CVE-2017-11421

gnome-exe-thumbnailer before 0.9.5 is prone to a VBScript Injection when generating thumbnails for MSI files, aka the "Bad Taste" issue. There is a local attack if the victim uses the GNOME Files file manager, and navigates to a directory containing a .msi file with VBScript code in its filename...

CVE-2017-11421

Removed by vendor...

CVE-2017-11421

The CVE-2017-11421 entry affects gnome-exe-thumbnailer prior to 0.9.5, used by GNOME Files to generate thumbnails. It permits VBScript Injection via MSI file names, enabling local code execution when a user navigates to a directory containing a malicious MSI and GNOME Files invokes the thumbnaile...

Threat Outbreak Alert RuleID29487: Email Messages Distributing Malicious Software on June 14, 2017

Medium Alert ID: 54201 First Published: 2017 June 14 20:13 GMT Version: 1 Summary Cisco Security has detected significant activity related to spam email messages distributing malicious software. Email messages that are related to this threat RuleID29487 may contain the following files: Name | Siz...

Design/Logic Flaw

Untrusted search path vulnerability in PatchJGD PatchJGD101.EXE ver. 1.0.1 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory...

Design/Logic Flaw

Untrusted search path vulnerability in TKY2JGD TKY2JGD1379.EXE ver. 1.3.79 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory...

CVE-2017-2212

Untrusted search path vulnerability in TKY2JGD TKY2JGD1379.EXE ver. 1.3.79 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory...

CVE-2017-2211

CVE-2017-2211 affects PatchJGD (Hyoko) installer PatchJGDh101.EXE 1.0.1. The issue is an untrusted search path that can lead to Trojan horse DLL loading, allowing privilege elevation. Impact described as arbitrary code execution with user privileges when invoking the installer. The problem is tie...

Keylogger Found in Audio Drivers on Some HP Machines

An audio driver that comes installed on some HP-manufactured computers records users’ keystrokes and stores them in a world-readable plaintext file, researchers said Thursday. The culprit appears to be version 1.0.0.31 of MicTray64.exe, a program that comes installed with the Conexant audio drive...

SAP GUI regsvr32.exe Rule Security Policy Bypass (CVE-2017-6950)

A security policy bypass vulnerability has been reported in SAP GUI. The vulnerability is due to improper implementation of client side security policies regarding the Windows application regsvr32.exe. A remote attacker could exploit this vulnerability by enticing an user to connect to a maliciou...

NSA Eternalblue SMB vulnerability analysis-vulnerability warning-the black bar safety net

Environment TROJAN: Eternalblue-2.2.0.exe TARGET: win7 sp1 32bits srv.sys 6.1.7601.17514 srvnet.sys 6.1.7601.17514 PATCH: MS17-010 The vulnerability principle srv. sys in the processing SrvOs2FeaListSizeToNt when logic is incorrect resulting in cross-border copy. We first look at the vulnerabilit...

HTTP Protocol Remote Code Execution

A remote code execution vulnerability exists in HTTP protocol. By sending a request containing a specially crafted EXE file, a remote attacker can exploit this vulnerability in order to execute arbitrary code on the effected system...

Updated icoutils packages fix security vulnerability

Multiple vulnerabilities were discovered in the icotool CVE-2017-6010, CVE-2017-6011 and wrestool CVE-2017-6009 tools of icoutils, a set of programs that deal with MS Windows icons and cursors, which may result in denial of service or the execution of arbitrary code if a malformed .ico or .exe fi...

DeepService SSL VPN suffers from a local power lifting vulnerability

EasyConnect enables you to use all the systems and applications on your company's intranet outside the office. The EasyConnect PC Client version 7.1.0.4 has an exe hijacking vulnerability due to a space in the binary path Program Files and the entire path is not enclosed in double quotes, which...

EasyCom SQL iPlug Denial Of Service

Credits: John Page AKA Hyp3rlinX + Website: hyp3rlinx.altervista.org + Source: http://hyp3rlinx.altervista.org/advisories/EASYCOM-SQL-IPLUG-DENIAL-OF-SERVICE.txt + ISR: ApparitionSec Vendor: ================ easycom-aura.com Product: =========== SQL iPlug EasycomPHP4.0029.iC8im2.exe SQL iPlug...

Spear Phishing Techniques Used in Attacks Targeting the Mongolian Government

Introduction FireEye recently observed a sophisticated campaign targeting individuals within the Mongolian government. Targeted individuals that enabled macros in a malicious Microsoft Word document may have been infected with Poison Ivy, a popular remote access tool RAT that has been used for...

CVE-2016-7086

The installer in VMware Workstation Pro 12.x before 12.5.0 and VMware Workstation Player 12.x before 12.5.0 on Windows allows local users to gain privileges via a Trojan horse setup64.exe file in the installation directory...

CVE-2016-7086

The CVE-2016-7086 issue affects VMware Workstation Pro 12.x before 12.5.0 and VMware Workstation Player 12.x before 12.5.0 on Windows. The root cause is a Trojan horse setup64.exe placed in the installation directory, enabling local privilege escalation for attackers with local access. The public...

CVE-2016-7086

The installer in VMware Workstation Pro 12.x before 12.5.0 and VMware Workstation Player 12.x before 12.5.0 on Windows allows local users to gain privileges via a Trojan horse setup64.exe file in the installation directory...

CVE-2016-10072

WampServer 3.0.6 has two files called 'wampmanager.exe' and 'unins000.exe' with a weak ACL for Modify. This could potentially allow an authorized but non-privileged local user to execute arbitrary code with elevated privileges on the system. To properly exploit this vulnerability, the local...