CWE-426 · Untrusted Search Path (page 3)
Page 3 of 7 — CVEs classified under CWE-426, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-6473 | High | 7.8 | 2024-09-03 | Yandex Browser for Desktop before 24.7.1.380 has a DLL Hijacking Vulnerability because an untrusted search path is used. |
CVE-2024-5623 | High | 7.8 | 2024-08-29 | An untrusted search path vulnerability in B&R APROL <= R 4.4-00P3 may be used by an authenticated local attacker to get other users to execute arbitrary code u… |
CVE-2024-5622 | High | 7.8 | 2024-08-29 | An untrusted search path vulnerability in the AprolConfigureCCServices of B&R APROL <= R 4.2.-07P3 and <= R 4.4-00P3 may allow an authenticated local attacker… |
CVE-2024-38305 | High | 7.3 | 2024-08-21 | Dell SupportAssist for Home PCs Installer exe version 4.0.3 contains a privilege escalation vulnerability in the installer. A local low-privileged authenticate… |
CVE-2024-7886 | High | 7.8 | 2024-08-16 | A vulnerability has been found in Scooter Software Beyond Compare up to 3.3.5.15075 and classified as critical. Affected by this vulnerability is an unknown fu… |
CVE-2024-42439 | Medium | 6.5 | 2024-08-14 | Untrusted search path in the installer for Zoom Workplace Desktop App for macOS and Zoom Meeting SDK for macOS before 6.1.0 may allow a privileged user to cond… |
CVE-2024-41865 | High | 7.8 | 2024-08-14 | Dimension versions 3.4.11 and earlier are affected by an Untrusted Search Path vulnerability that could lead to arbitrary code execution. An attacker could exp… |
CVE-2024-6975 | High | 8.8 | 2024-07-31 | Cato Networks Windows SDP Client Local Privilege Escalation via openssl configuration file. This issue affects SDP Client before 5.10.34. |
CVE-2024-6974 | High | 8.8 | 2024-07-31 | Cato Networks Windows SDP Client Local Privilege Escalation via self-upgradeThis issue affects SDP Client: before 5.10.34. |
CVE-2024-34123 | High | 7.0 | 2024-07-09 | Premiere Pro versions 23.6.5, 24.4.1 and earlier are affected by an Untrusted Search Path vulnerability that could lead to arbitrary code execution. An attacke… |
CVE-2024-35260 | High | 8.0 | 2024-06-27 | An authenticated attacker can exploit an untrusted search path vulnerability in Microsoft Dataverse to execute code over a network. |
CVE-2024-36071 | Medium | 6.3 | 2024-06-20 | Samsung Magician 8.0.0 on Windows allows an admin to escalate privileges by tampering with the directory and DLL files used during the installation process. Th… |
CVE-2024-6080 | High | 7.8 | 2024-06-17 | A vulnerability classified as critical was found in Intelbras InControl 2.21.56. This vulnerability affects unknown code of the component incontrolWebcam Servi… |
CVE-2024-38462 | Critical | 9.8 | 2024-06-16 | iRODS before 4.3.2 provides an msiSendMail function with a problematic dependency on the mail binary, such as in the mailMS.cpp#L94-L106 reference. |
CVE-2024-30100 | High | 7.8 | 2024-06-11 | Microsoft SharePoint Server Remote Code Execution Vulnerability |
CVE-2024-28060 | High | 7.3 | 2024-05-28 | An issue was discovered in Apiris Kafeo 6.4.4. It permits DLL hijacking, allowing a user to trigger the execution of arbitrary code every time the product is e… |
CVE-2024-28133 | High | 7.8 | 2024-05-14 | A local low privileged attacker can use an untrusted search path in a CHARX system utility to gain root privileges. … |
CVE-2024-32019 | High | 8.8 | 2024-04-12 | Netdata is an open source observability tool. In affected versions the `ndsudo` tool shipped with affected versions of the Netdata Agent allows an attacker to… |
CVE-2024-20693 | High | 7.8 | 2024-04-09 | Windows Kernel Elevation of Privilege Vulnerability |
