Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
388 results · page 1 of 8
Jun 3, 2025A vulnerability was found in Jrohy trojan up to 2.15.3.CVE-2025-5525 · Other software · Jrohy · reported by VulDBMedium 6.3
A vulnerability was found in Jrohy trojan up to 2.15.3. It has been declared as critical. This vulnerability affects the function LogChan of the file trojan/util/linux.go. The manipulation of the argument c leads to os command injection. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitation appears to be difficult. The exploit has been disclosed to the public and may be used.
- Product
- trojan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 4, 2025Wondershare filmora 9.2.11 is affected by Trojan Dll hijacking leading to privilege escalation.CVE-2020-23438 · Other software · Wondershare · reported by MITREHigh 7.8
Wondershare filmora 9.2.11 is affected by Trojan Dll hijacking leading to privilege escalation.
- Product
- Filmora
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 7, 2025An issue in trojan v.2.0.0 through v.2.15.3 allows a remote attacker to escalate privileges via the initialization interface /auth/register.CVE-2024-55215 · Other software · Jrohy · reported by MITRECritical 9.8
An issue in trojan v.2.0.0 through v.2.15.3 allows a remote attacker to escalate privileges via the initialization interface /auth/register.
- Product
- Trojan
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 26, 2024In Foxit PDF Reader before 2024.3, and PDF Editor before 2024.3 and 13.x before 13.1.4, an attacker can replace an update file with a Trojan horse via side loadCVE-2024-41605 · Other software · foxitsoftware · reported by MITREHigh 8.4
In Foxit PDF Reader before 2024.3, and PDF Editor before 2024.3 and 13.x before 13.1.4, an attacker can replace an update file with a Trojan horse via side loading, because the update service lacks integrity validation for the updater. Attacker-controlled code may thus be executed.
- Product
- foxit_pdf_editor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 13, 2023Diasoft File Replication Pro 7.5.0 allows attackers to escalate privileges by replacing a legitimate file with a Trojan horse that will be executed as LocalSystCVE-2023-26918 · Other software · Filereplicationpro · reported by MITRECritical 9.8
Diasoft File Replication Pro 7.5.0 allows attackers to escalate privileges by replacing a legitimate file with a Trojan horse that will be executed as LocalSystem. This occurs because %ProgramFiles%\FileReplicationPro allows Everyone:(F) access.
- Product
- File Replication Pro
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comfilereplicationpro.com
Mar 18, 2023ONLYOFFICE Docs through 7.3 on certain Linux distributions allows local users to gain privileges via a Trojan horse libgcc_s.so.1 in the current working directoCVE-2022-48422 · Other software · Onlyoffice · reported by MITREHigh 7.8
ONLYOFFICE Docs through 7.3 on certain Linux distributions allows local users to gain privileges via a Trojan horse libgcc_s.so.1 in the current working directory, which may be any directory in which an ONLYOFFICE document is located.
- Product
- Document Server
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordforum.onlyoffice.comforum.onlyoffice.com
Feb 14, 2023Untrusted search path vulnerability in ELECOM Camera Assistant 1.00 and QuickFileDealer Ver.1.2.1 and earlier allows an attacker to gain privileges via a TrojanCVE-2023-22368 · Other software · ELECOM CO.,LTD. · reported by vultures@jpcert.or.jpHigh 7.8
Untrusted search path vulnerability in ELECOM Camera Assistant 1.00 and QuickFileDealer Ver.1.2.1 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
- Product
- ELECOM Camera Assistant and QuickFileDealer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 21, 2022Untrusted search path vulnerability in Baidunetdisk Version 7.4.3 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified dirCVE-2021-36631 · Other software · Baidu · reported by MITREMedium 6.7
Untrusted search path vulnerability in Baidunetdisk Version 7.4.3 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
- Product
- Baidunetdisk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 24, 2022Untrusted search path vulnerability in the installer of Content Transfer (for Windows) Ver.1.3 and prior allows an attacker to gain privileges via a Trojan horsCVE-2022-41796 · Other software · Sony Corporation · reported by vultures@jpcert.or.jpHigh 7.8
Untrusted search path vulnerability in the installer of Content Transfer (for Windows) Ver.1.3 and prior allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
- Product
- Content Transfer (for Windows)
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 8, 2022Untrusted search path vulnerability in the installer of Device Software Manager prior to Ver.2.20.3.0 allows an attacker to gain privileges via a Trojan horse DCVE-2022-36403 · Other software · RICOH COMPANY, LTD. · reported by vultures@jpcert.or.jpHigh 7.8
Untrusted search path vulnerability in the installer of Device Software Manager prior to Ver.2.20.3.0 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
- Product
- Installer of Device Software Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2022An Access Control vulnerability exists in BigAntSoft BigAnt office messenger 5.6 via im_webserver, which could let a malicious user upload PHP Trojan files.CVE-2021-43430 · Other software · Bigantsoft · reported by MITREHigh 8.8
An Access Control vulnerability exists in BigAntSoft BigAnt office messenger 5.6 via im_webserver, which could let a malicious user upload PHP Trojan files.
