DEBIAN-CVE-2015-9267

Nullsoft Scriptable Install System NSIS before 2.49 uses temporary folder locations that allow unprivileged local users to overwrite files. This allows a local attack in which either a plugin or the uninstaller can be replaced by a Trojan horse program...

CVE-2015-9267

CVE-2015-9267 affects NSIS (Nullsoft Scriptable Install System) before 2.49. The vulnerability arises from the use of temporary folder locations, enabling unprivileged local users to overwrite files, which can allow replacing either an installer plugin or the uninstaller with a trojan. In practic...

CVE-2015-9267

Nullsoft Scriptable Install System NSIS before 2.49 uses temporary folder locations that allow unprivileged local users to overwrite files. This allows a local attack in which either a plugin or the uninstaller can be replaced by a Trojan horse program...

CVE-2015-9267

Nullsoft Scriptable Install System NSIS before 2.49 uses temporary folder locations that allow unprivileged local users to overwrite files. This allows a local attack in which either a plugin or the uninstaller can be replaced by a Trojan horse program...

CVE-2015-9267: Improper Privilege Management

Nullsoft Scriptable Install System NSIS before 2.49 uses temporary folder locations that allow unprivileged local users to overwrite files. This allows a local attack in which either a plugin or the uninstaller can be replaced by a Trojan horse program...

Code injection

PCProtect Anti-Virus v4.8.35 has "Everyone: F" permission for %PROGRAMFILESX86%\PCProtect, which allows local users to gain privileges by replacing an executable file with a Trojan horse...

CVE-2018-17776

PCProtect Anti-Virus v4.8.35 has "Everyone: F" permission for %PROGRAMFILESX86%\PCProtect, which allows local users to gain privileges by replacing an executable file with a Trojan horse...

Threat Roundup Sept 21 - 28

Today, as we do every week, Talos is giving you a glimpse into the most prevalent threats we’ve observed this week — covering the dates between Sept. 21 and 28. As with previous roundups, this post isn’t meant to be an in-depth analysis. Instead, we will summarize the threats we’ve observed by...

CVE-2018-17776: Incorrect Permission Assignment for Critical Resource

PCProtect Anti-Virus v4.8.35 has "Everyone: F" permission for %PROGRAMFILESX86%\PCProtect, which allows local users to gain privileges by replacing an executable file with a Trojan horse...

Directory traversal

The installer for the Alcatel OSPREY3MINI Modem component on EE EE40VB 4G mobile broadband modems with firmware before EE400002.0045 sets weak permissions Everyone:Full Control for the "Web Connecton\EE40" and "Web Connecton\EE40\BackgroundService" directories, which allows local users to gain...

CVE-2018-14327

The installer for the Alcatel OSPREY3MINI Modem component on EE EE40VB 4G mobile broadband modems with firmware before EE400002.0045 sets weak permissions Everyone:Full Control for the "Web Connecton\EE40" and "Web Connecton\EE40\BackgroundService" directories, which allows local users to gain...

CVE-2018-14327

The installer for the Alcatel OSPREY3MINI Modem component on EE EE40VB 4G mobile broadband modems with firmware before EE400002.0045 sets weak permissions Everyone:Full Control for the "Web Connecton\EE40" and "Web Connecton\EE40\BackgroundService" directories, which allows local users to gain...

Banking trojan found in call recorder app on Play Store – stole over €10,000

By Waqas Android is one of the most vulnerable mobile operating systems with hackers developing new Android malware and banking trojan every 17 seconds. Then, there is Google and questionable security measures to protect users from sophisticated and persistent malware attacks. Recently, Lukas...

A week in security (September 10 – 16)

Last week on Malwarebytes Labs, we assessed the security of a portable router, identified ways to waste a scammer's time, named the many faces of omnichannel fraud, questioned the security of 2FAs, profiled a massive tech support scam operation, and exposed a new HMRC phishing campaign. Other...

Threat Roundup for September 7 to September 14

Today, as we do every week, Talos is giving you a glimpse into the most prevalent threats we’ve observed this week — covering the dates between Sept. 7 and 14. As with previous roundups, this post isn’t meant to be an in-depth analysis. Instead, we will summarize the threats we’ve observed by...

OilRig APT Continues Its Ongoing Malware Evolution

OilRig, an APT group believed to have ties to Iran, has been spotted in yet another campaign in the Middle East – this time targeting victims within an undisclosed government using an evolved variant of the BondUpdater trojan. The group, which is also called Cobalt Gypsy, Crambus, Helix Kitten or...

Osiris Banking Trojan Displays Modern Malware Innovation

After staying dormant for few years, the Kronos banking trojan resurfaced in July in a form dubbed Osiris. A wider analysis of how the banking trojan is evolving shows innovative development on the part of its authors, with an eye to broader malware trends. Osiris first appeared in July in three...

Command Execution Vulnerability in ThinkLC Backend

ThinkLC is a classified information system developed by SaxueCMS. A command execution vulnerability exists in the backend of ThinkLC, which can be exploited by an attacker to upload a Trojan horse file at the upload template in the backend and gain control of the web server...

LuckyMouse signs malicious NDISProxy driver with certificate of Chinese IT company

What happened? Since March 2018 we have discovered several infections where a previously unknown Trojan was injected into the lsass.exe system process memory. These implants were injected by the digitally signed 32- and 64-bit network filtering driver NDISProxy. Interestingly, this driver is sign...

Google Chrome MEGA Extension Trojan - Mac OS X

Detection of a trojaned MEGA extension for Google Chrome. SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...