CVE-2017-5233

Rapid7 AppSpider Pro installers prior to version 6.14.053 contain a DLL preloading vulnerability, wherein it is possible for the installer to load a malicious DLL located in the current working directory of the installer...

Python Remote Administration Tool: Stitch

Python Remote Administration Tool This is a cross platform python framework which allows you to build custom payloads for Windows, Mac OSX and Linux as well. You are able to select whether the payload binds to a specific IP and port, listens for a connection on a port, option to send an email of...

SoftMaker Office 201x Privilege Escalation

Hi @ll, the service pack installers for SoftMaker Office 201x, available from , are surprise.- vulnerable. The executable installer OUCH ofw16763.exe, a 7z SFX OUCH, creates an UNPROTECTED directory "%TEMP%\7zSxxxxxxxx" to extract its payload, then executes "%TEMP%\7zSxxxxxxxx\spsetup.exe"...

SoftMaker Office 201x Privilege Escalation Vulnerability

SoftMaker Office 201x suffers from a local privilege escalation vulnerability due to an unprotected directory. Hi @ll, the service pack installers for SoftMaker Office 201x, available from , are surprise.- vulnerable. The executable installer OUCH ofw16763.exe, a 7z SFX OUCH, creates an UNPROTECT...

JVN#08868688: The installers of multiple Japan Pension Service software may insecurely load Dynamic Link Libraries

The installers of multiple Japan Pension Service software contain an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries. Impact This vulnerability can be exploited when the following condition is met. If this vulnerability is exploited, an arbitrary code m...

EMC Avamar Data Store and Avamar Virtual Edition Information Disclosure Vulnerability

EMC Avamar is a backup and recovery solution. EMC Avamar Server's ADS and AVE installers for different users use the same key, allowing an attacker to exploit a vulnerability to break the password protection mechanism and gain access to sensitive client-server data flow information...

Avira Free Antivirus DLL Hijacking

Hi @ll, Avira's free antivirus full package executable installers, aviraantivirusen-us.exe, aviraantivirusde-de.exe etc., available from , etc., have multiple vulnerabilities: 1. the full package executable installers really: self- extracting RAR archives extract their payload the real installer...

ESET NOD32 Archive support module heap buffer overflow vulnerability

ESET NOD32 is a suite of antivirus programs from ESET Slovakia. A heap buffer overflow vulnerability exists in the Archive support module of ESET NOD32 update prior to version 11861. A remote attacker can exploit this vulnerability to execute arbitrary code with the help of a large number of...

CTF-Tools - Some setup scripts for security research tools

This is a collection of setup scripts to create an install of various security research tools. Of course, this isn't a hard problem, but it's really nice to have them in one place that's easily deployable to new machines and so forth. Installers for the following tools are included: Category | To...

InstallShield DLL Hijacking

Hi @ll, executable installers ° created with InstallShield see alias are vulnerable: 1. Their wrappers/self-extractors load and execute a rogue/bogus/ malicious RichEd32.dll ' and other DLLs too, dependent on the version of Windows eventually found in the directory they are started from the...

Python 3.5.1 DLL Hijacking

Hi @ll, the executable installers python-3.5.1-webinstall.exe and python-3.5.1.exe available on load and execute multiple DLLs from their "application directory". For software downloaded with a web browser the application directory is typically the user's "Downloads" directory: see , and for "pri...

ESET NOD32 Antivirus DLL Hijacking

Hi @ll, the executable installer ° of ESET's NOD32 antivirus, esetnod32antivirusliveinstaller.exe, loads and executes at least the rogue/bogus/malicious Cabinet.dll and DbgHelp.dll eventually found in the directory it is started from ' the "application directory". For software downloaded with a w...

Google Chrome DLL Hijack

Hi @ll, the executable installers ° of Google Chrome are vulnerable: 1. ChromeStandaloneSetup.exe and ChromeSetup.exe load and execute a rogue/bogus/malicious CryptBase.dll under Windows NT6.x from their "application directory" '. For software downloaded with a web browser this is typically the...

7-Zip DLL Hijack

Hi @ll, the executable installers ° of 7-Zip see and ALL self-extracting archives created with 7-Zip are vulnerable: 1. They load and execute a rogue/bogus/malicious UXTheme.dll ' eventually found in the directory they are started from the "application directory". For software downloaded with a w...

JRSoft InnoSetup DLL Hijack

Hi @ll, executable installers ° created with JRSoft InnoSetup see ; this includes of course InnoSetup itself too are vulnerable: 1. They load and execute a rogue/bogus/malicious UXTheme.dll ' eventually found in the directory they are started from the "application directory". For software...

Deliberately Insecure Web Application: OWASP WebGoat

WebGoat is a deliberately insecure web application maintained by OWASP designed to teach web application security lessons. You can install and practice with WebGoat in either J2EE or WebGoat for .Net in ASP.NET. In each lesson, users must demonstrate their understanding of a security issue by...

This Malware Can Delete and Replace Your Entire Chrome Browser with a lookalike

Security researchers have uncovered a new piece of Adware that replaces your entire browser with a dangerous copy of Google Chrome, in a way that you will not notice any difference while browsing. The new adware software, dubbed "eFast Browser," works by installing and running itself in place of...

Epic Operation Kicks Off Multistage Turla APT Campaign

The Turla APT campaign has baffled researchers for months as to how its victims are compromised. Peaking during the first two months of the year, Turla has targeted municipal governments, embassies, militaries and other high-value targets worldwide, with particular concentrations in the Middle Ea...

ICS Malware Found on Vendors' Update Installers

Malware targeting industrial control systems has infected the update installers belonging to three known industrial control vendors, according to an advisory from the Industrial Control Systems Cyber Emergency Response Team ICS-CERT. The Havex remote access Trojan RAT is targeting vendors via...

Heartbleed Bug (CVE-2014-0160) and Qt

Although Qt as such is not affected by the Heartbleed Bug CVE-2014-0160 found in OpenSSL, it affects users of Qt, so I wanted to write a short summary about the topic. As defined at : "The Heartbleed Bug is a serious vulnerability in the popular OpenSSL cryptographic software library. This weakne...