CWE-426 · Untrusted Search Path (page 5)
Page 5 of 7 — CVEs classified under CWE-426, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-14960 | High | 7.8 | 2019-10-01 | JetBrains Rider before 2019.1.2 was using an unsigned JetBrains.Rider.Unity.Editor.Plugin.Repacked.dll file. |
CVE-2019-13357 | High | 7.8 | 2019-09-24 | In Total Defense Anti-virus 9.0.0.773, resource acquisition from the untrusted search path C:\ used by caschelp.exe allows local attackers to hijack ccGUIFrm.d… |
CVE-2019-6826 | High | 7.8 | 2019-09-17 | A CWE-426: Untrusted Search Path vulnerability exists in SoMachine HVAC v2.4.1 and earlier versions, which could cause arbitrary code execution on the system r… |
CVE-2019-11660 | High | 7.8 | 2019-09-13 | Privileges manipulation in Micro Focus Data Protector, versions 10.00, 10.01, 10.02, 10.03, 10.04, 10.10, 10.20, 10.30, 10.40. This vulnerability could be expl… |
CVE-2019-3646 | Medium | 6.9 | 2019-09-13 | DLL Search Order Hijacking vulnerability in Microsoft Windows client in McAfee Total Protection (MTP) Free Antivirus Trial 16.0.R18 and earlier allows local us… |
CVE-2019-8461 | High | 7.8 | 2019-08-29 | Check Point Endpoint Security Initial Client for Windows before version E81.30 tries to load a DLL placed in any PATH location on a clean image without Endpoin… |
CVE-2019-15295 | High | 7.8 | 2019-08-21 | An Untrusted Search Path vulnerability in the ServiceInstance.dll library versions 1.0.15.119 and lower, as used in Bitdefender Antivirus Free 2020 versions pr… |
CVE-2019-6165 | High | 7.8 | 2019-08-19 | A DLL search path vulnerability was reported in PaperDisplay Hotkey Service version 1.2.0.8 that could allow privilege escalation. Lenovo has ended support for… |
CVE-2019-5631 | High | 7.8 | 2019-08-19 | The Rapid7 InsightAppSec broker suffers from a DLL injection vulnerability in the 'prunsrv.exe' component of the product. If exploited, a local user of the sys… |
CVE-2016-10837 | High | 7.5 | 2019-08-01 | cPanel before 11.54.0.4 allows arbitrary code execution because of an unsafe @INC path (SEC-46). |
CVE-2019-9492 | High | 7.8 | 2019-07-26 | A DLL side-loading vulnerability in Trend Micro OfficeScan 11.0 SP1 and XG could allow an authenticated attacker to gain code execution and terminate the produ… |
CVE-2019-1010100 | High | 7.8 | 2019-07-19 | Akeo Consulting Rufus 3.0 and earlier is affected by: DLL search order hijacking. The impact is: Arbitrary code execution WITH escalation of privilege. The com… |
CVE-2019-13637 | High | 8.8 | 2019-07-17 | In LogMeIn join.me before 3.16.0.5505, an attacker could execute arbitrary commands on a targeted system. This vulnerability is due to unsafe search paths used… |
CVE-2019-12912 | Medium | 5.5 | 2019-07-17 | Redbrick Shift through 3.4.3 allows an attacker to extract emails of services (such as Gmail, Outlook, etc.) used in the application. |
CVE-2019-12576 | High | 7.8 | 2019-07-11 | A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v82 for macOS could allow an authenticated, local attacker to run arbitrary… |
CVE-2019-12574 | High | 7.8 | 2019-07-11 | A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v1.0 for Windows could allow an authenticated, local attacker to run arbitra… |
CVE-2019-10971 | High | 7.8 | 2019-06-12 | The application (Network Configurator for DeviceNet Safety 3.41 and prior) searches for resources by means of an untrusted search path that could execute a mal… |
CVE-2019-12569 | High | 7.8 | 2019-06-03 | A vulnerability in Viber before 10.7.0 for Desktop (Windows) could allow an attacker to execute arbitrary commands on a targeted system. This vulnerability is… |
CVE-2019-5589 | High | 7.8 | 2019-05-28 | An Unsafe Search Path vulnerability in FortiClient Online Installer (Windows version before 6.0.6) may allow an unauthenticated, remote attacker with control o… |
CVE-2018-16156 | High | 7.8 | 2019-05-17 | In PaperStream IP (TWAIN) 1.42.0.5685 (Service Update 7), the FJTWSVIC service running with SYSTEM privilege processes unauthenticated messages received over t… |
