CVE-2015-0974

CVE-2015-0974 affects ZTE Datacard MF19 0V1.0.0B04 (mobiconnect). Root cause: untrusted search path allows a local attacker to cause privilege escalation by referencing a malicious DLL (mms_dll_r.dll or mediaplayerdll.dll) in the 'Ucell Internet' directory, yielding complete control. Public explo...

The installer of the Ministry of Justice [The electronic authentication system based on the commercial registration system "The CRCA user's Software"] may insecurely load Dynamic Link Libraries

Overview The electronic authentication system based on the commercial registration system "The CRCA user's Software" provided by the Ministry of Justice contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries CWE-427. DigiGnome and BlackWingCat of...

CVE-2017-2228

CVE-2017-2228 describes an untrusted search path vulnerability in Teikihoukokusho Sakuseishien Tool, specifically version 4.0. The issue allows a local attacker to gain privileges by placing a Trojan horse DLL in a directory searched by the tool, enabling arbitrary code execution with the user’s ...

CVE-2017-10823

CVE-2017-10823 affects the Installer of Shin Kinkyuji Houkoku Data Nyuryoku Program (released 2011-03-10; distributed until 2017-05-17). The root cause is an insecure DLL search path (CWE-427) that may allow a Trojan DLL to be loaded, enabling arbitrary code execution with the user’s privileges. ...

CVE-2017-10822

The CVE-2017-10822 entries describe an untrusted DLL search path vulnerability in the Installer of Shin Sekiyu Yunyu Chousa Houkoku Data Nyuryoku Program (released 2013-09-30; distribution until 2017-05-17). Root cause: insecure DLL loading (CWE-427) in the installer, allowing arbitrary code exec...

CVE-2017-10824

CVE-2017-10824 affects TDB CA TypeA use software (version 5.2 and earlier). The issue is an untrusted DLL search path, enabling arbitrary code execution via loading a Trojan horse DLL from an insecure directory, typically tied to the installer/self-extracting archive (CWE-427). Publications (CNVD...

Teikihoukokusho Sakuseishien Tool may insecurely load Dynamic Link Libraries

Overview Teikihoukokusho Sakuseishien Tool provided by Agency for Natural Resources and Energy of METI contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries CWE-427. The tool is provided as a ZIP archive. It is assumed that a user extracts the too...

CVE-2017-2221

CVE-2017-2221 affects Baidu IME Installer (versions 3.6.1.6 and earlier). The vulnerability is an untrusted DLL search path that may allow arbitrary code execution with the privileges of the user invoking the installer when a malicious DLL is present in an unspecified directory. Documented impact...

CVE-2017-10820

The CVE-2017-10820 issue affects IP Messenger for Win 4.60 and earlier, where the installer contains an untrusted DLL search path vulnerability (CWE-427). This can allow a Trojan horse DLL placed in an untrusted directory to be loaded, enabling arbitrary code execution with the privileges of the ...

CVE-2017-2279

Untrusted search path vulnerability in Tween Ver1.6.6.0 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory...

CVE-2017-2286

CVE-2017-2286 affects Sony PaSoRi/NFC Port Software and related utilities (e.g., NFC Port Software 5.5.0.6 and earlier; 5.3.6.7 and earlier; PC/SC Activator for Type B 1.2.1.0 and earlier; SFCard Viewer; NFC Net Installer). The vulnerability is an untrusted search path that allows an attacker to ...

CVE-2017-2272

AttacheCase self-extracting encrypted files are affected by an untrusted DLL search path (CWE-427) vulnerability. Versions up to 3.2.2.6 are vulnerable; exploitation allows arbitrary code execution via a Trojan DLL loaded from an untrusted directory. Affected products include AttacheCase with CVE...

CVE-2017-2269

The CVE-2017-2269 issue affects FileCapsule Deluxe Portable Ver.2.0.9 and earlier, described as an untrusted search path vulnerability where a Trojan DLL in an unspecified directory can be loaded to gain privileges. Multiple connected sources indicate this could allow arbitrary code execution wit...

CVE-2017-2246

The CVE-2017-2246 entry concerns Lhaz Installer (version 2.4.0 and earlier). The vulnerability is an untrusted search path that allows an attacker to gain privileges by placing a Trojan DLL in an unspecified directory, enabling arbitrary code execution with the invoking user’s privileges via the ...

CVE-2017-2266

CVE-2017-2266 concerns FileCapsule Deluxe Portable and its Encrypted Files in Self-Decryption Format. The vulnerability is an untrusted search path that could allow arbitrary code execution via a Trojan horse DLL loaded from an unspecified directory, with impact as described in the CVE records. A...

Design/Logic Flaw

Untrusted search path vulnerability in Installer of CASL II simulator self-extract format allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory...

Design/Logic Flaw

Untrusted search path vulnerability in Installer of Shinseiyo Sogo Soft 4.8A and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory...

CVE-2017-2229

CVE-2017-2229: Untrusted search path vulnerability in Douroshisetu Kihon Data Sakusei System Ver1.0.2 and earlier allows privilege escalation via a Trojan horse DLL in an untrusted directory. Root cause: insecure DLL search path (CWE-427) related to the installer/load process. Affected product: D...

CVE-2017-2208

CVE-2017-2208 is an untrusted search path vulnerability in the Installer of the Electronic tendering and bid opening system (available before 12 June 2017). The root cause is an insecure search path that allows a specially crafted executable in an unspecified directory to be executed, enabling ar...

PT-2017-15274

Name of the Vulnerable Software and Affected Versions EbidSettingChecker.exe version 1.0.0.0 Description The issue allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory due to an untrusted search path vulnerability. Recommendations For version 1.0.0.0, consider...