CVE-2024-20754 | High | 7.8 | 2024-03-18 | Lightroom Desktop versions 7.1.2 and earlier are affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the contex… |
CVE-2024-26198 | High | 8.8 | 2024-03-12 | Microsoft Exchange Server Remote Code Execution Vulnerability |
CVE-2024-21435 | High | 8.8 | 2024-03-12 | Windows OLE Remote Code Execution Vulnerability |
CVE-2024-27303 | High | 7.3 | 2024-03-06 | electron-builder is a solution to package and build a ready for distribution Electron, Proton Native app for macOS, Windows and Linux. A vulnerability that onl… |
CVE-2024-25103 | Medium | 6.3 | 2024-03-06 | This vulnerability exists in AppSamvid software due to the usage of vulnerable and outdated components. An attacker with local administrative privileges could… |
CVE-2024-24697 | High | 7.2 | 2024-02-14 | Untrusted search path in some Zoom 32 bit Windows clients may allow an authenticated user to conduct an escalation of privilege via local access. |
CVE-2024-24810 | High | 8.2 | 2024-02-07 | WiX toolset lets developers create installers for Windows Installer, the Windows installation engine. The .be TEMP folder is vulnerable to DLL redirection atta… |
CVE-2024-23304 | High | 7.5 | 2024-02-06 | Cybozu KUNAI for Android 3.0.20 to 3.0.21 allows a remote unauthenticated attacker to cause a denial-of-service (DoS) condition by performing certain operation… |
CVE-2021-4435 | High | 7.7 | 2024-02-04 | An untrusted search path vulnerability was found in Yarn. When a victim runs certain Yarn commands in a directory with attacker-controlled content, malicious c… |
CVE-2024-22410 | Low | 3.3 | 2024-01-17 | Creditcoin is a network that enables cross-blockchain credit transactions. The Windows binary of the Creditcoin node loads a suite of DLLs provided by Microsof… |
CVE-2024-22190 | High | 7.8 | 2024-01-11 | GitPython is a python library used to interact with Git repositories. There is an incomplete fix for CVE-2023-40590. On Windows, GitPython uses an untrusted se… |
CVE-2024-21325 | High | 7.8 | 2024-01-09 | Microsoft Printer Metadata Troubleshooter Tool Remote Code Execution Vulnerability |
CVE-2023-48670 | High | 7.3 | 2023-12-22 | Dell SupportAssist for Home PCs version 3.14.1 and prior versions contain a privilege escalation vulnerability in the installer. A local low privileged authen… |
CVE-2023-43586 | High | 7.3 | 2023-12-13 | Path traversal in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom SDKs for Windows may allow an authenticated user to conduct an escalat… |
CVE-2023-36003 | Medium | 6.7 | 2023-12-12 | XAML Diagnostics Elevation of Privilege Vulnerability |
CVE-2023-26031 | High | 7.5 | 2023-11-16 | Relative library resolution in linux container-executor binary in Apache Hadoop 3.3.1-3.3.4 on Linux allows local user to gain root privileges. If the YARN clu… |
CVE-2023-39202 | Low | 3.1 | 2023-11-14 | Untrusted search path in Zoom Rooms Client for Windows and Zoom VDI Client may allow a privileged user to conduct a denial of service via local access. |
CVE-2023-41840 | High | 7.8 | 2023-11-14 | A untrusted search path vulnerability in Fortinet FortiClientWindows 7.0.9 allows an attacker to perform a DLL Hijack attack via a malicious OpenSSL engine lib… |
CVE-2023-36422 | High | 7.8 | 2023-11-14 | Microsoft Windows Defender Elevation of Privilege Vulnerability |
CVE-2023-36393 | High | 7.8 | 2023-11-14 | Windows User Interface Application Core Remote Code Execution Vulnerability |
CVE-2021-26738 | High | 7.8 | 2023-10-23 | Zscaler Client Connector for macOS prior to 3.7 had an unquoted search path vulnerability via the PATH variable. A local adversary may be able to execute code… |
CVE-2023-41766 | High | 7.8 | 2023-10-10 | Windows Client Server Run-time Subsystem (CSRSS) Elevation of Privilege Vulnerability |