CVE-2019-5958 | High | 7.8 | 2019-05-17 | Untrusted search path vulnerability in Electronic reception and examination of application for radio licenses Offline 1.0.9.0 and earlier allows an attacker to… |
CVE-2019-5957 | High | 7.8 | 2019-05-17 | Untrusted search path vulnerability in Installer of Electronic reception and examination of application for radio licenses Online 1.0.9.0 and earlier allows an… |
CVE-2019-5429 | High | 7.8 | 2019-04-29 | Untrusted search path in FileZilla before 3.41.0-rc1 allows an attacker to gain privileges via a malicious 'fzsftp' binary in the user's home directory. |
CVE-2019-9798 | High | 7.4 | 2019-04-26 | On Android systems, Firefox can load a library from APITRACE_LIB, which is writable by all users and applications. This could allow malicious third party appli… |
CVE-2018-18367 | High | 7.8 | 2019-04-25 | Symantec Endpoint Protection Manager (SEPM) prior to and including 12.1 RU6 MP9 and prior to 14.2 RU1 may be susceptible to a DLL Preloading vulnerability, whi… |
CVE-2018-18369 | High | 7.8 | 2019-04-25 | Norton Security (Windows client) prior to 22.16.3 and SEP SBE (Windows client) prior to Cloud Agent 3.00.31.2817, NIS-22.15.2.22 & SEP-12.1.7484.7002, may be s… |
CVE-2019-11351 | High | 8.8 | 2019-04-19 | TeamSpeak 3 Client before 3.2.5 allows remote code execution in the Qt framework. |
CVE-2019-8453 | Medium | 5.5 | 2019-04-17 | Some of the DLLs loaded by Check Point ZoneAlarm up to 15.4.062 are taken from directories where all users have write permissions. This can allow a local attac… |
CVE-2018-10959 | High | 7.5 | 2019-04-17 | Avecto Defendpoint 4 prior to 4.4 SR6 and 5 prior to 5.1 SR1 has an Untrusted Search Path vulnerability, exploitable by modifying environment variables to trig… |
CVE-2019-6154 | Medium | 5.3 | 2019-04-10 | A DLL search path vulnerability was reported in Lenovo Bootable Generator, prior to version Mar-2019, that could allow a malicious user with local access to ex… |
CVE-2019-0809 | High | 7.8 | 2019-04-09 | A remote code execution vulnerability exists when the Visual Studio C++ Redistributable Installer improperly validates input before loading dynamic link librar… |
CVE-2018-18913 | High | 7.8 | 2019-03-21 | Opera before 57.0.3098.106 is vulnerable to a DLL Search Order hijacking attack where an attacker can send a ZIP archive composed of an HTML page along with a… |
CVE-2019-6724 | High | 7.8 | 2019-03-21 | The barracudavpn component of the Barracuda VPN Client prior to version 5.0.2.7 for Linux, macOS, and OpenBSD runs as a privileged process and can allow an unp… |
CVE-2019-5922 | High | 7.8 | 2019-03-12 | Untrusted search path vulnerability in The installer of Microsoft Teams allows an attacker to gain privileges via a Trojan horse DLL in an unspecified director… |
CVE-2019-5921 | High | 7.8 | 2019-03-12 | Untrusted search path vulnerability in Windows 7 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory. |
CVE-2019-5913 | High | 7.8 | 2019-02-13 | Untrusted search path vulnerability in the installer of LHMelting (LHMelting for Win32 Ver 1.65.3.6 and earlier) allows an attacker to gain privileges via a Tr… |
CVE-2019-5912 | High | 7.8 | 2019-02-13 | Untrusted search path vulnerability in the installer of UNARJ32.DLL (UNARJ32.DLL for Win32 Ver 1.10.1.25 and earlier) allows an attacker to gain privileges via… |
CVE-2019-5911 | High | 7.8 | 2019-02-13 | Untrusted search path vulnerability in the installer of UNLHA32.DLL (UNLHA32.DLL for Win32 Ver 2.67.1.2 and earlier) allows an attacker to gain privileges via… |
CVE-2018-16190 | High | 7.8 | 2019-02-13 | Untrusted search path vulnerability in UNARJ32.DLL for Win32, LHMelting for Win32, and LMLzh32.DLL (UNARJ32.DLL for Win32 Ver 1.10.1.25 and earlier, LHMelting… |
