CVE-2018-6461

March Hare WINCVS before 2.8.01 build 6610, and CVS Suite before 2009R2 build 6610, contains an Insecure Library Loading vulnerability in the wincvs2.exe or wincvs.exe file, which may allow local users to gain privileges via a Trojan horse Python or TCL DLL file in the current working directory.

• CWE-426

• http://hyp3rlinx.altervista.org/advisories/CVS-SUITE-2009R2-INSECURE-LIBRARY-LOADING-CVE-2018-6461.txtExploit, Third Party Advisory
• http://march-hare.com/cvspro/vulnwincvs.htmVendor Advisory
• http://packetstormsecurity.com/files/146267/WINCVS-2009R2-DLL-Hijacking.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2018/Feb/24Exploit, Mailing List, Third Party Advisory
• http://hyp3rlinx.altervista.org/advisories/CVS-SUITE-2009R2-INSECURE-LIBRARY-LOADING-CVE-2018-6461.txtExploit, Third Party Advisory
• http://march-hare.com/cvspro/vulnwincvs.htmVendor Advisory
• http://packetstormsecurity.com/files/146267/WINCVS-2009R2-DLL-Hijacking.htmlExploit, Third Party Advisory, VDB Entry
• http://seclists.org/fulldisclosure/2018/Feb/24Exploit, Mailing List, Third Party Advisory

Published

Feb 5, 2018

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-6447A Reflective XSS Vulnerability in HTTP Management Interface …5.4
• CVE-2018-6448A vulnerability in the management interface in Brocade Fabri…7.5
• CVE-2018-6449Host Header Injection vulnerability in the http management i…6.1
• CVE-2018-6458Easy Hosting Control Panel (EHCP) v0.37.12.b allows remote a…
• CVE-2018-6459The rsa_pss_params_parse function in libstrongswan/credentia…
• CVE-2018-6460Hotspot Shield runs a webserver with a static IP address 127…
• CVE-2018-6462Tracker PDF-XChange Viewer and Viewer AX SDK before 2.5.322.…
• CVE-2018-6464Simditor v2.3.11 allows XSS via crafted use of svg/onload=al…6.1
• CVE-2018-6465The PropertyHive plugin before 1.4.15 for WordPress has XSS …
• CVE-2018-6466A cross-site scripting (XSS) vulnerability in flickrRSS.php …
• CVE-2018-6467The flickrRSS plugin 5.3.1 for WordPress has CSRF via wp-adm…
• CVE-2018-6468A cross-site scripting (XSS) vulnerability in flickrRSS.php …