- Product
- Bigant Office Messenger 5
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2022Untrusted search path vulnerability in AttacheCase ver.3.6.1.0 and earlier allows an attacker to gain privileges and execute arbitrary code via a Trojan horse DCVE-2022-28128 · Other software · HiBARA Software · reported by vultures@jpcert.or.jpHigh 7.8
Untrusted search path vulnerability in AttacheCase ver.3.6.1.0 and earlier allows an attacker to gain privileges and execute arbitrary code via a Trojan horse DLL in an unspecified directory.
- Product
- AttacheCase
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 31, 2022Untrusted search path vulnerability in AttacheCase ver.4.0.2.7 and earlier allows an attacker to gain privileges and execute arbitrary code via a Trojan horse DCVE-2022-25348 · Other software · HiBARA Software · reported by vultures@jpcert.or.jpHigh 7.8
Untrusted search path vulnerability in AttacheCase ver.4.0.2.7 and earlier allows an attacker to gain privileges and execute arbitrary code via a Trojan horse DLL in an unspecified directory.
- Product
- AttacheCase
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 15, 2022CyberArk Endpoint Privilege Manager (EPM) through 11.5.3.328 before 2021-12-20 allows a local user to gain elevated privileges via a Trojan horse Procmon64.exe CVE-2021-44049 · Other software · Cyberark · reported by MITREHigh 7.8
CyberArk Endpoint Privilege Manager (EPM) through 11.5.3.328 before 2021-12-20 allows a local user to gain elevated privileges via a Trojan horse Procmon64.exe in the user's Temp directory.
- Product
- Endpoint Privilege Manager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.cyberark.comhencohen10.medium.com
Sep 27, 2021ASUS ROG Armoury Crate Lite before 4.2.10 allows local users to gain privileges by placing a Trojan horse file in the publicly writable %PROGRAMDATA%\ASUS\GaminCVE-2021-40981 · Network & remote access · Asus · reported by MITREHigh 7.3
ASUS ROG Armoury Crate Lite before 4.2.10 allows local users to gain privileges by placing a Trojan horse file in the publicly writable %PROGRAMDATA%\ASUS\GamingCenterLib directory.
- Product
- Armoury Crate Lite Service
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 11, 2021Encode.pm, as distributed in Perl through 5.34.0, allows local users to gain privileges via a Trojan horse Encode::ConfigLocal library (in the current working dCVE-2021-36770 · Other software · P5-encode Project · reported by MITREHigh 7.8
Encode.pm, as distributed in Perl through 5.34.0, allows local users to gain privileges via a Trojan horse Encode::ConfigLocal library (in the current working directory) that preempts dynamic module loading. Exploitation requires an unusual configuration, and certain 2021 versions of Encode.pm (3.05 through 3.11). This issue occurs because the || operator evaluates @INC in a scalar context, and thus @INC has only an integer value.
- Product
- P5-encode
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 19, 2021Checkmk before 1.6.0p17 allows local users to obtain SYSTEM privileges via a Trojan horse shell script in the %PROGRAMDATA%\checkmk\agent\local directory.CVE-2020-24908 · Other software · Checkmk · reported by MITREHigh 7.8
Checkmk before 1.6.0p17 allows local users to obtain SYSTEM privileges via a Trojan horse shell script in the %PROGRAMDATA%\checkmk\agent\local directory.
