252 matches found
iscsicpl_bypassUAC
iscsicpl autoelevate DLL Search Order hijacking UAC Bypass 0day iscsicpl.exe バイナリには、SysWOW64 を介して 64bit ホスト上で 32bit の Microsoft バイナリを実行する際に、DLL 検索順序ハイジャックの脆弱性があります。32bit バイナリは、ユーザーの %Path% 内で iscsiexe.dll という DLL を検索します。これは、autoelevate が有効になっているため、Proxy DLL...
CVE-2024-0197-POC
CVE-2024-0197-POC Thales Sentinel HASP LDK におけるローカル特権昇格の概念実証です。 当初は自身で作成しようと考えていましたが、結局その必要はありませんでした。 競合状態を気にする必要はなく、既知の場所からの単純な DLL 検索順序ハイジャックで SYSTEM を獲得できます。 手順は以下の通りです: 1. raw.cpp を fltlib.dll としてコンパイルし、AppData\Local\Temp に配置します（C:\Windows\System32\fltlib.dll に至る適切なプロキシ DLL である必要があります）。 2...
DLLHSC
DLLHSC DLL Hijack SCanner - DLL 검색 순서 하이재킹 후보를 자동으로 발견하고 리드를 생성하는 도구 이 페이지의 목차 이 저장소의 내용 작동 모드 컴파일 및 실행 가이드 도움말 메뉴 실행 예시 피드백 이 저장소의 내용 이 저장소에는 도구DLLHSC의 Visual Studio 프로젝트 파일, API 후킹 기능detour의 프로젝트 파일, 페이로드의 프로젝트 파일, 그리고 x86 및 x64 아키텍처용으로 컴파일된 실행 파일이 저장소의 릴리스 섹션에 있음이 포함되어 있습니다. 코드는 Visual Studio...
DLL-Planting-Slack-4.33.73-CVE-2023-38820
DLL-プランティング-Slack-4.33.73-CVE-2023-38820 DLLプランティング in the Slack 4.33.73 - CVE-2023-38820 発見者: Idan Malihi 説明 Slack v.4.33.73の問題により、ローカルの攻撃者がprofapi.dll、CRYPTBASE.dll、KBDUS.DLL、DPAPI.dll、MSASN1.dll、mf.dll、mfplat.dll、RTWorkQ.DLLファイルのDLL読み込みメカニズムを介して任意のコードを実行できる可能性があります。 再現手順...
CVE-2026-9633
A security issue exists within the Redundancy Module Configuration Tool. The RM3ConfigTool.exe binary searches directories in the system path for a required DLL, and one or more of these directories may be writable by standard non-administrator users due to incorrect default permissions. If a loc...
CVE-2026-9634
CVE-2026-9634 affects Rockwell Automation's Redundancy Module Configuration Tool (RMConfigTool.exe). The binary searches system path directories for a required DLL, and one or more of these directories may be writable by standard (non-administrator) users due to incorrect default permissions. A l...
CVE-2026-9633
CVE-2026-9633 affects Rockwell Automation's Redundancy Module Configuration Tool . The RM3ConfigTool.exe binary searches directories in the system path for a required DLL, but due to incorrect default permissions , one or more of these directories may be writable by standard (non-administrator) u...
CVE-2026-9169: Uncontrolled Search Path Element
DLL Search Order Hijacking in LUCID Vision Labs Arena SDK 1.0.80.49 on Windows allows a local attacker to execute arbitrary code with the privileges of the application by placing a malicious DLL in a user-controlled directory listed in the PATH environment variable, which the SDK traverses when a...
CVE-2026-38972: Uncontrolled Search Path Element
Notepad3 through 6.25.822.1 contains a DLL search-order hijacking vulnerability in the About-dialog code path in src/Notepad3.c. The application calls LoadLibraryL"MSFTEDIT.DLL" with a bare DLL name, which allows a local attacker to place a malicious MSFTEDIT.DLL in the application directory or...
CVE-2026-22561: Uncontrolled Search Path Element
Uncontrolled search path elements in Anthropic Claude for Windows installer Claude Setup.exe versions prior to 1.1.3363 allow local privilege escalation via DLL search-order hijacking. The installer loads DLLs e.g., profapi.dll from its own directory after UAC elevation, enabling arbitrary code...
CVE-2026-4255: Inclusion of Functionality from Untrusted Control Sphere
A DLL search order hijacking vulnerability in Thermalright TR-VISION HOME on Windows 64-bit allows a local attacker to escalate privileges via DLL side-loading. The application loads certain dynamic-link library DLL dependencies using the default Windows search order, which includes directories...
CVE-2022-42945
DWG TrueViewTM 2023 version has a DLL Search Order Hijacking vulnerability. Successful exploitation by a malicious attacker could result in remote code execution on the target system...
CVE-2021-31853
DLL Search Order Hijacking Vulnerability in McAfee Drive Encryption MDE prior to 7.3.0 HF2 7.3.0.183 allows local users to execute arbitrary code and escalate privileges via execution from a compromised folder...
CVE-2023-53937: Uncontrolled Search Path Element
Hubstaff 1.6.14 contains a DLL search order hijacking vulnerability that allows attackers to replace a missing system32 wow64log.dll with a malicious library. Attackers can generate a custom DLL using Metasploit and place it in the system32 directory to obtain a reverse shell during application...
CVE-2025-34417: Uncontrolled Search Path Element
MailEnable versions prior to 10.54 contain an unsafe DLL loading vulnerability that can lead to local arbitrary code execution. The MailEnable administrative executable attempts to load MEAISO.DLL from its installation directory without sufficient integrity validation or a secure search order. A...
EUVD-2019-13281
Malware in sbrugna...
EUVD-2020-28439
Malware in sbrugna...
EUVD-2020-25870
Malware in sbrugna...