Sandboxie installer DLL hijacking vulnerability

Sandboxie is a virtualization software from the American company Sandboxie Holdings. The software supports running other applications in an isolated space and prevents programs from making changes to the system.Sandboxie installer is an installer for Sandboxie. A DLL hijacking vulnerability exist...

CVE-2017-12480

Sandboxie installer 5071703 has a DLL Hijacking or Unsafe DLL Loading Vulnerability via a Trojan horse dwmapi.dll or profapi.dll file in an AppData\Local\Temp directory...

CVE-2017-12480

The CVE-2017-12480 entry concerns Sandboxie installer version 5071703 with a DLL hijacking/unsafe DLL loading vulnerability. An attacker could place a malicious dwmapi.dll or profapi.dll in an AppData\Local\Temp directory, leading to code execution when the installer loads the DLL. The issue is d...

CVE-2017-12480: Untrusted Search Path

Sandboxie installer 5071703 has a DLL Hijacking or Unsafe DLL Loading Vulnerability via a Trojan horse dwmapi.dll or profapi.dll file in an AppData\Local\Temp directory...

CVE-2015-7543

CVE-2015-7543 affects aRts 1.5.10 and kdelibs3 3.5.10 and earlier. The issue stems from insecure creation of temporary directories, allowing a local attacker to hijack IPC by pre-creating the temporary directory. Several advisories note this vulnerability and provide patches/remediations: SUSE-SU...

Parallels Desktop - Virtual Machine Escape

Title: Parallels Desktop - Virtual Machine Escape + Product: Parallels + Vendor: http://www.parallels.com/products/desktop/ + Affected Versions: All Version Author : Mohammad Reza Espargham Linkedin : https://ir.linkedin.com/in/rezasp E-Mail : meatrezadotes , reza.esparghamatgmaildotcom Website :...

Roundcube Webmail Information Disclosure Vulnerability (CNVD-2017-08084)

RoundCube Webmail is a browser-based IMAP client mail client that supports address book management, message searching, spell checking and more. An information disclosure vulnerability exists in Roundcube Webmail version 1.1.x before 1.1.2. A remote attacker can exploit this vulnerability by readi...

UBUNTU-CVE-2015-5383

Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to obtain sensitive information by reading files in the 1 config, 2 temp, or 3 logs directory...

CVE-2015-5383

Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to obtain sensitive information by reading files in the 1 config, 2 temp, or 3 logs directory...

CVE-2015-5383: Exposure of Sensitive Information to an Unauthorized Actor

Roundcube Webmail 1.1.x before 1.1.2 allows remote attackers to obtain sensitive information by reading files in the 1 config, 2 temp, or 3 logs directory...

PT-2017-6850

Name of the Vulnerable Software and Affected Versions Roundcube Webmail versions 1.1.x through 1.1.1 Description The issue allows remote attackers to obtain sensitive information by reading files in the config, temp, or logs directory. Recommendations For Roundcube Webmail versions 1.1.x through...

Apache Struts Jakarta Multipart Parser OGNL Injection

This module requires Metasploit: http://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework require 'msf/core' class MetasploitModule 'Apache Struts Jakarta Multipart Parser OGNL Injection', 'Description' = %q This module exploits a remote code execution...

Get the Vehicle Information Such as the VIN from the Target Module

Post Module to query DTCs, Some common engine info and Vehicle Info. It returns such things as engine speed, coolant temp, Diagnostic Trouble Codes as well as All info stored by Mode $09 Vehicle Info, VIN, etc This module requires Metasploit: https://metasploit.com/download Current source:...

Sample Module to Flood Temp Gauge on 2006 Malibu

Simple sample temp flood for the 2006 Malibu This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Sample Module to Flood Temp Gauge on 2006 Malibu', 'Description' = %q Simple sample temp flood for t...

WinSparkle issue where registry value is not validated

Overview When an application that uses WinSparkle is launched, it checks the directory used by WinSparkle for temporary files and deletes any temporary files. This directory path is specified in a registry key. In a situation where an attacker has modified the specific registry value used by this...

CVE-2016-7489

Teradata Virtual Machine Community Edition v15.10's perl script /opt/teradata/gsctools/bin/t2a.pl creates files in /tmp in an insecure manner, this may lead to elevated code execution...

Arbitrary File Deletion Vulnerability in the showDeleteContactTempFile() Function of Tibus Communications Call Center System

The core of the Tibco call center system is a communication-based enterprise internal and external communication system. An arbitrary file deletion vulnerability exists in the showDeleteContactTempFile function of the Tibco Call Center System. Vulnerability file:...

Apache Tomcat on RedHat Based Systems Insecure Temp Config Privilege Escalation

This module exploits a vulnerability in RedHat based systems where improper file permissions are applied to /usr/lib/tmpfiles.d/tomcat.conf for Apache Tomcat versions before 7.0.54-8. This may also work against The configuration files in tmpfiles.d are used by systemd-tmpfiles to manage temporary...

DLA-588-1 mongodb - security update

Bulletin has no description...

Firefox ESR Data Compromise

The vulnerability in the maintenanceinstaller.exe installer of Mozilla Firefox ESR allows local users to elevate their privileges by placing a Trojan DLL file in the temporary folder during the update process...