CVE-2015-8264

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Untrusted search path vulnerability in F-Secure Online Scanner allows remote attackers to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse DLL that is located in the same folder as F-SecureOnlineScanner.exe.

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-426

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://seclists.org/fulldisclosure/2016/Mar/64Mailing List, Third Party Advisory
http://www.securityfocus.com/archive/1/537803/100/0/threaded
http://www.securityfocus.com/bid/79657Third Party Advisory, VDB Entry
https://www.f-secure.com/en/web/labs_global/fsc-2015-4Vendor Advisory
http://seclists.org/fulldisclosure/2016/Mar/64Mailing List, Third Party Advisory
http://www.securityfocus.com/archive/1/537803/100/0/threaded
http://www.securityfocus.com/bid/79657Third Party Advisory, VDB Entry
https://www.f-secure.com/en/web/labs_global/fsc-2015-4Vendor Advisory

Timeline

Published: Aug 2, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-82657.5Huawei Mobile WiFi E5151 routers with software before E5151s-2TCPU-V200R001B146D27SP00C00 and E5186 routers with software before V200R001B31 CVE-2015-826710.0The PasswordReset.Controllers.ResetController.ChangePasswordIndex method in PasswordReset.dll in Dovestones AD Self Password Reset before 3.CVE-2015-82687.5The up.time agent in Idera Uptime Infrastructure Monitor 7.5 and 7.6 on Linux allows remote attackers to read arbitrary files via unspecifie CVE-2015-82697.5The API on Fisher-Price Smart Toy Bear devices allows remote attackers to obtain sensitive information or modify data by leveraging presence CVE-2015-82707.5The AMF3ReadString function in amf.c in RTMPDump 2.4 allows remote RTMP Media servers to cause a denial of service (invalid pointer derefere CVE-2015-82719.8The AMF3CD_AddProp function in amf.c in RTMPDump 2.4 allows remote RTMP Media servers to execute arbitrary code.CVE-2015-82726.5RTMPDump 2.4 allows remote attackers to trigger a denial of service (NULL pointer dereference and process crash).CVE-2015-82755.5LVRTC eParakstitajs 3.0 (1.3.0) and edoc-libraries-2.5.4_01 allow attackers to write to arbitrary files via crafted EDOC files.CVE-2015-82765.5LVRTC eParakstitajs 3.0 (1.3.0) and edoc-libraries-2.5.4_01 allow attackers to read arbitrary files via crafted EDOC files.CVE-2015-82779.8Multiple buffer overflows in (1) lmgrd and (2) Vendor Daemon in Flexera FlexNet Publisher before 11.13.1.2 Security Update 1 allow remote at CVE-2015-82798.6Web Viewer 1.0.0.193 on Samsung SRN-1670D devices allows remote attackers to read arbitrary files via a request to an unspecified PHP script CVE-2015-82807.5Web Viewer 1.0.0.193 on Samsung SRN-1670D devices allows remote attackers to discover credentials by reading detailed error messages.