The installer of The Public Certification Service for Individuals "The JPKI user's software" may insecurely load Dynamic Link Libraries

Overview The installer of The Public Certification Service for Individuals "The JPKI user's software" provided by Japan Agency for Local Authority Information Systems J-LIS contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries. Note that this...

Product update: Virtuozzo PowerPanel RTM Hotfix 2 (7.0.1-354)

The new packages for Virtuozzo PowerPanel introducing usability bug fixes. Vulnerability id: PP-403 Installation of computes failed to complete if 'nodes.lst' had empty lines. Vulnerability id: PP-401 Unable to join computes due to incorrect repository priorities. Vulnerability id: PP-378 Improve...

Design/Logic Flaw

Editions of Rapid7 AppSpider Pro installers prior to version 6.14.060 contain a DLL preloading vulnerability, wherein it is possible for the installer to load a malicious DLL located in the current working directory of the installer...

CVE-2017-5236

Rapid7 AppSpider Pro installers prior to version 6.14.060 are affected by a DLL preloading vulnerability. The installer can load a malicious DLL from its current working directory, enabling tampering during installation. CNVD-2017-10390 confirms this flaw; CVE-2017-5236 notes the affected pre-6.1...

CVE-2017-2156

Untrusted search path vulnerability in Vivaldi installer for Windows prior to version 1.7.735.48 allows an attacker to execute arbitrary code via a specially crafted executable file in an unspecified directory...

CVE-2017-2156

Untrusted search path vulnerability in Vivaldi installer for Windows prior to version 1.7.735.48 allows an attacker to execute arbitrary code via a specially crafted executable file in an unspecified directory...

CVE-2017-2130

Untrusted search path vulnerability in the installer of PhishWall Client Internet Explorer version Ver. 3.7.13 and earlier allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory...

Design/Logic Flaw

Untrusted search path vulnerability in Vivaldi installer for Windows prior to version 1.7.735.48 allows an attacker to execute arbitrary code via a specially crafted executable file in an unspecified directory...

CVE-2017-2149

The CVE-2017-2149 issue is an Untrusted search path vulnerability in Toshiba memory card installers, enabling a Trojan horse DLL to be loaded from an unspecified directory and allowing code execution with user privileges. Affected software includes several FlashAir/TransferJet related tools and c...

Veritas System Recovery DLL Load Local Code Execution Vulnerability

Veritas System Recovery is a suite of disaster recovery software for virtual machines, servers and laptops from Veritas Technologies, USA. A local code execution vulnerability exists in the patch installer in versions prior to Veritas System Recovery 16 SP1. An attacker could exploit this...

Installer of Vivaldi for Windows may insecurely load executable files

Overview The installer of Vivaldi for Windows contains an issue in the file search path when loading files, which may insecurely load executable files CWE-427. Eiji James Yoshida of Security Professionals Network Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer...

JVN#71572107: Installer of Vivaldi for Windows may insecurely load executable files

The installer of Vivaldi for Windows contains an issue in the file search path when loading files, which may insecurely load executable files CWE-427. Impact Arbitrary code may be executed with the privilege of the user invoking the installer. Solution Use the latest installer Use the latest...

CVE-2016-4846

Untrusted search path vulnerability in the installer of PhishWall Client Internet Explorer before 3.7.8.2...

CVE-2016-4846

Untrusted search path vulnerability in the installer of PhishWall Client Internet Explorer before 3.7.8.2...

CVE-2016-4846

PhishWall Client Internet Explorer installer is affected. The DLL search path issue stems from an old InstallShield in versions up to 3.7.8.1 (and before 3.7.8.2), allowing insecure loading of DLLs. Impact: arbitrary code execution with the user’s privileges when running the installer. Exploitati...

CVE-2016-4846

Untrusted search path vulnerability in the installer of PhishWall Client Internet Explorer before 3.7.8.2...

Vulnerability Disclosure: Vivaldi installer for Windows could run arbitrary downloaded code (JVN#71572107)

Recently, JP-CERT, the Japanese security vulnerability clearing house, brought to our attention a security vulnerability when they forwarded information about a problem in Vivaldi's installer for Windows. The installer for Vivaldi on Windows for releases prior to version 1.7.735.48 could run...

Design/Logic Flaw

The web interface in Red Hat QuickStart Cloud Installer QCI 1.0 does not mask passwords fields, which allows physically proximate attackers to obtain sensitive password information by reading the display...

CVE-2016-7060

The web interface in Red Hat QuickStart Cloud Installer QCI 1.0 does not mask passwords fields, which allows physically proximate attackers to obtain sensitive password information by reading the display...

CVE-2016-7060

CVE-2016-7060 describes a information-disclosure risk in Red Hat QuickStart Cloud Installer (QCI) 1.0 where the web interface does not mask password fields, enabling a physically proximate attacker to read passwords from the display. The CVSSv2/2.0 base score is 2.1 (LOW) with LOCAL attack vector...