CVE-2022-1098 Delta Electronics DIAEnergie Uncontrolledly Search Path Element

Delta Electronics DIAEnergie all versions prior to 1.8.02.004 are vulnerable to a DLL hijacking condition. When combined with the Incorrect Default Permissions vulnerability of 4.2.2 above, this makes it possible for an attacker to escalate privileges...

CVE-2022-1098

Delta Electronics DIAEnergie (all versions prior to 1.9) is affected by CVE-2022-1098 through Uncontrolled Search Path Element (DLL hijacking). The root cause is DLL loading order/search path allowing privilege escalation when paired with the Incorrect Default Permissions issue; CVSSv3 base score...

CVE-2021-32957 MDT AutoSave Uncontrolled Search Path Element

A function in MDT AutoSave versions prior to v6.02.06 is used to retrieve system information for a specific process, and this information collection executes multiple commands and summarizes the information into an XML. This function and subsequent process gives full path to the executable and is...

CVE-2021-32957 MDT AutoSave Uncontrolled Search Path Element

A function in MDT AutoSave versions prior to v6.02.06 is used to retrieve system information for a specific process, and this information collection executes multiple commands and summarizes the information into an XML. This function and subsequent process gives full path to the executable and is...

CVE-2021-32957

The CVE-2021-32957 entry relates to MDT AutoSave prior to version 6.02.06, where a function used to retrieve process system information collects commands and formats results into XML and returns the full path to the executable. This creates a risk of binary hijacking (Uncontrolled Search Path Ele...

Security Bulletin: IBM WebSphere Application Server Liberty for IBM i is affected by arbitrary code execution and other attacks due to multiple vulnerabilities.

Summary Multiple vulnerabilities in IBM WebSphere Application Server allow arbitrary code execution, LDAP injection, unauthorized access, and click hijacking as described in the CVEs listed in the vulnerability details section. IBM WebSphere Application Server Liberty for IBM i has addressed the...

Automaker Cybersecurity Lagging Behind Tech Adoption, Experts Warn

A pair of recent vulnerabilities found in the automaker ecosystem might not seem like a real danger taken separately. But experts warn a lack of attention on cybersecurity could plague “smart” car and electric vehicle systems — and users — in years to come, as the use of automotive technology...

Samsung SettingsReceiver PendingIntent Hijacking Vulnerability

Samsung SettingsReceiver is a component in Samsung Samsung mobile devices. Samsung SettingsReceiver suffers from a PendingIntent hijacking vulnerability that originates from unauthorized access in SettingsReceiver, which can be exploited by a local attacker to gain unauthorized access to media...

Design/Logic Flaw

Totolink A3100R V5.9c.4577 suffers from Use of Insufficiently Random Values via the web configuration. The SESSIONID is predictable. An attacker can hijack a valid session and conduct further malicious operations...

CVE-2021-46010

Totolink A3100R V5.9c.4577 is affected. The root cause is Use of Insufficiently Random Values in the web configuration, making the SESSION_ID predictable. This enables an attacker to hijack a valid session and perform further malicious operations. No remediation details are provided in the docume...

CVE-2021-46010

Totolink A3100R V5.9c.4577 suffers from Use of Insufficiently Random Values via the web configuration. The SESSIONID is predictable. An attacker can hijack a valid session and conduct further malicious operations...

CVE-2022-27772

spring-boot versions prior to version v2.2.11.RELEASE was vulnerable to temporary directory hijacking. This vulnerability impacted the org.springframework.boot.web.server.AbstractConfigurableWebServerFactory.createTempDir method. NOTE: This vulnerability only affects products and/or versions that...

CVE-2022-27772

spring-boot versions prior to version v2.2.11.RELEASE was vulnerable to temporary directory hijacking. This vulnerability impacted the org.springframework.boot.web.server.AbstractConfigurableWebServerFactory.createTempDir method. NOTE: This vulnerability only affects products and/or versions that...

Directory traversal

UNSUPPORTED WHEN ASSIGNED spring-boot versions prior to version v2.2.11.RELEASE was vulnerable to temporary directory hijacking. This vulnerability impacted the org.springframework.boot.web.server.AbstractConfigurableWebServerFactory.createTempDir method. NOTE: This vulnerability only affects...

CVE-2022-27772

CVE-2022-27772 : Spring Boot before v2.2.11.RELEASE is vulnerable to temporary directory hijacking via the method org.springframework.boot.web.server.AbstractConfigurableWebServerFactory.createTempDir. A local attacker could leverage this to escalate privileges or take over the application, as de...

CVE-2022-22996

The G-RAID 4/8 Software Utility setups for Windows were affected by a DLL hijacking vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the system user...

CVE-2022-22996

The G-RAID 4/8 Software Utility setups for Windows were affected by a DLL hijacking vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the system user...

CVE-2022-22996

The G-RAID 4/8 Software Utility setups for Windows were affected by a DLL hijacking vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the system user...

Code injection

The G-RAID 4/8 Software Utility setups for Windows were affected by a DLL hijacking vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the system user...

CVE-2022-22996 SanDisk Professional G-RAID 4/8 Software Utility, Privilege Escalation

The G-RAID 4/8 Software Utility setups for Windows were affected by a DLL hijacking vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the system user...