Design/Logic Flaw

When the directory containing the installer does not have sufficiently restrictive file permissions, an attacker can modify or replace the installer to execute malicious code...

Insecure Access Control

chromium is uses an insecure access control. An insufficient policy enforcement in Installer allows an attacker to bypass security restrictions...

Joomla! 2.5.x < 3.9.28 Multiple Vulnerabilities

According to its self-reported version, the instance of Joomla! running on the remote web server is 2.5.x prior to 3.9.28. It is, therefore, affected by multiple vulnerabilities. - Inadequate escaping in the Rules field of the JForm API leads to a Cross-Site Scripting XSS vulnerability...

CVE-2020-16007

Insufficient data validation in installer in Google Chrome prior to 86.0.4240.183 allowed a local attacker to potentially elevate privilege via a crafted filesystem...

KB4580330: Windows 10 Version 1803 October 2020 Security Update

The remote Windows host is missing security update 4580330. It is, therefore, affected by multiple vulnerabilities : - A spoofing vulnerability exists when Windows incorrectly validates file signatures. An attacker who successfully exploited this vulnerability could bypass security features and...

Design/Logic Flaw

Uncontrolled search path in the installer for the IntelR Binary Configuration Tool for Windows, all versions, may allow an authenticated user to potentially enable escalation of privilege via local access...

CVE-2019-10210

Postgresql Windows installer before versions 11.5, 10.10, 9.6.15, 9.5.19, 9.4.24 is vulnerable via superuser writing password to unprotected temporary file...

CVE-2018-16182

CVE-2018-16182 concerns an untrusted DLL search path in the installer for MARKET SPEED, affecting Ver.16.4 and earlier. The root cause is insecure DLL loading (CWE-427) that can allow arbitrary code execution with the invoking user’s privileges. Public sources in the connected documents confirm t...

JVN#95423049: The installer of Content Manager Assistant for PlayStation may insecurely load Dynamic Link Libraries

Content Manager Assistant for PlayStation provided by Sony Interactive Entertainment Inc. is a data transfer tool. The installer of Content Manager Assistant for PlayStation contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries CWE-427. Impact...

Installers of Mozilla Firefox and Thunderbird for Windows may insecurely load Dynamic Link Libraries

Overview Installers of Mozilla Firefox and Thunderbird for Windows provided by Mozilla Foundation contain an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries CWE-427. Eili Masami of Tachibana Lab. reported this vulnerability to IPA. JPCERT/CC coordinated...

CVE-2017-5235

Rapid7 Metasploit Pro installers prior to 4.13.0-2017022101 are affected by a DLL preloading vulnerability: the installer can load a malicious DLL from the current working directory. The issue is tied to how the installer searches for system DLLs, allowing an attacker with a malicious DLL in the ...