CWE-426 · Untrusted Search Path (page 3)
Page 3 of 7 — CVEs classified under CWE-426, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2024-21435 | High | 8.8 | 2024-03-12 | Windows OLE Remote Code Execution Vulnerability |
CVE-2024-27303 | High | 7.3 | 2024-03-06 | electron-builder is a solution to package and build a ready for distribution Electron, Proton Native app for macOS, Windows and Linux. A vulnerability that onl… |
CVE-2024-25103 | Medium | 6.3 | 2024-03-06 | This vulnerability exists in AppSamvid software due to the usage of vulnerable and outdated components. An attacker with local administrative privileges could… |
CVE-2024-24697 | High | 7.2 | 2024-02-14 | Untrusted search path in some Zoom 32 bit Windows clients may allow an authenticated user to conduct an escalation of privilege via local access. |
CVE-2024-24810 | High | 8.2 | 2024-02-07 | WiX toolset lets developers create installers for Windows Installer, the Windows installation engine. The .be TEMP folder is vulnerable to DLL redirection atta… |
CVE-2024-23304 | High | 7.5 | 2024-02-06 | Cybozu KUNAI for Android 3.0.20 to 3.0.21 allows a remote unauthenticated attacker to cause a denial-of-service (DoS) condition by performing certain operation… |
CVE-2021-4435 | High | 7.7 | 2024-02-04 | An untrusted search path vulnerability was found in Yarn. When a victim runs certain Yarn commands in a directory with attacker-controlled content, malicious c… |
CVE-2024-22410 | Low | 3.3 | 2024-01-17 | Creditcoin is a network that enables cross-blockchain credit transactions. The Windows binary of the Creditcoin node loads a suite of DLLs provided by Microsof… |
CVE-2024-22190 | High | 7.8 | 2024-01-11 | GitPython is a python library used to interact with Git repositories. There is an incomplete fix for CVE-2023-40590. On Windows, GitPython uses an untrusted se… |
CVE-2024-21325 | High | 7.8 | 2024-01-09 | Microsoft Printer Metadata Troubleshooter Tool Remote Code Execution Vulnerability |
CVE-2023-48670 | High | 7.3 | 2023-12-22 | Dell SupportAssist for Home PCs version 3.14.1 and prior versions contain a privilege escalation vulnerability in the installer. A local low privileged authen… |
CVE-2023-43586 | High | 7.3 | 2023-12-13 | Path traversal in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom SDKs for Windows may allow an authenticated user to conduct an escalat… |
CVE-2023-36003 | Medium | 6.7 | 2023-12-12 | XAML Diagnostics Elevation of Privilege Vulnerability |
CVE-2023-26031 | High | 7.5 | 2023-11-16 | Relative library resolution in linux container-executor binary in Apache Hadoop 3.3.1-3.3.4 on Linux allows local user to gain root privileges. If the YARN clu… |
CVE-2023-39202 | Low | 3.1 | 2023-11-14 | Untrusted search path in Zoom Rooms Client for Windows and Zoom VDI Client may allow a privileged user to conduct a denial of service via local access. |
CVE-2023-41840 | High | 7.8 | 2023-11-14 | A untrusted search path vulnerability in Fortinet FortiClientWindows 7.0.9 allows an attacker to perform a DLL Hijack attack via a malicious OpenSSL engine lib… |
CVE-2023-36422 | High | 7.8 | 2023-11-14 | Microsoft Windows Defender Elevation of Privilege Vulnerability |
CVE-2023-36393 | High | 7.8 | 2023-11-14 | Windows User Interface Application Core Remote Code Execution Vulnerability |
CVE-2021-26738 | High | 7.8 | 2023-10-23 | Zscaler Client Connector for macOS prior to 3.7 had an unquoted search path vulnerability via the PATH variable. A local adversary may be able to execute code… |
CVE-2023-41766 | High | 7.8 | 2023-10-10 | Windows Client Server Run-time Subsystem (CSRSS) Elevation of Privilege Vulnerability |
CVE-2023-36780 | High | 7.2 | 2023-10-10 | Skype for Business Remote Code Execution Vulnerability |
