CVE-2017-13676

Norton Remove & Reinstall can be susceptible to a DLL preloading vulnerability. These types of issues occur when an application looks to call a DLL for execution and an attacker provides a malicious DLL to use instead. Depending on how the application is configured, it will generally follow a...

CVE-2017-10860

CVE-2017-10860 affects i-filter 6.0 installer/installer components from Digital Arts. The issue is an untrusted search path vulnerability in the installer’s code signing timestamp (before 23 Aug 2017 JST) that can allow arbitrary code execution via a specially crafted executable in an unspecified...

CVE-2017-10859

CVE-2017-10859 corresponds to an untrusted search path vulnerability in Digital Arts’ i-filter 6.0 installer. The code-signing timestamp before 23 Aug 2017 (JST) enables privilege escalation via a Trojan DLL located in an unspecified directory, potentially allowing arbitrary code execution with t...

CVE-2017-10849

CVE-2017-10849 affects DocuWorks self-extracting documents generated by DocuWorks 8.0.7 and earlier. The underlying issue is an untrusted DLL search path that can allow a Trojan horse DLL placed in an unspecified directory to be loaded, enabling privilege escalation. The vulnerability is tied to ...

CVE-2017-10848

DocuWorks and DocuWorks Viewer Light are affected by an untrusted search path vulnerability (CWE-427) in Installers for DocuWorks 8.0.7 and earlier and DocuWorks Viewer Light vices published in July 2017 and earlier. An attacker could gain privilege escalation by placing a Trojan horse DLL in an ...

CVE-2017-10850

Untrusted search path vulnerability in Installers of ART EX Driver for ApeosPort-VI C7771/C6671/C5571/C4471/C3371/C2271, DocuCentre-VI C7771/C6671/C5571/C4471/C3371/C2271 Timestamp of code signing is before 12 Apr 2017 02:04 UTC., PostScript? Driver + Additional Feature Plug-in + PPD File for...

CVE-2017-10828

Untrusted search path vulnerability in Flets Install Tool all versions distributed through the website till 2017 August 8 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory...

Design/Logic Flaw

An unquoted service path vulnerability was identified in the driver for the ElanTech Touchpad, various versions, used on some Lenovo brand notebooks not ThinkPads. This could allow an attacker with local privileges to execute code with administrative privileges...

CVE-2017-10830

CVE-2017-10830 affects Security Setup Tool (all versions) from NTT West. The vulnerability is an untrusted search path (DLL search order) that allows a local attacker to gain privileges via a Trojan horse DLL placed in an unspecified directory. Documented impact indicates the potential for arbitr...

CVE-2017-10828

The CVE-2017-10828 issue affects Flets Install Tool installers distributed by NTT West. The root cause is an insecure DLL search path (untrusted search path) that can allow loading a Trojan/DLL, enabling arbitrary code execution with the caller’s privileges when running the installer. Affected ve...

CVE-2017-10836

CVE-2017-10836 affects Optimal Guard (OPTiM) installers—versions 1.1.21 and earlier. The root cause is an untrusted/insecure DLL search path (CWE-427), allowing a Trojan horse DLL placed in a directory to be loaded and execute arbitrary code with the caller’s privileges. Documented impact: arbitr...

CVE-2015-0974

CVE-2015-0974 affects ZTE Datacard MF19 0V1.0.0B04 (mobiconnect). Root cause: untrusted search path allows a local attacker to cause privilege escalation by referencing a malicious DLL (mms_dll_r.dll or mediaplayerdll.dll) in the 'Ucell Internet' directory, yielding complete control. Public explo...

The installer of the Ministry of Justice [The electronic authentication system based on the commercial registration system "The CRCA user's Software"] may insecurely load Dynamic Link Libraries

Overview The electronic authentication system based on the commercial registration system "The CRCA user's Software" provided by the Ministry of Justice contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries CWE-427. DigiGnome and BlackWingCat of...

Design/Logic Flaw

Untrusted search path vulnerability in Installer for Shin Kikan Toukei Houkoku Data Nyuryokuyou Program program released on 2013 September 30 Distributed on the website until 2017 May 17 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory...

CVE-2017-10824

CVE-2017-10824 affects TDB CA TypeA use software (version 5.2 and earlier). The issue is an untrusted DLL search path, enabling arbitrary code execution via loading a Trojan horse DLL from an insecure directory, typically tied to the installer/self-extracting archive (CWE-427). Publications (CNVD...

CVE-2017-10823

CVE-2017-10823 affects the Installer of Shin Kinkyuji Houkoku Data Nyuryoku Program (released 2011-03-10; distributed until 2017-05-17). The root cause is an insecure DLL search path (CWE-427) that may allow a Trojan DLL to be loaded, enabling arbitrary code execution with the user’s privileges. ...

CVE-2017-10822

The CVE-2017-10822 entries describe an untrusted DLL search path vulnerability in the Installer of Shin Sekiyu Yunyu Chousa Houkoku Data Nyuryoku Program (released 2013-09-30; distribution until 2017-05-17). Root cause: insecure DLL loading (CWE-427) in the installer, allowing arbitrary code exec...

CVE-2017-2228

CVE-2017-2228 describes an untrusted search path vulnerability in Teikihoukokusho Sakuseishien Tool, specifically version 4.0. The issue allows a local attacker to gain privileges by placing a Trojan horse DLL in a directory searched by the tool, enabling arbitrary code execution with the user’s ...

Teikihoukokusho Sakuseishien Tool may insecurely load Dynamic Link Libraries

Overview Teikihoukokusho Sakuseishien Tool provided by Agency for Natural Resources and Energy of METI contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries CWE-427. The tool is provided as a ZIP archive. It is assumed that a user extracts the too...

CVE-2017-3751

An unquoted service path vulnerability was identified in the driver for the ThinkPad Compact USB Keyboard with TrackPoint versions earlier than 1.5.5.0. This could allow an attacker with local privileges to execute code with administrative privileges...