CVE-2017-2266

CVE-2017-2266 concerns FileCapsule Deluxe Portable and its Encrypted Files in Self-Decryption Format. The vulnerability is an untrusted search path that could allow arbitrary code execution via a Trojan horse DLL loaded from an unspecified directory, with impact as described in the CVE records. A...

CVE-2017-2269

The CVE-2017-2269 issue affects FileCapsule Deluxe Portable Ver.2.0.9 and earlier, described as an untrusted search path vulnerability where a Trojan DLL in an unspecified directory can be loaded to gain privileges. Multiple connected sources indicate this could allow arbitrary code execution wit...

CVE-2017-2246

The CVE-2017-2246 entry concerns Lhaz Installer (version 2.4.0 and earlier). The vulnerability is an untrusted search path that allows an attacker to gain privileges by placing a Trojan DLL in an unspecified directory, enabling arbitrary code execution with the invoking user’s privileges via the ...

CVE-2017-2272

AttacheCase self-extracting encrypted files are affected by an untrusted DLL search path (CWE-427) vulnerability. Versions up to 3.2.2.6 are vulnerable; exploitation allows arbitrary code execution via a Trojan DLL loaded from an untrusted directory. Affected products include AttacheCase with CVE...

Design/Logic Flaw

Untrusted search path vulnerability in Installer of CASL II simulator self-extract format allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory...

Design/Logic Flaw

Untrusted search path vulnerability in Installer of Shinseiyo Sogo Soft 4.8A and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory...

CVE-2017-2208

CVE-2017-2208 is an untrusted search path vulnerability in the Installer of the Electronic tendering and bid opening system (available before 12 June 2017). The root cause is an insecure search path that allows a specially crafted executable in an unspecified directory to be executed, enabling ar...

CVE-2017-2229

CVE-2017-2229: Untrusted search path vulnerability in Douroshisetu Kihon Data Sakusei System Ver1.0.2 and earlier allows privilege escalation via a Trojan horse DLL in an untrusted directory. Root cause: insecure DLL search path (CWE-427) related to the installer/load process. Affected product: D...

CVE-2017-4987

In EMC VNX2 versions prior to OE for File 8.1.9.211 and VNX1 versions prior to OE for File 7.1.80.8, a local authenticated user can load a maliciously crafted file in the search path which may potentially allow the attacker to execute arbitrary code on the targeted VNX Control Station system, aka...

Installer of electronic tendering and bid opening system provided by Acquisition, Technology & Logistics Agency may insecurely invoke an executable file

Overview Installer of electronic tendering and bid opening system provided by Acquisition, Technology & Logistics Agency contains an issue with the search path for executable files, which may lead to insecurely invoking an executable file. Note that this vulnerability is different from JVN7551446...

Design/Logic Flaw

Untrusted search path vulnerability in the installer of SaAT Netizen ver.1.2.10.510 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory...

CVE-2017-2209

The CVE-2017-2209 entry concerns the installer of Houkokusyo Sakusei Shien Tool. Multiple sources describe an untrusted DLL search path that may allow an attacker to load a Trojan horse DLL, enabling arbitrary code execution with the privileges of the installer. Affected are installer components ...

CVE-2017-2177

CVE-2017-2177 affects the installer for Shogyo Touki Denshi Ninsho Software, versions 1.7 and earlier. The vulnerability is an untrusted search path that allows an attacker to gain privileges by placing a Trojan horse DLL in an unspecified directory. Connected sources (JVN/JVNDB, CNVD, CVE record...

CVE-2017-2212

CVE-2017-2212 affects TKY2JGD1379.EXE (TKY2JGD version 1.3.79). The untrusted search path vulnerability (CWE-427) in the installer may allow an attacker to gain privileges by placing a malicious DLL in a directory searched by the installer, enabling arbitrary code execution with the caller’s priv...

CVE-2017-2213

The CVE-2017-2213 entry concerns SemiDynaEXE2008.EXE (version 1.0.2). The vulnerability is an untrusted search path that allows privilege escalation via a Trojan horse DLL located in an unspecified directory. Affected component is the installer/executable SemiDynaEXE2008.EXE; root cause is insecu...

CVE-2016-7818

CVE-2016-7818 is an Untrusted search path vulnerability in Japan Pension Service installers: Specification check program (social insurance) v9.00 and earlier, TODOKESHO print program v5.00 and earlier, Device data encryption program v1.00 and earlier, and TODOKESHO creation program v15.00 and ear...

RW-5100 tool to verify execution environment may insecurely load Dynamic Link Libraries

Overview RW-5100 tool to verify execution environment for IC Card Reader/Writer devices provided by Sharp Corporation contains an issue with the DLL search path, which may lead to insecurely load Dynamic Link Libraries CWE-427. Yuji Tounai of NTT Communications Corporation and BlackWingCat of...

CVE-2017-2107

CVE-2017-2107 concerns Self-extracting archives created by the 7-ZIP32.DLL library (versions 9.22.00.01 and earlier). The root cause is an insecure DLL search path (CWE-427) in the self-extracting archive loading process, allowing an attacker to execute arbitrary code with user privileges if a Tr...

CVE-2016-4846

Untrusted search path vulnerability in the installer of PhishWall Client Internet Explorer before 3.7.8.2...

HelpDEZk Cross-Site Request Forgery Vulnerability

HelpDEZk is a suite of PHP-based software for managing requests, events. A cross-site request forgery vulnerability exists in admin/home/person/ in HelpDEZk. It allows remote attackers to construct malicious URIs and trick users into parsing them, which can be used to perform malicious actions an...