OneDrive. An attacker can exploit this vulnerability with a malicious DLL in t...

CVE-2018-1000532

beep version 1.3 and up contains a External Control of File Name or Path vulnerability in --device option that can result in Local unprivileged user can inhibit execution of arbitrary programs by other users, allowing DoS. This attack appear to be exploitable via The system must allow local users...

Design/Logic Flaw

Untrusted search path vulnerability in the installer of Visual Studio Code allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory...

Design/Logic Flaw

Untrusted search path vulnerability in the installer of Visual Studio Community allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory...

CVE-2018-0594

CVE-2018-0594 describes an untrusted search path (DLL planting) vulnerability in Skype for Windows. The issue allows privilege escalation via a Trojan horse DLL placed in the same directory as the Skype executable. Affected product: Skype for Windows. Root cause: insecure DLL search path (CWE-427...

CVE-2018-0593

The CVE-2018-0593 entry affects the Microsoft OneDrive installer, which has an untrusted search path vulnerability (DLL planting) that can allow privilege escalation by placing a Trojan DLL in the installer’s directory. Root cause: insecure DLL search order in the installer. Impact described: arb...

CVE-2018-0598

The CVE-2018-0598 issue concerns self-extracting archive files created by IExpress bundled with Microsoft Windows. Affected component is the IExpress self-extracting archive mechanism, where an untrusted search path can lead to DLL planting and privilege escalation by loading a Trojan horse DLL f...

CVE-2018-12533

JBoss RichFaces 3.1.0 through 3.3.4 allows unauthenticated remote attackers to inject expression language EL expressions and execute arbitrary Java code via a /DATA/ substring in a path with an org.richfaces.renderkit.html.Paint2DResource$ImageData object, aka RF-14310...

CVE-2018-7495

In Advantech WebAccess versions V8.220170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada Node versions prior to 8.3.1, and WebAccess/NMS 2.0.3 and prior, an external control of file name or path vulnerability has been identified...

CVE-2018-0561

CVE-2018-0561 affects the SecureBrain PhishWall Client Internet Explorer edition installer (version 3.7.15 and earlier). The issue is an untrusted search path (CWE-427) in the installer that can be exploited to gain privileges via a Trojan horse DLL placed in an unsafe directory. Exploitation wou...

CVE-2018-2406

CVE-2018-2406 affects SAP Crystal Reports Server OEM Edition (CRSE) startup path: unquoted Windows search path leads to local directory/path traversal. Versions 4.0, 4.10, 4.20, 4.30 are affected; local privilege elevation is indicated in connected CNVD entry. The vulnerability’s CVSS notes local...

idreamsoft iCMS Physical Path Disclosure Vulnerability

iCMS is an efficient and simple content management system built with PHP and MySQL. A physical path leak vulnerability exists in idreamsoft iCMS version 7.0.7 and lower. An attacker can obtain the physical path by displaying an invalid nickname field in the core/library/weixin.class.php pathname...

Microsoft Windows Unquoted Path Vulnerability (SMB Login)

The script tries to detect Windows SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only include"pluginfeedinfo.inc"; ifdescription...

CVE-2018-0540

Untrusted search path vulnerability in ViX version 2.21.148.0 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory...

CVE-2018-0540

CVE-2018-0540 affects ViX 2.21.148.0, with an untrusted search path vulnerability that can allow privilege escalation by a Trojan horse DLL located in an unspecified directory (CWE-427). Public sources (JPN/JVN records and CNVD) describe the issue as insecure DLL loading in ViX, potentially enabl...

Arbitrary File Editing Vulnerability in SDCMS Version v3.3

SDCMS is a PHP 3-in-1 website management system independently developed by Fireworks Network. SDCMS v3.3 version of the existence of arbitrary file editing vulnerability, the vulnerability stems from the file path to modify the file and the content of the file to be written into the file are not...