Ubuntu: Security Advisory (USN-3762-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Fixed in ClickHouse Release 18.12.13, 2018-09-10​

Functions for loading CatBoost models allowed path traversal and reading arbitrary files through error messages...

CVE-2018-16518

A directory traversal vulnerability with remote code execution in Prim'X Zed! FREE through 1.0 build 186 and Zed! Limited Edition through 6.1 build 2208 allows creation of arbitrary files on a user's workstation using crafted ZED! containers because the watermark loading function can place an...

CVE-2018-16518: Improper Limitation of a Pathname to a Restricted Directory

A directory traversal vulnerability with remote code execution in Prim'X Zed! FREE through 1.0 build 186 and Zed! Limited Edition through 6.1 build 2208 allows creation of arbitrary files on a user's workstation using crafted ZED! containers because the watermark loading function can place an...

PT-2018-13607

Name of the Vulnerable Software and Affected Versions Prim'X Zed! FREE versions 1.0 build 186 and earlier Prim'X Zed! Limited Edition versions 6.1 build 2208 and earlier Description A directory traversal issue allows for remote code execution, enabling the creation of arbitrary files on a user's...

Windows Installer Privilege Escalation

The vulnerability of the Windows Installer component in Windows operating systems is related to errors during library loading. Exploiting this vulnerability can allow an attacker to increase their privileges...

Xiaomi MIWiFi Xiaomi_55DD Resource Loading Vulnerability

Xiaomi MIWiFi Xiaomi55DD is a wireless router from the Chinese company Xiaomi. A security vulnerability exists in Xiaomi MIWiFi Xiaomi55DD version 2.8.50. An attacker can exploit this vulnerability to cause the application to retrieve the contents of arbitrary external URLs and return those...

GHSA-2GW2-8Q9W-CW8P Ruby-ffi has a DLL loading issue

ruby-ffi version 1.9.23 and earlier has a DLL loading issue which can be hijacked on Windows OS, when a Symbol is used as DLL name instead of a String This vulnerability appears to have been fixed in v1.9.24 and later...

Ruby-ffi has a DLL loading issue

ruby-ffi version 1.9.23 and earlier has a DLL loading issue which can be hijacked on Windows OS, when a Symbol is used as DLL name instead of a String This vulnerability appears to have been fixed in v1.9.24 and later...

PT-2018-2162

Name of the Vulnerable Software and Affected Versions Galakтиka ERP affected versions not specified Description The issue is related to insufficient access control in the GalSrv directory used in the system's two-tier architecture. An attacker with USERS group privileges can exploit this by placi...

CVE-2018-5003

Adobe Creative Cloud Desktop Application before 4.5.5.342 installer has an insecure library loading dll hijacking vulnerability. Successful exploitation could lead to privilege escalation...

CVE-2018-5003

Adobe Creative Cloud Desktop Application before 4.5.5.342 installer has an insecure library loading dll hijacking vulnerability. Successful exploitation could lead to privilege escalation...

CVE-2018-5003

Adobe Creative Cloud Desktop Application before 4.5.5.342 installer has an insecure library loading dll hijacking vulnerability. Successful exploitation could lead to privilege escalation...

CVE-2018-5003

Adobe Creative Cloud Desktop Application installer (Windows) prior to version 4.5.5.342 is affected by an insecure library loading (DLL hijacking) vulnerability (CVE-2018-5003). The root cause is DLL loading during installation, enabling privilege escalation if an attacker can place a malicious l...

CVE-2018-14797

Emerson DeltaV DCS versions 11.3.1, 12.3.1, 13.3.0, 13.3.1, R5 allow a specially crafted DLL file to be placed in the search path and loaded as an internal and valid DLL, which may allow arbitrary code execution...

CVE-2018-14797

Emerson DeltaV DCS versions 11.3.1, 12.3.1, 13.3.0, 13.3.1, R5 allow a specially crafted DLL file to be placed in the search path and loaded as an internal and valid DLL, which may allow arbitrary code execution...

CVE-2018-14797: Uncontrolled Search Path Element

Emerson DeltaV DCS versions 11.3.1, 12.3.1, 13.3.0, 13.3.1, R5 allow a specially crafted DLL file to be placed in the search path and loaded as an internal and valid DLL, which may allow arbitrary code execution...

PT-2018-12731

Name of the Vulnerable Software and Affected Versions Emerson DeltaV DCS versions 11.3.1, 12.3.1, 13.3.0, 13.3.1, R5 Description The issue allows a specially crafted DLL file to be placed in the search path and loaded as an internal and valid DLL, which may allow arbitrary code execution...

Microsoft Windows 10 - Diagnostics Hub Standard Collector Service Privilege Escalation

Microsoft Windows 10 - Diagnostics Hub Standard Collector Service Privilege Escalation SystemCollector PoC for Privilege Escalation in Windows 10 Diagnostics Hub Standard Collector Service Affected Products Windows 10 Windows Server Windows Server 2016 Visual Studio 2015 Update 3 Visual Studio 20...

The installer of Digital Paper App may insecurely load Dynamic Link Libraries

Overview Digital Paper App provided by Sony Corporation is document management software exclusively for Sony Digital Paper. The installer of Digital Paper App contains an issue with the DLL search path, which may lead to insecurely loading Dynamic Link Libraries CWE-427. Yuji Tounai of NTT...