CVE-2023-36778 | High | 8.0 | 2023-10-10 | Microsoft Exchange Server Remote Code Execution Vulnerability |
CVE-2023-39201 | High | 7.2 | 2023-09-12 | Untrusted search path in CleanZoom before file date 07/24/2023 may allow a privileged user to conduct an escalation of privilege via local access. |
CVE-2023-4736 | High | 7.8 | 2023-09-02 | Untrusted Search Path in GitHub repository vim/vim prior to 9.0.1833. |
CVE-2023-40590 | High | 7.8 | 2023-08-28 | GitPython is a python library used to interact with Git repositories. When resolving a program, Python/Windows look for the current working directory, and aft… |
CVE-2023-41105 | High | 7.5 | 2023-08-23 | An issue was discovered in Python 3.11 through 3.11.4. If a path containing '\0' bytes is passed to os.path.normpath(), the path will be truncated unexpectedly… |
CVE-2022-43456 | Medium | 6.7 | 2023-08-11 | Uncontrolled search path in some Intel(R) RST software before versions 16.8.5.1014.5, 17.11.3.1010.2, 18.7.6.1011.2 and 19.5.2.1049.5 may allow an authenticate… |
CVE-2023-29299 | Medium | 4.7 | 2023-08-10 | Adobe Acrobat Reader versions 23.003.20244 (and earlier) and 20.005.30467 (and earlier) are affected by an Untrusted Search Path vulnerability that could lead… |
CVE-2023-39212 | High | 7.9 | 2023-08-08 | Untrusted search path in Zoom Rooms for Windows before version 5.15.5 may allow an authenticated user to enable a denial of service via local access. |
CVE-2023-36898 | High | 7.8 | 2023-08-08 | Tablet Windows User Interface Application Core Remote Code Execution Vulnerability |
CVE-2023-36540 | High | 7.3 | 2023-08-08 | Untrusted search path in the installer for Zoom Desktop Client for Windows before 5.14.5 may allow an authenticated user to enable an escalation of privilege v… |
CVE-2023-36538 | High | 8.4 | 2023-07-11 | Improper access control in Zoom Rooms for Windows before version 5.15.0 may allow an authenticated user to enable an escalation of privilege via local access. |
CVE-2023-36536 | High | 8.2 | 2023-07-11 | Untrusted search path in the installer for Zoom Rooms for Windows before version 5.15.0 may allow an authenticated user to enable an escalation of privilege v… |
CVE-2023-35343 | High | 7.8 | 2023-07-11 | Windows Geolocation Service Remote Code Execution Vulnerability |
CVE-2023-34119 | High | 8.2 | 2023-07-11 | Insecure temporary file in the installer for Zoom Rooms for Windows before version 5.15.0 may allow an authenticated user to enable an escalation of privilege… |
CVE-2023-34145 | High | 7.8 | 2023-06-26 | An untrusted search path vulnerability in the Trend Micro Apex One and Apex One as a Service security agent could allow a local attacker to escalate their priv… |
CVE-2023-34144 | High | 7.8 | 2023-06-26 | An untrusted search path vulnerability in the Trend Micro Apex One and Apex One as a Service security agent could allow a local attacker to escalate their priv… |
CVE-2023-30330 | Critical | 9.8 | 2023-05-12 | SoftExpert (SE) Excellence Suite 2.x versions before 2.1.3 is vulnerable to Local File Inclusion in the function /se/v42300/generic/gn_defaultframe/2.0/default… |
CVE-2023-29790 | High | 7.5 | 2023-05-12 | kodbox 1.2.x through 1.3.7 has a Sensitive Information Leakage issue. |
CVE-2023-28143 | Medium | 6.7 | 2023-04-18 | Qualys Cloud Agent for macOS (versions 2.5.1-75 before 3.7) installer allows a local escalation of privilege bounded only to the time of installation and only… |
CVE-2023-27771 | High | 7.8 | 2023-04-04 | An issue found in Wondershare Technology Co.,Ltd Creative Centerr v.1.0.8 allows a remote attacker to execute arbitrary commands via the wondershareCC_setup_fu… |
CVE-2023-27770 | High | 7.8 | 2023-04-04 | An issue found in Wondershare Technology Co.,Ltd Edraw-max v.12.0.4 allows a remote attacker to execute arbitrary commands via the edraw-max_setup_full5371.exe… |