- Product
- Checkmk
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcompass-security.comcompass-security.com
Jan 13, 2021Untrusted search path vulnerability in the installer of SKYSEA Client View Ver.1.020.05b to Ver.16.001.01g allows an attacker to gain privileges via a Trojan hoCVE-2021-20616 · Other software · Sky Co., LTD. · reported by vultures@jpcert.or.jpHigh 7.8
Untrusted search path vulnerability in the installer of SKYSEA Client View Ver.1.020.05b to Ver.16.001.01g allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
- Product
- SKYSEA Client View
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpskyseaclientview.net
Dec 22, 2020Nanosystems SupRemo 4.1.3.2348 allows attackers to obtain LocalSystem access because File Manager can be used to rename Supremo.exe and then upload a Trojan horCVE-2020-25106 · Other software · Supremocontrol · reported by MITREHigh 7.8
Nanosystems SupRemo 4.1.3.2348 allows attackers to obtain LocalSystem access because File Manager can be used to rename Supremo.exe and then upload a Trojan horse with the Supremo.exe filename.
- Product
- Supremo
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Nov 24, 2020Untrusted search path vulnerability in the installers of multiple SEIKO EPSON products allows an attacker to gain privileges via a Trojan horse DLL in an unspecCVE-2020-5674 · Other software · SEIKO EPSON CORPORATION · reported by vultures@jpcert.or.jpHigh 7.8
Untrusted search path vulnerability in the installers of multiple SEIKO EPSON products allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
- Product
- the installers of multiple SEIKO EPSON products
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 2, 2020Dr.Fone 3.0.0 allows local users to gain privileges via a Trojan horse DriverInstall.exe because %PROGRAMFILES(X86)%\Wondershare\dr.fone\Library\DriverInstallerCVE-2020-27992 · Other software · Wondershare · reported by MITREHigh 7.8
Dr.Fone 3.0.0 allows local users to gain privileges via a Trojan horse DriverInstall.exe because %PROGRAMFILES(X86)%\Wondershare\dr.fone\Library\DriverInstaller has Full Control for BUILTIN\Users.
- Product
- Dr.fone
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddrfone.wondershare.compacketstormsecurity.com
Aug 20, 2020voidtools Everything before 1.4.1 Beta Nightly 2020-08-18 allows privilege escalation via a Trojan horse urlmon.dll file in the installation directory.CVE-2020-24567 · Other software · Voidtools · reported by MITREHigh 7.8
voidtools Everything before 1.4.1 Beta Nightly 2020-08-18 allows privilege escalation via a Trojan horse urlmon.dll file in the installation directory. NOTE: this is only relevant if low-privileged users can write to the installation directory, which may be considered a site-specific configuration error
- Product
- Everything
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordcymaera.comvoidtools.com
Jul 4, 2020In Python 3.6 through 3.6.10, 3.7 through 3.7.8, 3.8 through 3.8.4rc1, and 3.9 through 3.9.0b4 on Windows, a Trojan horse python3.dll might be used in cases wheCVE-2020-15523 · Other software · Siemens · reported by MITREHigh 7.8
In Python 3.6 through 3.6.10, 3.7 through 3.7.8, 3.8 through 3.8.4rc1, and 3.9 through 3.9.0b4 on Windows, a Trojan horse python3.dll might be used in cases where CPython is embedded in a native application. This occurs because python3X.dll may use an invalid search path for python3.dll loading (after Py_SetPath has been used). NOTE: this issue CANNOT occur when using python.exe from a standard (non-embedded) Python installation on Windows.
- Product
- SIMATIC S7-1500 CPU 1518-4 PN/DP MFP
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugs.python.orggithub.com
Jun 16, 2020I2P before 0.9.46 allows local users to gain privileges via a Trojan horse I2PSvc.exe file because of weak permissions on a certain %PROGRAMFILES% subdirectory.CVE-2020-13431 · Other software · Geti2p · reported by MITREHigh 7.8
I2P before 0.9.46 allows local users to gain privileges via a Trojan horse I2PSvc.exe file because of weak permissions on a certain %PROGRAMFILES% subdirectory.
- Product
- I2p
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.blazeinfosec.comgeti2p.net
Jun 7, 2020SolarWinds Advanced Monitoring Agent before 10.8.9 allows local users to gain privileges via a Trojan horse .exe file, because everyone can write to a certain .CVE-2020-13912 · Other software · Solarwinds · reported by MITREHigh 7.3
SolarWinds Advanced Monitoring Agent before 10.8.9 allows local users to gain privileges via a Trojan horse .exe file, because everyone can write to a certain .exe file.