CVE-2023-36780 | High | 7.2 | 2023-10-10 | Skype for Business Remote Code Execution Vulnerability |
CVE-2023-36778 | High | 8.0 | 2023-10-10 | Microsoft Exchange Server Remote Code Execution Vulnerability |
CVE-2023-39201 | High | 7.2 | 2023-09-12 | Untrusted search path in CleanZoom before file date 07/24/2023 may allow a privileged user to conduct an escalation of privilege via local access. |
CVE-2023-4736 | High | 7.8 | 2023-09-02 | Untrusted Search Path in GitHub repository vim/vim prior to 9.0.1833. |
CVE-2023-40590 | High | 7.8 | 2023-08-28 | GitPython is a python library used to interact with Git repositories. When resolving a program, Python/Windows look for the current working directory, and aft… |
CVE-2023-41105 | High | 7.5 | 2023-08-23 | An issue was discovered in Python 3.11 through 3.11.4. If a path containing '\0' bytes is passed to os.path.normpath(), the path will be truncated unexpectedly… |
CVE-2022-43456 | Medium | 6.7 | 2023-08-11 | Uncontrolled search path in some Intel(R) RST software before versions 16.8.5.1014.5, 17.11.3.1010.2, 18.7.6.1011.2 and 19.5.2.1049.5 may allow an authenticate… |
CVE-2023-29299 | Medium | 4.7 | 2023-08-10 | Adobe Acrobat Reader versions 23.003.20244 (and earlier) and 20.005.30467 (and earlier) are affected by an Untrusted Search Path vulnerability that could lead… |
CVE-2023-39212 | High | 7.9 | 2023-08-08 | Untrusted search path in Zoom Rooms for Windows before version 5.15.5 may allow an authenticated user to enable a denial of service via local access. |
CVE-2023-36898 | High | 7.8 | 2023-08-08 | Tablet Windows User Interface Application Core Remote Code Execution Vulnerability |
CVE-2023-36540 | High | 7.3 | 2023-08-08 | Untrusted search path in the installer for Zoom Desktop Client for Windows before 5.14.5 may allow an authenticated user to enable an escalation of privilege v… |
CVE-2023-36538 | High | 8.4 | 2023-07-11 | Improper access control in Zoom Rooms for Windows before version 5.15.0 may allow an authenticated user to enable an escalation of privilege via local access. |
CVE-2023-36536 | High | 8.2 | 2023-07-11 | Untrusted search path in the installer for Zoom Rooms for Windows before version 5.15.0 may allow an authenticated user to enable an escalation of privilege v… |
CVE-2023-35343 | High | 7.8 | 2023-07-11 | Windows Geolocation Service Remote Code Execution Vulnerability |
CVE-2023-34119 | High | 8.2 | 2023-07-11 | Insecure temporary file in the installer for Zoom Rooms for Windows before version 5.15.0 may allow an authenticated user to enable an escalation of privilege… |
CVE-2023-34145 | High | 7.8 | 2023-06-26 | An untrusted search path vulnerability in the Trend Micro Apex One and Apex One as a Service security agent could allow a local attacker to escalate their priv… |
CVE-2023-34144 | High | 7.8 | 2023-06-26 | An untrusted search path vulnerability in the Trend Micro Apex One and Apex One as a Service security agent could allow a local attacker to escalate their priv… |
CVE-2023-30330 | Critical | 9.8 | 2023-05-12 | SoftExpert (SE) Excellence Suite 2.x versions before 2.1.3 is vulnerable to Local File Inclusion in the function /se/v42300/generic/gn_defaultframe/2.0/default… |
CVE-2023-29790 | High | 7.5 | 2023-05-12 | kodbox 1.2.x through 1.3.7 has a Sensitive Information Leakage issue. |
CVE-2023-28143 | Medium | 6.7 | 2023-04-18 | Qualys Cloud Agent for macOS (versions 2.5.1-75 before 3.7) installer allows a local escalation of privilege bounded only to the time of installation and only… |
