CVE-2012-1849

CVE-2012-1849 is an Untrusted search path DLL loading vulnerability in Microsoft Lync 2010 and related components (Attendee/Attendant). The root cause is loading of a Trojan horse DLL from the current working directory, demonstrated with a .ocsmeet file, enabling local privilege elevation. Affect...

Design/Logic Flaw

Untrusted search path vulnerability in VMware vMA 4.x and 5.x before 5.0.0.2 allows local users to gain privileges via a Trojan horse DLL in the current working directory...

CVE-2012-1824

CVE-2012-1824 affects Measuresoft ScadaPro Server and Client prior to version 4.0.0. The vulnerability is an Untrusted Search Path (DLL hijack) that lets a local attacker place a Trojan horse DLL in the current working directory to gain privileges. OpenVAS/Red Hat/NVD entries confirm a code execu...

CVE-2012-1819

CVE-2012-1819 describes an Untrusted Search Path (DLL hijack) vulnerability in WellinTech KingView 6.53. An attacker with file-system access could place a malicious DLL in the application's working directory to achieve arbitrary code execution. ICS-CERT notes the vulnerability is remotely exploit...

CVE-2012-0223

CVE-2012-0223 is a DLL hijacking vulnerability in 7-Technologies TERMIS, affecting TERMIS v2.10 and earlier. An attacker could cause local privilege escalation by placing a malicious DLL in the current working directory (Uncontrolled Search Path Element). A patch has been released by 7T (TERMIS_2...

CVE-2012-0315

CVE-2012-0315 (ALFTP) – Affected software and cause : ESTsoft ALFtp prior to 5.31 is vulnerable to an untrusted search path issue that lets local users gain privileges by loading a Trojan horse executable (e.g., README.exe) when a user opens an extensionless file like README in the same directory...

CVE-2012-0224

CVE-2012-0224 = Untrusted search path vulnerability in 7-Technologies AQUIS 1.5 and earlier allows local privilege escalation via a Trojan horse DLL in the current working directory. Connected docs confirm related TERMIS DLL-hijacking (CVE-2012-0223) and note a vendor patch exists for TERMIS 2.10...

[SECURITY] CVE-2011-4367 Apache MyFaces information disclosure vulnerability

-------------------------------------------------------------------------------------------------- CVE-2011-4367: Apache MyFaces information disclosure vulnerability Severity: Important Vendor: The Apache Software Foundation Versions Affected: MyFaces Core 2.0.1 to 2.0.11 MyFaces Core 2.1.0 to...

CVE-2012-0035

CVE-2012-0035 is an untrusted search path vulnerability in EDE (CEDET) that allows a local user to escalate privileges by crafting a Project.ede file loaded from a project directory. The issue affects CEDET’s EDE in Emacs contexts (notably Emacs 23.x with CEDET before 1.0.1); analysis from Gentoo...

KLA10170 LPE vulnerability in Emacs

An untrusted path vulnerability was found in GNU Emacs. By exploiting this vulnerability malicious users can gain privileges. This vulnerability can be exploited locally via a specially designed Lisp expression. Original advisories - Related products GNU-Emacs CVE list CVE-2012-0035 critical...

CVE-2010-5082

CVE-2010-5082 affects the Windows Color Control Panel (colorcpl.exe) on Windows Server 2008 SP2, R2, and R2 SP1. The vulnerability stems from insecure library loading where sti.dll can be loaded from the current working directory, enabling privilege escalation when a malicious directory also cont...

KLA10304 LPE vulnerability in RSA SecurID Software Token

An untrusted path vulnerability was found in the RSA SecurID Software Token. By exploiting this vulnerability malicious users can gain privileges. This vulnerability can be exploited locally via a DLL hijack. Original advisories - Related products RSA-SecurID-Software-Token CVE list CVE-2011-4141...

CVE-2011-2019

Untrusted search path vulnerability in Microsoft Internet Explorer 9 on Windows Server 2008 R2 and R2 SP1 and Windows 7 Gold and SP1 allows local users to gain privileges via a Trojan horse DLL in the current working directory, as demonstrated by a directory that contains an HTML file, aka...

CVE-2011-4266

CVE-2011-4266 affects FFFTP prior to version 1.98d, via an untrusted search path that lets local users gain privileges using a Trojan horse executable in the same directory read to load an extensionless file (demonstrated with README.exe). The vulnerability is rooted in unsafe loading of executab...

Mandriva Linux Security Advisory : mozilla (MDVSA-2011:169)

Security issues were identified and fixed in mozilla NSS, firefox and thunderbird : 22 weak 512-bit certificates issued by the DigiCert Sdn. Bhd certificate authority has been revoked from the root CA storage. This was fixed with rootcerts-20111103.00 and nss-3.13. DigiCert Sdn. Bhd is a Malaysia...

CVE-2011-3640

CVE-2011-3640 describes an untrusted search path vulnerability in Mozilla Network Security Services (NSS) as used in Google Chrome

CVE-2011-3360

Untrusted search path vulnerability in Wireshark 1.4.x before 1.4.9 and 1.6.x before 1.6.2 allows local users to gain privileges via a Trojan horse Lua script in an unspecified directory...

Design/Logic Flaw

Untrusted search path vulnerability in Microsoft Office 2003 SP3 and 2007 SP2 allows local users to gain privileges via a Trojan horse DLL in the current working directory, as demonstrated by a directory that contains a .doc, .ppt, or .xls file, aka "Office Component Insecure Library Loading...

Discuz 1.5 storm WEB path vulnerability-vulnerability warning-the black bar safety net

Test environment: discuz X1. 5+nginx 1.0 漏洞 文件 source/function/functioncore.php that Code: $G'setting''domain''app''default' && $content = pregreplace"/a href="^"+"/e", "rewriteoutput'sitedefault', 0, '".$ G'setting''domain''app''default'.$ port.$ G'siteroot'."', '\\1'", $content; Use code:...

CVE-2011-2980

Untrusted search path vulnerability in the ThinkPadSensor::Startup function in Mozilla Firefox before 3.6.20, Thunderbird 3.x before 3.1.12, allows local users to gain privileges by leveraging write access in an unspecified directory to place a Trojan horse DLL that is loaded into the running...