PuTTY DLL Hijacking Vulnerability - Windows

PuTTY is prone to a dll hijacking vulnerability. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:putty:putty"; ifdescription...

CVE-2016-5934

CVE-2016-5934 = IBM Tivoli Storage Manager FastBack installer DLL hijacking vulnerability. A specially-crafted DLL placed in the victim’s path could be loaded when the installer runs, allowing an unauthenticated attacker with local access to execute arbitrary code with the victim’s privileges. CV...

SumatraPDF 3.1.2 DLL Hijacking

Hi @ll, the executable installer deg and the "portable" version of SumatraPDF 3.1.2 available from are vulnerable to DLL hijacking ': The executable installers SumatraPDF-3.1.2-install.exe and SumatraPDF-3.1.2-64-install.exe load and execute tested on a fully patched Windows 7 SP1 at least...

February 7, 2017, update for Office 2016 (KB3114389)

None None...

CVE-2017-5630

PECL in the download utility class in the Installer in PEAR Base System v1.10.1 does not validate file types and filenames after a redirect, which allows remote HTTP servers to overwrite files via crafted responses, as demonstrated by a .htaccess overwrite...

CVE-2017-5630

PECL in the download utility class in the Installer in PEAR Base System v1.10.1 does not validate file types and filenames after a redirect, which allows remote HTTP servers to overwrite files via crafted responses, as demonstrated by a .htaccess overwrite...

CVE-2017-5630

PECL in the download utility class in the Installer in PEAR Base System v1.10.1 does not validate file types and filenames after a redirect, which allows remote HTTP servers to overwrite files via crafted responses, as demonstrated by a .htaccess overwrite...

CVE-2017-5630

CVE-2017-5630 affects PEAR Base System v1.10.1; PECL in the Installer’s download utility does not validate file types/filenames after redirects, allowing remote HTTP servers to overwrite files via crafted responses (e.g., .htaccess). Documented impact is file overwrite; no patch/remediation detai...

CVE-2017-5630

PECL in the download utility class in the Installer in PEAR Base System v1.10.1 does not validate file types and filenames after a redirect, which allows remote HTTP servers to overwrite files via crafted responses, as demonstrated by a .htaccess overwrite...

Design/Logic Flaw

Untrusted search path vulnerability in the installer for TrueCrypt 7.2 and 7.1a, VeraCrypt before 1.17-BETA, and possibly other products allows local users to execute arbitrary code with administrator privileges and conduct DLL hijacking attacks via a Trojan horse DLL in the "application...

CVE-2016-1281

The CVE-2016-1281 entry describes an untrusted search path/DLL hijacking vulnerability in installers for TrueCrypt 7.2 and 7.1a , and VeraCrypt before 1.17-BETA (and possibly other products). The issue allows local users to execute arbitrary code with administrator privileges by placing a Trojan ...

CVE-2017-5490

Cross-site scripting XSS vulnerability in the theme-name fallback functionality in wp-includes/class-wp-theme.php in WordPress before 4.7.1 allows remote attackers to inject arbitrary web script or HTML via a crafted directory name of a theme, related to...

CVE-2017-5490

Cross-site scripting XSS vulnerability in the theme-name fallback functionality in wp-includes/class-wp-theme.php in WordPress before 4.7.1 allows remote attackers to inject arbitrary web script or HTML via a crafted directory name of a theme, related to...

UBUNTU-CVE-2017-5490

Cross-site scripting XSS vulnerability in the theme-name fallback functionality in wp-includes/class-wp-theme.php in WordPress before 4.7.1 allows remote attackers to inject arbitrary web script or HTML via a crafted directory name of a theme, related to...

Cross site scripting

Cross-site scripting XSS vulnerability in the theme-name fallback functionality in wp-includes/class-wp-theme.php in WordPress before 4.7.1 allows remote attackers to inject arbitrary web script or HTML via a crafted directory name of a theme, related to...

CVE-2017-5490

Cross-site scripting XSS vulnerability in the theme-name fallback functionality in wp-includes/class-wp-theme.php in WordPress before 4.7.1 allows remote attackers to inject arbitrary web script or HTML via a crafted directory name of a theme, related to...

EMET 5.52 update is now available

EMET 5.52 is the latest version of the Enhanced Mitigation Experience Toolkit EMET and is now available for download. EMET 5.52 is a minor update from EMET 5.51 to address the following: An issue with the EAF mitigation that causes some applications to hang on Windows 7 SP1. A fix to the MSI...

EMET 5.52 update is now available

EMET 5.52 is the latest version of the Enhanced Mitigation Experience Toolkit EMET and is now available for download. EMET 5.52 is a minor update from EMET 5.51 to address the following: An issue with the EAF mitigation that causes some applications to hang on Windows 7 SP1. A fix to the MSI...

MS14-057: Description of the security update for the .NET Framework 3.5 for Windows 8.1 and Windows Server 2012 R2: October 14, 2014

MS14-057: Description of the security update for the .NET Framework 3.5 for Windows 8.1 and Windows Server 2012 R2: October 14, 2014 View products that this article applies to. Introduction The security update resolves the vulnerabilities that could allow elevation of privilege by improving how...

MS14-057: Description of the security update for the .NET Framework 3.5 for Windows 8 and Windows Server 2012: October 14, 2014

MS14-057: Description of the security update for the .NET Framework 3.5 for Windows 8 and Windows Server 2012: October 14, 2014 View products that this article applies to. Introduction The security update resolves the vulnerabilities that could allow elevation of privilege by improving how the...