CVE-2023-27769 | High | 7.8 | 2023-04-04 | An issue found in Wondershare Technology Co.,Ltd PDF Reader v.1.0.1 allows a remote attacker to execute arbitrary commands via the pdfreader_setup_full13143.ex… |
CVE-2023-27768 | High | 7.8 | 2023-04-04 | An issue found in Wondershare Technology Co.,Ltd PDFelement v9.1.1 allows a remote attacker to execute arbitrary commands via the pdfelement-pro_setup_full5239… |
CVE-2023-27767 | High | 7.8 | 2023-04-04 | An issue found in Wondershare Technology Co.,Ltd Dr.Fone v.12.4.9 allows a remote attacker to execute arbitrary commands via the drfone_setup_full3360.exe file. |
CVE-2023-27766 | High | 7.8 | 2023-04-04 | An issue found in Wondershare Technology Co.,Ltd Anireel 1.5.4 allows a remote attacker to execute arbitrary commands via the anireel_setup_full9589.exe file. |
CVE-2023-27765 | High | 7.8 | 2023-04-04 | An issue found in Wondershare Technology Co.,Ltd Recoverit v.10.6.3 allows a remote attacker to execute arbitrary commands via the recoverit_setup_full4134.exe… |
CVE-2023-27764 | High | 7.8 | 2023-04-04 | An issue found in Wondershare Technology Co.,Ltd Repairit v.3.5.4 allows a remote attacker to execute arbitrary commands via the repairit_setup_full5913.exe fi… |
CVE-2023-27763 | High | 7.8 | 2023-04-04 | An issue found in Wondershare Technology Co.,Ltd MobileTrans v.4.0.2 allows a remote attacker to execute arbitrary commands via the mobiletrans_setup_full5793… |
CVE-2023-27762 | High | 7.8 | 2023-04-04 | An issue found in Wondershare Technology Co., Ltd DemoCreator v.6.0.0 allows a remote attacker to execute arbitrary commands via the democreator_setup_full7743… |
CVE-2023-27761 | High | 7.8 | 2023-04-04 | An issue found in Wondershare Technology Co., Ltd UniConverter v.14.0.0 allows a remote attacker to execute arbitrary commands via the uniconverter14_64bit_set… |
CVE-2023-27760 | High | 7.8 | 2023-04-04 | An issue found in Wondershare Technology Co, Ltd Filmora v.12.0.9 allows a remote attacker to execute arbitrary commands via the filmora_setup_full846.exe. |
CVE-2023-27759 | High | 7.8 | 2023-04-04 | An issue found in Wondershare Technology Co, Ltd Edrawmind v.10.0.6 allows a remote attacker to executea arbitrary commands via the WindowsCodescs.dll file. |
CVE-2023-26358 | High | 8.6 | 2023-03-22 | Creative Cloud version 5.9.1 (and earlier) is affected by an Untrusted Search Path vulnerability that might allow attackers to execute their own programs, acce… |
CVE-2023-26038 | Medium | 5.4 | 2023-02-25 | ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33… |
CVE-2023-26036 | High | 8.1 | 2023-02-25 | ZoneMinder is a free, open source Closed-circuit television software application for Linux which supports IP, USB and Analog cameras. Versions prior to 1.36.33… |
CVE-2023-23920 | Medium | 4.2 | 2023-02-23 | An untrusted search path vulnerability exists in Node.js. <19.6.1, <18.14.1, <16.19.1, and <14.21.3 that could allow an attacker to search and potentially load… |
CVE-2023-22368 | High | 7.8 | 2023-02-15 | Untrusted search path vulnerability in ELECOM Camera Assistant 1.00 and QuickFileDealer Ver.1.2.1 and earlier allows an attacker to gain privileges via a Troja… |
CVE-2023-23618 | High | 8.6 | 2023-02-14 | Git for Windows is the Windows port of the revision control system Git. Prior to Git for Windows version 2.39.2, when `gitk` is run on Windows, it potentially… |
CVE-2023-22743 | High | 7.2 | 2023-02-14 | Git for Windows is the Windows port of the revision control system Git. Prior to Git for Windows version 2.39.2, by carefully crafting DLL and putting into a s… |
CVE-2022-35868 | Medium | 6.7 | 2023-02-14 | A vulnerability has been identified in TIA Multiuser Server V14 (All versions), TIA Multiuser Server V15 (All versions < V15.1 Update 8), TIA Project-Server (A… |