CVE-2023-27771 | High | 7.8 | 2023-04-04 | An issue found in Wondershare Technology Co.,Ltd Creative Centerr v.1.0.8 allows a remote attacker to execute arbitrary commands via the wondershareCC_setup_fu… |
CVE-2023-27770 | High | 7.8 | 2023-04-04 | An issue found in Wondershare Technology Co.,Ltd Edraw-max v.12.0.4 allows a remote attacker to execute arbitrary commands via the edraw-max_setup_full5371.exe… |
CVE-2023-27769 | High | 7.8 | 2023-04-04 | An issue found in Wondershare Technology Co.,Ltd PDF Reader v.1.0.1 allows a remote attacker to execute arbitrary commands via the pdfreader_setup_full13143.ex… |
CVE-2023-27768 | High | 7.8 | 2023-04-04 | An issue found in Wondershare Technology Co.,Ltd PDFelement v9.1.1 allows a remote attacker to execute arbitrary commands via the pdfelement-pro_setup_full5239… |
CVE-2023-27767 | High | 7.8 | 2023-04-04 | An issue found in Wondershare Technology Co.,Ltd Dr.Fone v.12.4.9 allows a remote attacker to execute arbitrary commands via the drfone_setup_full3360.exe file. |
CVE-2023-27766 | High | 7.8 | 2023-04-04 | An issue found in Wondershare Technology Co.,Ltd Anireel 1.5.4 allows a remote attacker to execute arbitrary commands via the anireel_setup_full9589.exe file. |
CVE-2023-27765 | High | 7.8 | 2023-04-04 | An issue found in Wondershare Technology Co.,Ltd Recoverit v.10.6.3 allows a remote attacker to execute arbitrary commands via the recoverit_setup_full4134.exe… |
CVE-2023-27764 | High | 7.8 | 2023-04-04 | An issue found in Wondershare Technology Co.,Ltd Repairit v.3.5.4 allows a remote attacker to execute arbitrary commands via the repairit_setup_full5913.exe fi… |
CVE-2023-27763 | High | 7.8 | 2023-04-04 | An issue found in Wondershare Technology Co.,Ltd MobileTrans v.4.0.2 allows a remote attacker to execute arbitrary commands via the mobiletrans_setup_full5793… |
CVE-2023-27762 | High | 7.8 | 2023-04-04 | An issue found in Wondershare Technology Co., Ltd DemoCreator v.6.0.0 allows a remote attacker to execute arbitrary commands via the democreator_setup_full7743… |
CVE-2023-27761 | High | 7.8 | 2023-04-04 | An issue found in Wondershare Technology Co., Ltd UniConverter v.14.0.0 allows a remote attacker to execute arbitrary commands via the uniconverter14_64bit_set… |
CVE-2023-27760 | High | 7.8 | 2023-04-04 | An issue found in Wondershare Technology Co, Ltd Filmora v.12.0.9 allows a remote attacker to execute arbitrary commands via the filmora_setup_full846.exe. |
CVE-2023-27759 | High | 7.8 | 2023-04-04 | An issue found in Wondershare Technology Co, Ltd Edrawmind v.10.0.6 allows a remote attacker to executea arbitrary commands via the WindowsCodescs.dll file. |
CVE-2023-26358 | High | 8.6 | 2023-03-22 | Creative Cloud version 5.9.1 (and earlier) is affected by an Untrusted Search Path vulnerability that might allow attackers to execute their own programs, acce… |
CVE-2023-26038 | Medium | 5.4 | 2023-02-25 | ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33… |
CVE-2023-26036 | High | 8.1 | 2023-02-25 | ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33… |
CVE-2023-23920 | Medium | 4.2 | 2023-02-23 | An untrusted search path vulnerability exists in Node.js. <19.6.1, <18.14.1, <16.19.1, and <14.21.3 that could allow an attacker to search and potentially load… |
CVE-2023-22368 | High | 7.8 | 2023-02-15 | Untrusted search path vulnerability in ELECOM Camera Assistant 1.00 and QuickFileDealer Ver.1.2.1 and earlier allows an attacker to gain privileges via a Troja… |
CVE-2023-23618 | High | 8.6 | 2023-02-14 | Git for Windows is the Windows port of the revision control system Git. Prior to Git for Windows version 2.39.2, when `gitk` is run on Windows, it potentially… |
