Bandizip不安全库加载漏洞

CVECAN ID: CVE-2014-1680 Bandizip是免费的轻量级Zip压缩软件。 Bandisoft Bandizip 3.10之前版本加载库（例如dwmapi.dll的方式不安全，攻击者通过诱使用户打开远程WebDAV或SMB共享上的文件，利用此漏洞可加载任意库。 0 bandisoft Bandizip 3.08 厂商补丁： bandisoft --------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： http://www.bandisoft.com/bandizip/history/ / Exploit Title: Bandizip...

CVE-2014-1680

CVE-2014-1680 affects Bandizip (Bandisoft) prior to version 3.10. The vulnerability is a DLL hijacking/unsafe library loading issue where an attacker can place a dwmapi.dll in the current working directory, enabling local privilege escalation. The root cause is untrusted search path loading of an...

Bandizip 3.09 DLL Hijack

/ Exploit Title: Bandizip 3.09 DLL Hijacking Exploit dwmapi.dll Date: February 5th 2014 Author: Osanda Malith Jayathissa E-Mail: osandajayathissagmail.com Version: 3.09 Vendor Homepage: http://www.bandisoft.com/ Tested on: Windows XP SP2 en Vulnerable extensions: All Extensions CVE: CVE-2014-1680...