- Product
- Advanced Monitoring Agent
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhansesecure.dehansesecure.de
Jan 20, 2020Gentoo Portage through 2.3.84 allows local users to place a Trojan horse plugin in the /usr/lib64/nagios/plugins directory by leveraging access to the nagios usCVE-2019-20384 · Other software · Gentoo · reported by MITREMedium 5.5
Gentoo Portage through 2.3.84 allows local users to place a Trojan horse plugin in the /usr/lib64/nagios/plugins directory by leveraging access to the nagios user account, because this directory is writable in between a call to emake and a call to fowners.
- Product
- Portage
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.combugs.gentoo.org
Dec 26, 2019Untrusted search path vulnerability in STAMP Workbench installer all versions allows an attacker to gain privileges via a Trojan horse DLL in an unspecified dirCVE-2019-6019 · Other software · INFORMATION-TECHNOLOGY PROMOTION AGENCY, JAPAN (IPA) · reported by vultures@jpcert.or.jpHigh 7.8
Untrusted search path vulnerability in STAMP Workbench installer all versions allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
- Product
- STAMP Workbench installer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 24, 2019Signal Desktop before 1.29.1 on Windows allows local users to gain privileges by creating a Trojan horse %SYSTEMDRIVE%\node_modules\.bin\wmic.exe file.CVE-2019-19954 · Other software · Signal · reported by MITREHigh 7.3
Signal Desktop before 1.29.1 on Windows allows local users to gain privileges by creating a Trojan horse %SYSTEMDRIVE%\node_modules\.bin\wmic.exe file.
- Product
- Signal-desktop
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordblog.mirch.iogithub.com
Dec 12, 2019The lodahs package 0.0.1 for Node.js is a Trojan horse, and may have been installed by persons who mistyped the lodash package name.CVE-2019-19771 · Other software · Lodahs Project · reported by MITREHigh 8.8
The lodahs package 0.0.1 for Node.js is a Trojan horse, and may have been installed by persons who mistyped the lodash package name. In particular, the Trojan horse finds and exfiltrates cryptocurrency wallets.
- Product
- Lodahs
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 14, 2019Scanguard through 2019-11-12 on Windows has Insecure Permissions for the installation directory, leading to privilege escalation via a Trojan horse executable fCVE-2019-18895 · Other software · Scanguard · reported by MITREHigh 7.8
Scanguard through 2019-11-12 on Windows has Insecure Permissions for the installation directory, leading to privilege escalation via a Trojan horse executable file.
- Product
- Scanguard Antivirus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhyp3rlinx.altervista.orgseclists.org
Oct 31, 2019autojump before 21.5.8 allows local users to gain privileges via a Trojan horse custom_install directory in the current working directory.CVE-2013-2012 · Other software · autojump · reported by Red HatHigh 7.3
autojump before 21.5.8 allows local users to gain privileges via a Trojan horse custom_install directory in the current working directory.
- Product
- autojump
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.combugzilla.redhat.com
Oct 31, 2019yum does not properly handle bad metadata, which allows an attacker to cause a denial of service and possibly have other unspecified impact via a Trojan horse fCVE-2013-1910 · Other software · yum · reported by Red HatCritical 9.8
yum does not properly handle bad metadata, which allows an attacker to cause a denial of service and possibly have other unspecified impact via a Trojan horse file in the metadata of a remote repository.
- Product
- yum
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordopenwall.comsecurityfocus.com
Jul 7, 2019The MSI installer for Python through 2.7.16 on Windows defaults to the C:\Python27 directory, which makes it easier for local users to deploy Trojan horse code.CVE-2019-13404 · Other software · Python · reported by MITREHigh 7.8
The MSI installer for Python through 2.7.16 on Windows defaults to the C:\Python27 directory, which makes it easier for local users to deploy Trojan horse code. (This also affects old 3.x releases before 3.5.) NOTE: the vendor's position is that it is the user's responsibility to ensure C:\Python27 access control or choose a different directory, because backwards compatibility requires that C:\Python27 remain the default for 2.7.x
- Product
- Python
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocs.python.orgdocs.python.org
Apr 30, 2019Zoho ManageEngine ADManager Plus 6.6 Build 6657 allows local users to gain privileges (after a reboot) by placing a Trojan horse file into the permissive bin diCVE-2018-19374 · Email & office · Zohocorp · reported by MITREHigh 7
Zoho ManageEngine ADManager Plus 6.6 Build 6657 allows local users to gain privileges (after a reboot) by placing a Trojan horse file into the permissive bin directory.