CVE-2022-4883 | High | 8.8 | 2023-02-07 | A flaw was found in libXpm. When processing files with .Z or .gz extensions, the library calls external programs to compress and uncompress files, relying on t… |
CVE-2022-41953 | High | 8.6 | 2023-01-17 | Git GUI is a convenient graphical tool that comes with Git for Windows. Its target audience is users who are uncomfortable with using Git on the command-line… |
CVE-2023-21764 | High | 7.8 | 2023-01-10 | Microsoft Exchange Server Elevation of Privilege Vulnerability |
CVE-2023-21763 | High | 7.8 | 2023-01-10 | Microsoft Exchange Server Elevation of Privilege Vulnerability |
CVE-2022-38060 | High | 8.8 | 2022-12-21 | A privilege escalation vulnerability exists in the sudo functionality of OpenStack Kolla git master 05194e7618. A misconfiguration in /etc/sudoers within a con… |
CVE-2022-23748 | High | 7.8 | 2022-11-17 | mDNSResponder.exe is vulnerable to DLL Sideloading attack. Executable improperly specifies how to load the DLL, from which folder and under what conditions. In… |
CVE-2022-31253 | High | 7.1 | 2022-11-09 | A Untrusted Search Path vulnerability in openldap2 of openSUSE Factory allows local attackers with control of the ldap user or group to change ownership of arb… |
CVE-2022-3734 | Medium | 6.3 | 2022-10-28 | A vulnerability was found in a port or fork of Redis. It has been declared as critical. This vulnerability affects unknown code in the library C:/Program Files… |
CVE-2022-0074 | High | 8.8 | 2022-10-27 | Untrusted Search Path vulnerability in LiteSpeed Technologies OpenLiteSpeed Web Server and LiteSpeed Web Server Container allows Privilege Escalation. This aff… |
CVE-2021-3305 | High | 7.8 | 2022-10-18 | Beijing Feishu Technology Co., Ltd Feishu v3.40.3 was discovered to contain an untrusted search path vulnerability. |
CVE-2022-39245 | High | 8.4 | 2022-09-26 | Mist is the command-line interface for the makedeb Package Repository. Prior to version 0.9.5, a user-provided `sudo` binary via the `PATH` variable can allow… |
CVE-2022-36403 | High | 7.8 | 2022-09-08 | Untrusted search path vulnerability in the installer of Device Software Manager prior to Ver.2.20.3.0 allows an attacker to gain privileges via a Trojan horse… |
CVE-2022-36070 | High | 7.3 | 2022-09-07 | Poetry is a dependency manager for Python. To handle dependencies that come from a Git repository, Poetry executes various commands, e.g. `git config`. These c… |
CVE-2022-22047 | High | 7.8 | 2022-07-12 | Windows Client Server Run-time Subsystem (CSRSS) Elevation of Privilege Vulnerability |
CVE-2022-31012 | High | 8.2 | 2022-07-12 | Git for Windows is a fork of Git that contains Windows-specific patches. This vulnerability in versions prior to 2.37.1 lets Git for Windows' installer execute… |
CVE-2021-36666 | High | 7.8 | 2022-07-12 | An issue was discovered in Druva 6.9.0 for MacOS, allows attackers to gain escalated local privileges via the inSyncDecommission. |
CVE-2017-20123 | High | 8.8 | 2022-06-30 | A vulnerability was found in Viscosity 1.6.7. It has been classified as critical. This affects an unknown part of the component DLL Handler. The manipulation l… |
CVE-2022-28964 | High | 7.1 | 2022-05-20 | An arbitrary file write vulnerability in Avast Premium Security before v21.11.2500 (build 21.11.6809.528) allows attackers to cause a Denial of Service (DoS) v… |
CVE-2022-29583 | High | 7.8 | 2022-04-22 | service_windows.go in the kardianos service package for Go omits quoting that is sometimes needed for execution of a Windows service executable from the intend… |
CVE-2022-24826 | Critical | 9.8 | 2022-04-20 | On Windows, if Git LFS operates on a malicious repository with a `..exe` file as well as a file named `git.exe`, and `git.exe` is not found in `PATH`, the `..e… |