CVE-2018-16189 | High | 7.8 | 2019-02-13 | Untrusted search path vulnerability in Self-Extracting Archives created by UNLHA32.DLL prior to Ver 3.00 allows an attacker to gain privileges via a Trojan hor… |
CVE-2018-18364 | High | 7.3 | 2019-02-08 | Symantec Ghost Solution Suite (GSS) versions prior to 3.3 RU1 may be susceptible to a DLL hijacking vulnerability, which is a type of issue whereby a potential… |
CVE-2018-18333 | High | 7.8 | 2019-02-05 | A DLL hijacking vulnerability in Trend Micro Security 2019 (Consumer) versions below 15.0.0.1163 and below could allow an attacker to manipulate a specific DLL… |
CVE-2019-3587 | High | 7.2 | 2019-01-23 | DLL Search Order Hijacking vulnerability in Microsoft Windows client in McAfee Total Protection (MTP) Prior to 16.0.18 allows local users to execute arbitrary… |
CVE-2018-15983 | High | 7.8 | 2019-01-18 | Flash Player versions 31.0.0.153 and earlier, and 31.0.0.108 and earlier have an insecure library loading (dll hijacking) vulnerability. Successful exploitatio… |
CVE-2018-16182 | High | 7.8 | 2019-01-09 | Untrusted search path vulnerability in the installer of MARKET SPEED Ver.16.4 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an un… |
CVE-2018-16176 | High | 7.8 | 2019-01-09 | Untrusted search path vulnerability in Installer of Mapping Tool 2.0.1.6 and 2.0.1.7 allows remote attackers to gain privileges via a Trojan horse DLL in an un… |
CVE-2018-0667 | High | 7.8 | 2019-01-09 | Untrusted search path vulnerability in Installer of INplc SDK Express 3.08 and earlier and Installer of INplc SDK Pro+ 3.08 and earlier allows an attacker to g… |
CVE-2018-1888 | Medium | 5.3 | 2019-01-04 | An untrusted search path vulnerability in IBM i Access for Windows versions 7.1 and earlier on Windows can allow arbitrary code execution via a Trojan horse DL… |
CVE-2018-18629 | High | 7.8 | 2018-12-20 | An issue was discovered in the Keybase command-line client before 2.8.0-20181023124437 for Linux. An untrusted search path vulnerability in the keybase-redirec… |
CVE-2018-7365 | Medium | 5.1 | 2018-12-20 | All versions up to ZXCLOUD iRAI V5.01.05 of the ZTE uSmartView product are impacted by untrusted search path vulnerability, which may allow an unauthorized use… |
CVE-2018-12245 | High | 7.8 | 2018-11-29 | Symantec Endpoint Protection prior to 14.2 MP1 may be susceptible to a DLL Preloading vulnerability, which in this case is an issue that can occur when an appl… |
CVE-2018-19486 | Critical | 9.8 | 2018-11-23 | Git before 2.19.2 on Linux and UNIX executes commands from the current working directory (as if '.' were at the end of $PATH) in certain cases involving the ru… |
CVE-2018-18519 | High | 7.8 | 2018-11-19 | BestXsoftware Best Free Keylogger before 6.0.0 allows local users to gain privileges via a Trojan horse "%PROGRAMFILES%\BFK 5.2.9\syscrb.exe" file because of i… |
CVE-2018-0692 | High | 7.8 | 2018-11-15 | Untrusted search path vulnerability in Baidu Browser Version 43.23.1000.500 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unsp… |
CVE-2018-1802 | High | 8.4 | 2018-11-09 | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 binaries load shared libraries from an untrusted path potentially g… |
CVE-2018-15974 | High | 7.8 | 2018-10-17 | Adobe Framemaker versions 1.0.5.1 and below have an insecure library loading (dll hijacking) vulnerability. Successful exploitation could lead to privilege esc… |
CVE-2018-17980 | High | 7.8 | 2018-10-15 | NoMachine before 5.3.27 and 6.x before 6.3.6 allows attackers to gain privileges via a Trojan horse wintab32.dll file located in the same directory as a .nxs f… |
CVE-2018-12449 | High | 7.8 | 2018-10-11 | The Whale browser installer 0.4.3.0 and earlier versions allows DLL hijacking. |
CVE-2018-6700 | High | 7.8 | 2018-09-24 | DLL Search Order Hijacking vulnerability in Microsoft Windows Client in McAfee True Key (TK) before 5.1.165 allows local users to execute arbitrary code via sp… |
