CWE-427 Archives - CVE Vulnerability

CVE-2018-8090

Sun, 26 Feb 2023 06:51:17 +0000

Quick Heal Total Security 64 bit 17.00 (QHTS64.exe), (QHTSFT64.exe) – Version 10.0.1.38; Quick Heal Total Security 32 bit 17.00 (QHTS32.exe), (QHTSFT32.exe) – Version 10.0.1.38; Quick Heal Internet Security 64 bit 17.00 (QHIS64.exe), (QHISFT64.exe) – Version 10.0.0.37; Quick Heal Internet Security 32 bit 17.00 (QHIS32.exe), (QHISFT32.exe) – Version 10.0.0.37; Quick Heal AntiVirus Pro 64 bit 17.00 (QHAV64.exe), (QHAVFT64.exe) – Version 10.0.0.37; and Quick Heal AntiVirus Pro 32 bit 17.00 (QHAV32.exe), (QHAVFT32.exe) – Version 10.0.0.37 allow DLL Hijacking because of Insecure Library Loading.

The post CVE-2018-8090 appeared first on CVE Vulnerability.

CVE-2018-7840

Sun, 26 Feb 2023 06:51:11 +0000

A Uncontrolled Search Path Element (CWE-427) vulnerability exists in VideoXpert OpsCenter versions prior to 3.1 which could allow an attacker to cause the system to call an incorrect DLL.

The post CVE-2018-7840 appeared first on CVE Vulnerability.

CVE-2018-7799

Sun, 26 Feb 2023 06:51:10 +0000

A DLL hijacking vulnerability exists in Schneider Electric Software Update (SESU), all versions prior to V2.2.0, which could allow an attacker to execute arbitrary code on the targeted system when placing a specific DLL file.

The post CVE-2018-7799 appeared first on CVE Vulnerability.

CVE-2018-6765

Sun, 26 Feb 2023 06:50:49 +0000

Swisscom MySwisscomAssistant 2.17.1.1065 contains a vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary code on the targeted system. This vulnerability exists due to the way .dll files are loaded. It allows an attacker to load a .dll of the attacker’s choosing that could execute arbitrary code without the user’s knowledge. The specific flaw exists within the handling of several DLLs (dwmapi.dll, IPHLPAPI.DLL, WindowsCodecs.dll, RpcRtRemote.dll, CRYPTSP.dll, rasadhlp.dll, DNSAPI.dll, ntmarta.dll, netbios.dll, olepro32.dll, security.dll, winhttp.dll, WINSTA.dll) loaded by the MySwisscomAssistant_Setup.exe process.

The post CVE-2018-6765 appeared first on CVE Vulnerability.

CVE-2018-6766

Sun, 26 Feb 2023 06:50:49 +0000

Swisscom TVMediaHelper 1.1.0.50 contains a vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary code on the targeted system. This vulnerability exists due to the way .dll files are loaded. It allows an attacker to load a .dll of the attacker’s choosing that could execute arbitrary code without the user’s knowledge. The specific flaw exists within the handling of several DLLs (dwmapi.dll, PROPSYS.dll, cscapi.dll, SAMLIB.dll, netbios.dll, winhttp.dll, security.dll, ntmarta.dll, WindowsCodecs.dll, apphelp.dll) loaded by the SwisscomTVMediaHelper.exe process.

The post CVE-2018-6766 appeared first on CVE Vulnerability.

CVE-2018-5457

Sun, 26 Feb 2023 06:50:21 +0000

A uncontrolled search path element issue was discovered in Vyaire Medical CareFusion Upgrade Utility used with Windows XP systems, Versions 2.0.2.2 and prior versions. A successful exploit of this vulnerability requires the local user to install a crafted DLL on the target machine. The application loads the DLL and gives the attacker access at the same privilege level as the application.

The post CVE-2018-5457 appeared first on CVE Vulnerability.

CVE-2018-5235

Sun, 26 Feb 2023 06:50:15 +0000

Norton Utilities (prior to 16.0.3.44) may be susceptible to a DLL Preloading vulnerability, which is a type of issue that can occur when an application looks to call a DLL for execution and an attacker provides a malicious DLL to use instead. Depending on how the application is configured, it will generally follow a specific search path to locate the DLL. The vulnerability can be exploited by a simple file write (or potentially an over-write) which results in a foreign DLL running under the context of the application.

The post CVE-2018-5235 appeared first on CVE Vulnerability.

CVE-2018-5238

Sun, 26 Feb 2023 06:50:15 +0000

Norton Power Eraser (prior to 5.3.0.24) and SymDiag (prior to 2.1.242) may be susceptible to a DLL Preloading vulnerability, which is a type of issue that can occur when an application looks to call a DLL for execution and an attacker provides a malicious DLL to use instead. Depending on how the application is configured, it will generally follow a specific search path to locate the DLL. The vulnerability can be exploited by a simple file write (or potentially an over-write) which results in a foreign DLL running under the context of the application.

The post CVE-2018-5238 appeared first on CVE Vulnerability.

CVE-2018-4938

Sun, 26 Feb 2023 06:50:07 +0000

Adobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have an exploitable Insecure Library Loading vulnerability. Successful exploitation could lead to local privilege escalation.

The post CVE-2018-4938 appeared first on CVE Vulnerability.

CVE-2018-3649

Sun, 26 Feb 2023 06:49:45 +0000

DLL injection vulnerability in the installation executables (Autorun.exe and Setup.exe) for Intel’s wireless drivers and related software in Intel Dual Band Wireless-AC, Tri-Band Wireless-AC and Wireless-AC family of products allows a local attacker to cause escalation of privilege via remote code execution.

The post CVE-2018-3649 appeared first on CVE Vulnerability.