7 matches found
Microsoft Windows Unsafe Handling Practices
Hi @ll, This multi-part post can be read even without a MIME-compliant program! Back in 2014, I reported a vulnerability in CreateProcess's handling of .cmd and .bat files that Microsoft fixed with MS14-019 alias MSKB 2922229 and assigned CVE-2014-0315: command lines with a batch script as first...
CVE-2019-1010100
Akeo Consulting Rufus 3.0 and earlier is affected by: DLL search order hijacking. The impact is: Arbitrary code execution WITH escalation of privilege. The component is: Executable installers, portable executables ALL executables on the web site. The attack vector is: CAPEC-471, CWE-426, CWE-427...
CVE-2019-1010100
Akeo Consulting Rufus 3.0 and earlier is affected by: DLL search order hijacking. The impact is: Arbitrary code execution WITH escalation of privilege. The component is: Executable installers, portable executables ALL executables on the web site. The attack vector is: CAPEC-471, CWE-426, CWE-427...
Privilege escalation
Akeo Consulting Rufus 3.0 and earlier is affected by: DLL search order hijacking. The impact is: Arbitrary code execution WITH escalation of privilege. The component is: Executable installers, portable executables ALL executables on the web site. The attack vector is: CAPEC-471, CWE-426, CWE-427...
CVE-2019-1010100
Akeo Consulting Rufus 3.0 and earlier is affected by: DLL search order hijacking. The impact is: Arbitrary code execution WITH escalation of privilege. The component is: Executable installers, portable executables ALL executables on the web site. The attack vector is: CAPEC-471, CWE-426, CWE-427...
CVE-2019-1010100
CVE-2019-1010100 affects Akeo Consulting Rufus 3.0 and earlier. The vulnerability is DLL search order hijacking in executable installers/portable executables on the site. Root cause: DLL search order issue leading to Arbitrary code execution with escalation of privilege. Documented attack referen...
G-Data DLL Hijacking
Hi @ll, the executable installers of G-Data's "security" products for Windows, available from , allow escalation of privilege! The downloadable executables are self-extractors containing the real executable installer as resource: they create the subdirectory...