CVE-2018-0649 | High | 7.8 | 2018-09-07 | Untrusted search path vulnerability in the installers of multiple Canon IT Solutions Inc. software programs (ESET Smart Security Premium, ESET Internet Securit… |
CVE-2018-0648 | High | 7.8 | 2018-09-07 | Untrusted search path vulnerability in installer of ChatWork Desktop App for Windows 2.3.0 and earlier allows an attacker to gain privileges via a Trojan horse… |
CVE-2018-0624 | High | 7.8 | 2018-09-07 | Untrusted search path vulnerability in Multiple Yayoi 17 Series products (Yayoi Kaikei 17 Series Ver.23.1.1 and earlier, Yayoi Aoiro Shinkoku 17 Ver.23.1.1 and… |
CVE-2018-0623 | High | 7.8 | 2018-09-07 | Untrusted search path vulnerability in Multiple Yayoi 17 Series products (Yayoi Kaikei 17 Series Ver.23.1.1 and earlier, Yayoi Aoiro Shinkoku 17 Ver.23.1.1 and… |
CVE-2018-10904 | High | 8.8 | 2018-09-04 | It was found that glusterfs server does not properly sanitize file paths in the "trusted.io-stats-dump" extended attribute which is used by the "debug/io-stats… |
CVE-2018-0656 | High | 7.8 | 2018-09-04 | Untrusted search path vulnerability in The installer of Digital Paper App version 1.4.0.16050 and earlier allows an attacker to gain privileges via a Trojan ho… |
CVE-2018-5003 | High | 7.8 | 2018-08-29 | Adobe Creative Cloud Desktop Application before 4.5.5.342 (installer) has an insecure library loading (dll hijacking) vulnerability. Successful exploitation co… |
CVE-2018-0621 | High | 7.8 | 2018-07-26 | Untrusted search path vulnerability in LOGICOOL CONNECTION UTILITY SOFTWARE versions before 2.30.9 allows an attacker to gain privileges via a Trojan horse DLL… |
CVE-2018-0620 | High | 7.8 | 2018-07-26 | Untrusted search path vulnerability in LOGICOOL Game Software versions before 8.87.116 allows an attacker to gain privileges via a Trojan horse DLL in an unspe… |
CVE-2018-0619 | High | 7.8 | 2018-07-26 | Untrusted search path vulnerability in the installer of Glarysoft Glary Utilities (Glary Utilities 5.99 and earlier and Glary Utilities Pro 5.99 and earlier) a… |
CVE-2018-10875 | High | 7.8 | 2018-07-13 | A flaw was found in ansible. ansible.cfg is read from the current working directory which can be altered to make it point to a plugin or a module path under th… |
CVE-2018-1487 | High | 8.4 | 2018-07-10 | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5 and 11.1 binaries load shared libraries from an untrusted path potentially gi… |
CVE-2018-1458 | High | 7.4 | 2018-07-10 | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10,1, 10.5 and 11.1 could allow a local user to execute arbitrary code and conduct DLL h… |
CVE-2018-13133 | High | 7.8 | 2018-07-04 | Golden Frog VyprVPN before 2018-06-21 has a vulnerability associated with the installation process on Windows. |
CVE-2018-13102 | High | 7.8 | 2018-07-03 | AnyDesk before "12.06.2018 - 4.1.3" on Windows 7 SP1 has a DLL preloading vulnerability. |
CVE-2018-10874 | High | 7.8 | 2018-07-02 | In ansible it was found that inventory variables are loaded from current working directory when running ad-hoc command which are under attacker's control, allo… |
CVE-2018-12589 | High | 7.8 | 2018-06-28 | Polaris Office 2017 8.1 allows attackers to execute arbitrary code via a Trojan horse puiframeworkproresenu.dll file in the current working directory. |
CVE-2018-0609 | High | 7.8 | 2018-06-26 | Untrusted search path vulnerability in LINE for Windows versions before 5.8.0 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified di… |
CVE-2018-0601 | High | 7.8 | 2018-06-26 | Untrusted search path vulnerability in axpdfium v0.01 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory. |
CVE-2018-0600 | High | 7.8 | 2018-06-26 | Untrusted search path vulnerability in the installer of PlayMemories Home for Windows ver.5.5.01 and earlier allows an attacker to gain privileges via a Trojan… |
CVE-2018-0599 | High | 7.8 | 2018-06-26 | Untrusted search path vulnerability in the installer of Visual C++ Redistributable allows an attacker to gain privileges via a Trojan horse DLL in an unspecifi… |
