PT-2018-4577

Name of the Vulnerable Software and Affected Versions Nullsoft Scriptable Install System NSIS versions prior to 2.49 Description The issue concerns unsafe implicit linking against Version.dll, meaning there is no protection mechanism to resolve the dependency at an appropriate time during runtime...

CVE-2015-9267: Improper Privilege Management

Nullsoft Scriptable Install System NSIS before 2.49 uses temporary folder locations that allow unprivileged local users to overwrite files. This allows a local attack in which either a plugin or the uninstaller can be replaced by a Trojan horse program...

Updated mingw-nsis packages fix security vulnerability

The Nullsoft Scriptable Install System version 2.50 contains a DLL hijacking attack which allows administrative root level access on the target Windows system...

MGASA-2017-0271 Updated mingw-nsis packages fix security vulnerability

The Nullsoft Scriptable Install System version 2.50 contains a DLL hijacking attack which allows administrative root level access on the target Windows system...

PT-2017-19433

Name of the Vulnerable Software and Affected Versions Nullsoft Scriptable Install System versions prior to 2.50 Description The issue allows for a DLL hijacking attack, which can provide administrative level access on the target Windows system. Recommendations For versions prior to 2.50, update t...

Nullsoft Scriptable Install System Inetc Plugin Security Bypass Vulnerability

Nullsoft Scriptable Install System NSIS is the United States Nullsoft company's set of script-based open source system used to create Windows installer. Inetc Internet client is one of the Internet to provide file upload and download plug-ins. A security vulnerability exists in the Inetc plug-in...

CVE-2015-0941

CVE-2015-0941 : The Inetc plug‑in for NSIS does not validate SSL certificates, enabling MITM attacks that could spoof servers and potentially execute arbitrary code during download of Windows executables. Affected: NSIS Inetc plug‑in (used in FOE and other products). Impact: possible arbitrary co...

CVE-2015-0941

The Inetc plugin for Nullsoft Scriptable Install System NSIS, as used in CERT/CC Failure Observation Engine FOE and other products, does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and possibly execute arbitrary code by sending a craft...

CVE-2015-0941: Undefined Security Weakness

The Inetc plugin for Nullsoft Scriptable Install System NSIS, as used in CERT/CC Failure Observation Engine FOE and other products, does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and possibly execute arbitrary code by sending a craft...