CVE-2022-26184 | Critical | 9.8 | 2022-03-21 | Poetry v1.1.9 and below was discovered to contain an untrusted search path which causes the application to behave in unexpected ways when users execute Poetry… |
CVE-2022-26183 | High | 8.8 | 2022-03-21 | PNPM v6.15.1 and below was discovered to contain an untrusted search path which causes the application to behave in unexpected ways when users execute PNPM com… |
CVE-2022-26488 | High | 7.0 | 2022-03-10 | In Python before 3.10.3 on Windows, local users can gain privileges because the search path is inadequately secured. The installer may allow a local attacker t… |
CVE-2022-25366 | High | 7.8 | 2022-02-19 | Cryptomator through 1.6.5 allows DYLIB injection because, although it has the flag 0x1000 for Hardened Runtime, it has the com.apple.security.cs.disable-librar… |
CVE-2021-45975 | High | 7.8 | 2022-01-26 | In ListCheck.exe in Acer Care Center 4.x before 4.00.3038, a vulnerability in the loading mechanism of Windows DLLs could allow a local attacker to perform a D… |
CVE-2022-0014 | Medium | 6.7 | 2022-01-12 | An untrusted search path vulnerability exists in the Palo Alto Networks Cortex XDR agent that enables a local attacker with file creation privilege in the Wind… |
CVE-2021-33063 | High | 7.8 | 2021-11-17 | Uncontrolled search path in the Intel(R) RealSense(TM) D400 Series UWP driver for Windows 10 before version 6.1.160.22 may allow an authenticated user to poten… |
CVE-2020-12892 | High | 7.8 | 2021-11-15 | An untrusted search path in AMD Radeon settings Installer may lead to a privilege escalation or unauthorized code execution. |
CVE-2011-4125 | Critical | 9.8 | 2021-10-27 | A untrusted search path issue was found in Calibre at devices/linux_mount_helper.c leading to the ability of unprivileged users to execute any program as root. |
CVE-2021-26557 | High | 7.8 | 2021-10-07 | When Octopus Tentacle is installed using a custom folder location, folder ACLs are not set correctly and could lead to an unprivileged user using DLL side-load… |
CVE-2021-26556 | High | 7.8 | 2021-10-07 | When Octopus Server is installed using a custom folder location, folder ACLs are not set correctly and could lead to an unprivileged user using DLL side-loadin… |
CVE-2021-36297 | High | 7.8 | 2021-09-28 | SupportAssist Client version 3.8 and 3.9 contains an Untrusted search path vulnerability that allows attackers to load an arbitrary .dll file via .dll planting… |
CVE-2021-31841 | High | 8.2 | 2021-09-22 | A DLL sideloading vulnerability in McAfee Agent for Windows prior to 5.7.4 could allow a local user to perform a DLL sideloading attack with an unsigned DLL wi… |
CVE-2021-41387 | High | 8.8 | 2021-09-17 | seatd-launch in seatd 0.6.x before 0.6.2 allows privilege escalation because it uses execlp and may be installed setuid root. |
CVE-2021-37617 | High | 7.3 | 2021-08-18 | The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with a computer. The Nextcloud Desktop Client invokes its uninstaller script… |
CVE-2021-21562 | Medium | 4.4 | 2021-08-03 | Dell EMC PowerScale OneFS contains an untrusted search path vulnerability. This vulnerability allows a user with (ISI_PRIV_LOGIN_SSH or ISI_PRIV_LOGIN_CONSOLE)… |
CVE-2021-25699 | High | 7.8 | 2021-07-21 | The OpenSSL component of the Teradici PCoIP Software Client prior to version 21.07.0 was compiled without the no-autoload-config option, which allowed an attac… |
CVE-2021-25698 | High | 7.8 | 2021-07-21 | The OpenSSL component of the Teradici PCoIP Standard Agent prior to version 21.07.0 was compiled without the no-autoload-config option, which allowed an attack… |
CVE-2021-26807 | High | 7.8 | 2021-04-30 | GalaxyClient version 2.0.28.9 loads unsigned DLLs such as zlib1.dll, libgcc_s_dw2-1.dll and libwinpthread-1.dll from PATH, which allows an attacker to potentia… |