CVE-2018-0598 | High | 7.8 | 2018-06-26 | Untrusted search path vulnerability in Self-extracting archive files created by IExpress bundled with Microsoft Windows allows an attacker to gain privileges v… |
CVE-2018-0597 | High | 7.8 | 2018-06-26 | Untrusted search path vulnerability in the installer of Visual Studio Code allows an attacker to gain privileges via a Trojan horse DLL in an unspecified direc… |
CVE-2018-0596 | High | 7.8 | 2018-06-26 | Untrusted search path vulnerability in the installer of Visual Studio Community allows an attacker to gain privileges via a Trojan horse DLL in an unspecified… |
CVE-2018-0595 | High | 7.8 | 2018-06-26 | Untrusted search path vulnerability in the installer of Skype for Windows allows an attacker to gain privileges via a Trojan horse DLL in an unspecified direct… |
CVE-2018-0594 | High | 7.8 | 2018-06-26 | Untrusted search path vulnerability in Skype for Windows allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory. |
CVE-2018-0593 | High | 7.8 | 2018-06-26 | Untrusted search path vulnerability in the installer of Microsoft OneDrive allows an attacker to gain privileges via a Trojan horse DLL in an unspecified direc… |
CVE-2018-0592 | High | 7.8 | 2018-06-26 | Untrusted search path vulnerability in Microsoft OneDrive allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory. |
CVE-2018-0563 | High | 7.8 | 2018-06-26 | Untrusted search path vulnerability in the installer of FLET'S VIRUS CLEAR Easy Setup & Application Tool ver.13.0 and earlier versions and FLET'S VIRUS CLEAR v… |
CVE-2018-1000201 | High | 7.8 | 2018-06-22 | ruby-ffi version 1.9.23 and earlier has a DLL loading issue which can be hijacked on Windows OS, when a Symbol is used as DLL name instead of a String This vul… |
CVE-2017-7755 | High | 7.8 | 2018-06-11 | The Firefox installer on Windows can be made to load malicious DLL files stored in the same directory as the installer when it is run. This allows privileged e… |
CVE-2018-6514 | High | 7.8 | 2018-06-11 | In Puppet Agent 1.10.x prior to 1.10.13, Puppet Agent 5.3.x prior to 5.3.7, Puppet Agent 5.5.x prior to 5.5.2, Facter on Windows is vulnerable to a DLL preload… |
CVE-2018-6513 | High | 8.8 | 2018-06-11 | Puppet Enterprise 2016.4.x prior to 2016.4.12, Puppet Enterprise 2017.3.x prior to 2017.3.7, Puppet Enterprise 2018.1.x prior to 2018.1.1, Puppet Agent 1.10.x… |
CVE-2018-7884 | High | 7.8 | 2018-06-05 | An issue was discovered in DisplayLink Core Software Cleaner Application 8.2.1956. When the drivers are updated to a newer version, the product launches a proc… |
CVE-2018-11551 | High | 7.8 | 2018-06-01 | AXON PBX 2.02 contains a DLL hijacking vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary code on a targeted system. The v… |
CVE-2018-10650 | High | 7.8 | 2018-05-23 | There is an Insufficient Path Validation Vulnerability in Citrix XenMobile Server 10.8 before RP2 and 10.7 before RP3. |
CVE-2018-4927 | High | 7.8 | 2018-05-19 | Adobe InDesign versions 13.0 and below have an exploitable Untrusted Search Path vulnerability. Successful exploitation could lead to local privilege escalatio… |
CVE-2018-10027 | High | 7.8 | 2018-05-17 | ESTsoft ALZip before 10.76 allows local users to execute arbitrary code via creating a malicious .DLL file and installing it in a specific directory: %PROGRAMF… |
CVE-2018-0580 | High | 7.8 | 2018-05-14 | Untrusted search path vulnerability in CELSYS, Inc CLIP STUDIO series (CLIP STUDIO PAINT (for Windows) EX/PRO/DEBUT Ver.1.7.3 and earlier, CLIP STUDIO ACTION (… |
CVE-2017-2802 | High | 7.8 | 2018-04-24 | An exploitable dll hijacking vulnerability exists in the poaService.exe service component of the Dell Precision Optimizer software version 3.5.5.0. A specifica… |
CVE-2018-6306 | High | 7.8 | 2018-04-19 | Unauthorized code execution from specific DLL and is known as DLL Hijacking attack in Kaspersky Password Manager versions before 8.0.6.538. |