PlugX: A Talisman to Behold

PlugX: A Talisman to Behold By Max Kersten, Marc Elias, Leandro Velasco, and Alexandre Mundo Alguacil · March 28, 2022 For over a decade, the PlugX malware has been observed internationally with different variants found around the world. This blog covers a PlugX variant that we have named Talisma...

Razer Synapse 3.6.x DLL Hijacking

Advisory ID: SYSS-2021-058 Product: Razer Synapse Manufacturer: Razer Inc. Affected Versions: Versions prior to 3.7.0228.022817 Tested Versions: 3.6.0920.091710, 3.6.1010.101113, 3.6.1018.101823, 3.6.1130.111217, 3.6.1201.111814, 3.7.0131.011810 Vulnerability Type: Improper Privilege Management...

Microsoft Windows Object Linking & Embedding (OLE) Automation Array Remote Code Execution Vulnerability

OleAut32.dll in OLE in Microsoft Windows allows remote attackers to remotely execute code via a crafted web site...

8x8: DLL Search-Order Hijacking Vulnerability in work-64-exe-v7.16.3-1.exe

@is- reported to us a DLL Search-Order Hijacking vulnerability in work-64-exe-v7.16.3-1.exe. Reference: https://attack.mitre.org/techniques/T1574/001/ The underlying issue was found in an older version of Squirrel.Windows. Issue Reference: https://github.com/Squirrel/Squirrel.Windows/issues/1801...

Delta Electronics DIAEnergie 安全漏洞

Delta Electronics DIAEnergie is an industrial energy management system used to monitor and analyze energy consumption in real time, calculate energy consumption and load characteristics, optimize equipment performance, improve production processes, and maximize energy efficiency.An authorization...

Security Bulletin: Multiple untrusted search path vulnerabilities in the IBM® Db2® DAS component on Windows (CVE-2018-1458).

Summary Multiple untrusted search path vulnerabilities in the Db2 Administration Server DAS component of Db2 on Windows could allow a local user to execute arbitrary code. Vulnerability Details CVEID: CVE-2018-1458 DESCRIPTION: IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server could...

CVE-2020-25182

Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x searches for and loads DLLs as dynamic libraries. Uncontrolled loading of dynamic libraries could allow a local, unauthenticated attacker to execute arbitrary code. This vulnerability only affects ISaGRAF Runtime when running on Microsoft...

CVE-2020-25182

Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x on Windows are affected by CVE-2020-25182 due to Uncontrolled loading of dynamic libraries (DLL search path). This local, unauthenticated vulnerability could allow an attacker to execute arbitrary code by manipulating the dynamic library lo...

Yokogawa CENTUM and Exaopc Uncontrolled Search Path Element (CVE-2022-23401)

The following Yokogawa Electric products contain insecure DLL loading issues. CENTUM CS 3000 versions from R3.08.10 to R3.09.00, CENTUM VP versions from R4.01.00 to R4.03.00, from R5.01.00 to R5.04.20, and from R6.01.00 to R6.08.00, Exaopc versions from R3.72.00 to R3.79.00. This plugin only work...

CVE-2022-26511

WPS Presentation 11.8.0.5745 insecurely load d3dx941.dll when opening .pps files'current directory type' DLL loading...

CVE-2022-26511

WPS Presentation 11.8.0.5745 insecurely load d3dx941.dll when opening .pps files'current directory type' DLL loading...

CVE-2022-25969

The installer of WPS Office Version 10.8.0.6186 insecurely load VERSION.DLL or some other DLLs, allowing an attacker to execute arbitrary code with the privilege of the user invoking the installer...

CVE-2022-26511

WPS Presentation 11.8.0.5745 insecurely load d3dx941.dll when opening .pps files'current directory type' DLL loading...

CVE-2022-25969

The installer of WPS Office Version 10.8.0.6186 insecurely load VERSION.DLL or some other DLLs, allowing an attacker to execute arbitrary code with the privilege of the user invoking the installer...

Directory traversal

WPS Presentation 11.8.0.5745 insecurely load d3dx941.dll when opening .pps files'current directory type' DLL loading...

CVE-2022-26511

WPS Presentation 11.8.0.5745 insecurely load d3dx941.dll when opening .pps files'current directory type' DLL loading...

CVE-2022-26511

CVE-2022-26511 affects WPS Presentation 11.8.0.5745 where DLL loading is insecure: it loads d3dx9_41.dll from the current directory when opening .pps files, enabling potential arbitrary code execution. Affected product: KINGSOFT WPS Presentation (part of WPS Office). Root cause: insecure DLL load...

CVE-2022-25969

CVE-2022-25969 affects KINGSOFT/WPS Office installer components, where the installer loads DLLs insecurely (e.g., VERSION.DLL), enabling arbitrary code execution with the invoking user’s privileges. Published details from JVN/EUVD/Red Hat indicate affected versions include WPS Office installer 10...

User Profile Arbitrary Junction Creation Local Privilege Elevation

The user profile service, identified as ProfSrv, is vulnerable to a local privilege elevation vulnerability in its CreateDirectoryJunction function due to a lack of appropriate checks on the directory structure of the junctions it tries to link together. Attackers can leverage this vulnerability ...

RefleXXion - A Utility Designed To Aid In Bypassing User-Mode Hooks Utilised By AV/EPP/EDR Etc

Introduction RefleXXion is a utility designed to aid in bypassing user-mode hooks utilised by AV/EPP/EDR etc. In order to bypass the user-mode hooks, it first collects the syscall numbers of the NtOpenFile, NtCreateSection, NtOpenSection and NtMapViewOfSection found in the LdrpThunkSignature arra...