CVE-2022-44939

Efs Software Easy Chat Server Version 3.1 was discovered to contain a DLL hijacking vulnerability via the component TextShaping.dll. This vulnerability allows attackers to execute arbitrary code via a crafted DLL...

CVE-2022-44939

Efs Software Easy Chat Server Version 3.1 was discovered to contain a DLL hijacking vulnerability via the component TextShaping.dll. This vulnerability allows attackers to execute arbitrary code via a crafted DLL...

PT-2023-14570 · Efs · Efs Software Easy Chat Server

Name of the Vulnerable Software and Affected Versions: Efs Software Easy Chat Server version 3.1 Description: The issue allows attackers to execute arbitrary code via a crafted DLL, exploiting a DLL hijacking vulnerability through the TextShaping.dll component. Recommendations: For Efs Software...

CVE-2022-44939

CVE-2022-44939 affects Efs Software Easy Chat Server 3.1; a DLL hijacking flaw in TextShaping.dll allows local attackers to execute arbitrary code via a crafted DLL. Impact: full code execution with high impact. Mitigation/remediation: as per PT-2023-14570, restrict access to TextShaping.dll or a...

A New Emerging CatB Ransomware Using DLL Hijacking to Evade Detection

Threat Level Attack Report For a detailed threat advisory, download the pdf file here Summary CatB is a ransomware that uses a technique called DLL hijacking to evade detection. It does this by injecting itself into the Microsoft Distributed Transaction Coordinator MSDTC service, a legitimate...

Autodesk DWG TrueView 2023 < 2023.1.1 RCE

The remote host has an install of Autodesk DWG TrueView version 2023 prior to 2023.1.1. It is, therefore, affected by a remote code execution vulnerability due to DLL search order hijacking. Note that Nessus has not tested for this issue but has instead relied only on the application's...

U.S. Department of State: RXSS on https://travel.state.gov/content/travel/en/search.html

Vulnerability description not provided...

Login as User or Customer < 3.3 - Unauthenticated Privilege Escalation to Admin

The plugin lacks authorization checks to ensure that users are allowed to log in as another one, which could allow unauthenticated attackers to obtain a valid admin session. Run the below command in the developer console of the web browser while being on the blog as an unauthenticated user, then...

Reddit: Reflected XSS via File Upload

Vulnerability description not provided...

Senayan Library Management System 9.1.1 Cross Site Scripting Vulnerability

Title: Senayan Library Management System v9.1.1 a.k.a SLIMS 9 XSS-Reflected - PHPSESSID Hijacking + inserting webp image Author: nu11secur1ty Vendor: https://slims.web.id/web/ Software: https://github.com/slims/slims9bulian/releases/tag/v9.1.1 Reference:...

GHSA-QCW2-492V-57XJ usememos/memos missing Secure cookie attribute

usememos/memos is an open-source, self-hosted memo hub with knowledge management and socialization. Memos prior to 0.9.0 is missing the Secure cookie attribute, making it vulnerable to session hijacking...

usememos/memos missing Secure cookie attribute

usememos/memos is an open-source, self-hosted memo hub with knowledge management and socialization. Memos prior to 0.9.0 is missing the Secure cookie attribute, making it vulnerable to session hijacking...

Lego's Bricklink steps on cross site scripting blocks

If you build it, they will come. In Legos case, they built it and certain security flaws meant someone could have taken it all apart. PCMag reports that flaws in Legos Bricklink service meant that it was open to potential data leakage or even account hijacking. Those flaws, now addressed,...

CVE-2022-42945

DWG TrueViewTM 2023 version has a DLL Search Order Hijacking vulnerability. Successful exploitation by a malicious attacker could result in remote code execution on the target system...

CVE-2022-42945

DWG TrueViewTM 2023 version has a DLL Search Order Hijacking vulnerability. Successful exploitation by a malicious attacker could result in remote code execution on the target system...

Design/Logic Flaw

DWG TrueViewTM 2023 version has a DLL Search Order Hijacking vulnerability. Successful exploitation by a malicious attacker could result in remote code execution on the target system...

Autodesk DWG TrueView 代码问题漏洞

Autodesk DWG TrueView is an application from the American company Autodesk. It is used to view and convert 2D and 3D DWG files for free. A security vulnerability exists in Autodesk DWG TrueView version 2023, which originates from a DLL search command hijacking that can be exploited by a malicious...

CVE-2022-42945

DWG TrueViewTM 2023 version has a DLL Search Order Hijacking vulnerability. Successful exploitation by a malicious attacker could result in remote code execution on the target system...

Senayan Library Management System 9.1.1 Cross Site Scripting

Title: Senayan Library Management System v9.1.1 a.k.a SLIMS 9 XSS-Reflected - PHPSESSID Hijacking + inserting webp image Author: nu11secur1ty Date: 12.17.2022 Vendor: https://slims.web.id/web/ Software: https://github.com/slims/slims9bulian/releases/tag/v9.1.1 Reference:...

CVE-2022-42945

DWG TrueView 2023 contains a DLL search order hijacking vulnerability leading to remote code execution (CVE-2022-42945). Root cause: DLL search order manipulation. Affected product: Autodesk DWG TrueView 2023. Evidence from multiple sources confirms the issue; exploitation is described as remote ...