- Product
- Manageengine Admanager Plus
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordresearch.digitalinterruption.comresearch.digitalinterruption.com
Mar 12, 2019Untrusted search path vulnerability in The installer of Microsoft Teams allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directoryCVE-2019-5922 · Email & office · Microsoft · reported by vultures@jpcert.or.jpHigh 7.8
Untrusted search path vulnerability in The installer of Microsoft Teams allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
- Product
- The installer of Microsoft Teams
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpsecurityfocus.com
Mar 12, 2019Untrusted search path vulnerability in Windows 7 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.CVE-2019-5921 · Computers, phones & browsers · Microsoft · reported by vultures@jpcert.or.jpHigh 7.8
Untrusted search path vulnerability in Windows 7 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
- Product
- Windows 7
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpsecurityfocus.com
Feb 25, 2019DLL hijacking is possible in Sublime Text 3 version 3.1.1 build 3176 on 32-bit Windows platforms because a Trojan horse api-ms-win-core-fibers-l1-1-1.dll or apiCVE-2019-9116 · Other software · Sublimetext · reported by MITREHigh 7.8
DLL hijacking is possible in Sublime Text 3 version 3.1.1 build 3176 on 32-bit Windows platforms because a Trojan horse api-ms-win-core-fibers-l1-1-1.dll or api-ms-win-core-localization-l1-2-1.dll file may be loaded if a victim uses sublime_text.exe to open a .txt file within an attacker's %LOCALAPPDATA%\Temp\sublime_text folder. NOTE: the vendor's position is "This does not appear to be a bug with Sublime Text, but rather one with Windows that has been patched.
- Product
- Sublime Text 3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Feb 13, 2019Untrusted search path vulnerability in Self-Extracting Archives created by UNLHA32.DLL prior to Ver 3.00 allows an attacker to gain privileges via a Trojan horsCVE-2018-16189 · Other software · Micco · reported by vultures@jpcert.or.jpHigh 7.8
Untrusted search path vulnerability in Self-Extracting Archives created by UNLHA32.DLL prior to Ver 3.00 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
- Product
- Self-Extracting Archives created by UNLHA32.DLL
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 31, 2019The CaptivelPortal service on D-Link Central WiFiManager CWM-100 1.03 r0098 devices will load a Trojan horse "quserex.dll" from the CaptivelPortal.exe subdirectCVE-2018-15515 · Other software · Dlink · reported by MITREHigh 7.8
The CaptivelPortal service on D-Link Central WiFiManager CWM-100 1.03 r0098 devices will load a Trojan horse "quserex.dll" from the CaptivelPortal.exe subdirectory under the D-Link directory, which allows unprivileged local users to gain SYSTEM privileges.
- Product
- Central Wifimanager
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comseclists.org
Jan 9, 2019Untrusted search path vulnerability in the installer of MARKET SPEED Ver.16.4 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unsCVE-2018-16182 · Other software · Rakuten Securities, Inc. · reported by vultures@jpcert.or.jpHigh 7.8
Untrusted search path vulnerability in the installer of MARKET SPEED Ver.16.4 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
- Product
- The installer of MARKET SPEED
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 9, 2019Untrusted search path vulnerability in Installer of Mapping Tool 2.0.1.6 and 2.0.1.7 allows remote attackers to gain privileges via a Trojan horse DLL in an unsCVE-2018-16176 · Other software · Japan Atomic Energy Agency · reported by vultures@jpcert.or.jpHigh 7.8
Untrusted search path vulnerability in Installer of Mapping Tool 2.0.1.6 and 2.0.1.7 allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory.
- Product
- Installer of Mapping Tool
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 4, 2019An untrusted search path vulnerability in IBM i Access for Windows versions 7.1 and earlier on Windows can allow arbitrary code execution via a Trojan horse DLLCVE-2018-1888 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.3
An untrusted search path vulnerability in IBM i Access for Windows versions 7.1 and earlier on Windows can allow arbitrary code execution via a Trojan horse DLL in the current working directory, related to use of the LoadLibrary function. IBM X-Force ID: 152079.