CVE-2023-22743 | High | 7.2 | 2023-02-14 | Git for Windows is the Windows port of the revision control system Git. Prior to Git for Windows version 2.39.2, by carefully crafting DLL and putting into a s… |
CVE-2022-35868 | Medium | 6.7 | 2023-02-14 | A vulnerability has been identified in TIA Multiuser Server V14 (All versions), TIA Multiuser Server V15 (All versions < V15.1 Update 8), TIA Project-Server (A… |
CVE-2022-4883 | High | 8.8 | 2023-02-07 | A flaw was found in libXpm. When processing files with .Z or .gz extensions, the library calls external programs to compress and uncompress files, relying on t… |
CVE-2022-41953 | High | 8.6 | 2023-01-17 | Git GUI is a convenient graphical tool that comes with Git for Windows. Its target audience is users who are uncomfortable with using Git on the command-line… |
CVE-2023-21764 | High | 7.8 | 2023-01-10 | Microsoft Exchange Server Elevation of Privilege Vulnerability |
CVE-2023-21763 | High | 7.8 | 2023-01-10 | Microsoft Exchange Server Elevation of Privilege Vulnerability |
CVE-2022-38060 | High | 8.8 | 2022-12-21 | A privilege escalation vulnerability exists in the sudo functionality of OpenStack Kolla git master 05194e7618. A misconfiguration in /etc/sudoers within a con… |
CVE-2022-23748 | High | 7.8 | 2022-11-17 | mDNSResponder.exe is vulnerable to DLL Sideloading attack. Executable improperly specifies how to load the DLL, from which folder and under what conditions. In… |
CVE-2022-31253 | High | 7.1 | 2022-11-09 | A Untrusted Search Path vulnerability in openldap2 of openSUSE Factory allows local attackers with control of the ldap user or group to change ownership of arb… |
CVE-2022-3734 | Medium | 6.3 | 2022-10-28 | A vulnerability was found in a port or fork of Redis. It has been declared as critical. This vulnerability affects unknown code in the library C:/Program Files… |
CVE-2022-0074 | High | 8.8 | 2022-10-27 | Untrusted Search Path vulnerability in LiteSpeed Technologies OpenLiteSpeed Web Server and LiteSpeed Web Server Container allows Privilege Escalation. This aff… |
CVE-2021-3305 | High | 7.8 | 2022-10-18 | Beijing Feishu Technology Co., Ltd Feishu v3.40.3 was discovered to contain an untrusted search path vulnerability. |
CVE-2022-39245 | High | 8.4 | 2022-09-26 | Mist is the command-line interface for the makedeb Package Repository. Prior to version 0.9.5, a user-provided `sudo` binary via the `PATH` variable can allow… |
CVE-2022-36403 | High | 7.8 | 2022-09-08 | Untrusted search path vulnerability in the installer of Device Software Manager prior to Ver.2.20.3.0 allows an attacker to gain privileges via a Trojan horse… |
CVE-2022-36070 | High | 7.3 | 2022-09-07 | Poetry is a dependency manager for Python. To handle dependencies that come from a Git repository, Poetry executes various commands, e.g. `git config`. These c… |
CVE-2022-22047 | High | 7.8 | 2022-07-12 | Windows Client Server Run-time Subsystem (CSRSS) Elevation of Privilege Vulnerability |
CVE-2022-31012 | High | 8.2 | 2022-07-12 | Git for Windows is a fork of Git that contains Windows-specific patches. This vulnerability in versions prior to 2.37.1 lets Git for Windows' installer execute… |
CVE-2021-36666 | High | 7.8 | 2022-07-12 | An issue was discovered in Druva 6.9.0 for MacOS, allows attackers to gain escalated local privileges via the inSyncDecommission. |
CVE-2017-20123 | High | 8.8 | 2022-06-30 | A vulnerability was found in Viscosity 1.6.7. It has been classified as critical. This affects an unknown part of the component DLL Handler. The manipulation l… |
CVE-2017-20051 | Medium | 6.3 | 2022-06-16 | A vulnerability was detected in InnoSetup Installer 5.5.9. This affects an unknown part. The manipulation results in uncontrolled search path. The attack can b… |