CVE-2017-2167

Untrusted search path vulnerability in Installer for PrimeDrive Desktop Application version 1.4.4 and earlier allows remote attackers to execute arbitrary code via a specially crafted executable file in an unspecified directory...

CVE-2017-2167

Untrusted search path vulnerability in Installer for PrimeDrive Desktop Application version 1.4.4 and earlier allows remote attackers to execute arbitrary code via a specially crafted executable file in an unspecified directory...

Design/Logic Flaw

Untrusted search path vulnerability in Installer for PrimeDrive Desktop Application version 1.4.4 and earlier allows remote attackers to execute arbitrary code via a specially crafted executable file in an unspecified directory...

CVE-2017-2164

Cross-site scripting vulnerability in SOY CMS with installer 1.8.12 and earlier allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

CVE-2017-2164

CVE-2017-2164 corresponds to a cross-site scripting vulnerability in the installer component of SOY CMS (1.8.12 and earlier). The root cause is a flaw in processing parameters (CWE-79) in the installer, enabling a remote attacker to cause arbitrary web-script or HTML execution in a user’s browser...

PrimeDrive Desktop Application Installer may insecurely load executable files

Overview PrimeDrive Desktop Application is the client application for PrimeDrive online storage service provided by SoftBank Corp. The installer of PrimeDrive Desktop Application contains an issue with the file search path, which may insecurely load executable files CWE-427. Eili Masami of...

CVE-2016-7048

The interactive installer in PostgreSQL before 9.3.15, 9.4.x before 9.4.10, and 9.5.x before 9.5.5 might allow remote attackers to execute arbitrary code by leveraging use of HTTP to download software...

The installer of SOY CMS vulnerable to cross-site scripting

Overview SOY CMS provided by Nippon Institute of Agroinformatics Ltd. is a Contents Management System CMS. The installer of SOY CMS contains a cross-site scripting vulnerability CWE-79 due to a flaw in processing parameter. Satoshi Ogawa of Mitsui Bussan Secure Directions,Inc. reported this...

The installer of The Public Certification Service for Individuals "The JPKI user's software" may insecurely load Dynamic Link Libraries

Overview The installer of The Public Certification Service for Individuals "The JPKI user's software" provided by Japan Agency for Local Authority Information Systems J-LIS contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries. Note that this...

Product update: Virtuozzo PowerPanel RTM Hotfix 2 (7.0.1-354)

The new packages for Virtuozzo PowerPanel introducing usability bug fixes. Vulnerability id: PP-403 Installation of computes failed to complete if 'nodes.lst' had empty lines. Vulnerability id: PP-401 Unable to join computes due to incorrect repository priorities. Vulnerability id: PP-378 Improve...

Design/Logic Flaw

Editions of Rapid7 AppSpider Pro installers prior to version 6.14.060 contain a DLL preloading vulnerability, wherein it is possible for the installer to load a malicious DLL located in the current working directory of the installer...

CVE-2017-5236

Rapid7 AppSpider Pro installers prior to version 6.14.060 are affected by a DLL preloading vulnerability. The installer can load a malicious DLL from its current working directory, enabling tampering during installation. CNVD-2017-10390 confirms this flaw; CVE-2017-5236 notes the affected pre-6.1...

CVE-2017-2156

Untrusted search path vulnerability in Vivaldi installer for Windows prior to version 1.7.735.48 allows an attacker to execute arbitrary code via a specially crafted executable file in an unspecified directory...

CVE-2017-2156

Untrusted search path vulnerability in Vivaldi installer for Windows prior to version 1.7.735.48 allows an attacker to execute arbitrary code via a specially crafted executable file in an unspecified directory...

CVE-2017-2130

Untrusted search path vulnerability in the installer of PhishWall Client Internet Explorer version Ver. 3.7.13 and earlier allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory...

Design/Logic Flaw

Untrusted search path vulnerability in Vivaldi installer for Windows prior to version 1.7.735.48 allows an attacker to execute arbitrary code via a specially crafted executable file in an unspecified directory...

CVE-2017-2149

The CVE-2017-2149 issue is an Untrusted search path vulnerability in Toshiba memory card installers, enabling a Trojan horse DLL to be loaded from an unspecified directory and allowing code execution with user privileges. Affected software includes several FlashAir/TransferJet related tools and c...

Veritas System Recovery DLL Load Local Code Execution Vulnerability

Veritas System Recovery is a suite of disaster recovery software for virtual machines, servers and laptops from Veritas Technologies, USA. A local code execution vulnerability exists in the patch installer in versions prior to Veritas System Recovery 16 SP1. An attacker could exploit this...

Installer of Vivaldi for Windows may insecurely load executable files

Overview The installer of Vivaldi for Windows contains an issue in the file search path when loading files, which may insecurely load executable files CWE-427. Eiji James Yoshida of Security Professionals Network Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer...

JVN#71572107: Installer of Vivaldi for Windows may insecurely load executable files

The installer of Vivaldi for Windows contains an issue in the file search path when loading files, which may insecurely load executable files CWE-427. Impact Arbitrary code may be executed with the privilege of the user invoking the installer. Solution Use the latest installer Use the latest...