- Product
- i Access for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecurityfocus.comexchange.xforce.ibmcloud.com
Nov 19, 2018BestXsoftware Best Free Keylogger before 6.0.0 allows local users to gain privileges via a Trojan horse "%PROGRAMFILES%\BFK 5.2.9\syscrb.exe" file because of inCVE-2018-18519 · Other software · Bestxsoftware · reported by MITREHigh 7.8
BestXsoftware Best Free Keylogger before 6.0.0 allows local users to gain privileges via a Trojan horse "%PROGRAMFILES%\BFK 5.2.9\syscrb.exe" file because of insecure permissions for the BUILTIN\Users group.
- Product
- Best Free Keylogger
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Nov 15, 2018Untrusted search path vulnerability in Baidu Browser Version 43.23.1000.500 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspeCVE-2018-0692 · Other software · Baidu, Inc. · reported by vultures@jpcert.or.jpHigh 7.8
Untrusted search path vulnerability in Baidu Browser Version 43.23.1000.500 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
- Product
- Baidu Browser
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Oct 15, 2018NoMachine before 5.3.27 and 6.x before 6.3.6 allows attackers to gain privileges via a Trojan horse wintab32.dll file located in the same directory as a .nxs fiCVE-2018-17980 · Other software · Nomachine · reported by MITREHigh 7.8
NoMachine before 5.3.27 and 6.x before 6.3.6 allows attackers to gain privileges via a Trojan horse wintab32.dll file located in the same directory as a .nxs file, as demonstrated by a scenario where the .nxs file and the DLL are in the current working directory, and the Trojan horse code is executed. (The directory could, in general, be on a local filesystem or a network share.).
- Product
- Nomachine
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordhyp3rlinx.altervista.orgpacketstormsecurity.com
Sep 7, 2018Untrusted search path vulnerability in installer of ChatWork Desktop App for Windows 2.3.0 and earlier allows an attacker to gain privileges via a Trojan horse CVE-2018-0648 · Other software · ChatWork Co,. LTD. · reported by vultures@jpcert.or.jpHigh 7.8
Untrusted search path vulnerability in installer of ChatWork Desktop App for Windows 2.3.0 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
- Product
- Installer of ChatWork Desktop App for Windows
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Sep 4, 2018Untrusted search path vulnerability in The installer of Digital Paper App version 1.4.0.16050 and earlier allows an attacker to gain privileges via a Trojan horCVE-2018-0656 · Other software · Sony Corporation · reported by vultures@jpcert.or.jpHigh 7.8
Untrusted search path vulnerability in The installer of Digital Paper App version 1.4.0.16050 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
- Product
- The installer of Digital Paper App
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordjvn.jpesupport.sony.com
Jul 26, 2018Untrusted search path vulnerability in LOGICOOL CONNECTION UTILITY SOFTWARE versions before 2.30.9 allows an attacker to gain privileges via a Trojan horse DLL CVE-2018-0621 · Other software · Logicool Co Ltd. · reported by vultures@jpcert.or.jpHigh 7.8
Untrusted search path vulnerability in LOGICOOL CONNECTION UTILITY SOFTWARE versions before 2.30.9 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
- Product
- the installer of LOGICOOL CONNECTION UTILITY SOFTWARE
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jul 26, 2018Untrusted search path vulnerability in LOGICOOL Game Software versions before 8.87.116 allows an attacker to gain privileges via a Trojan horse DLL in an unspecCVE-2018-0620 · Other software · Logicool Co Ltd. · reported by vultures@jpcert.or.jpHigh 7.8
Untrusted search path vulnerability in LOGICOOL Game Software versions before 8.87.116 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
- Product
- the installer of LOGICOOL Game Software
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jun 28, 2018Polaris Office 2017 8.1 allows attackers to execute arbitrary code via a Trojan horse puiframeworkproresenu.dll file in the current working directory.CVE-2018-12589 · Other software · Polarisoffice · reported by MITREHigh 7.8
Polaris Office 2017 8.1 allows attackers to execute arbitrary code via a Trojan horse puiframeworkproresenu.dll file in the current working directory.
- Product
- Polaris Office 2017
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpacketstormsecurity.comexploit-db.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.