CWE-427 · Uncontrolled Search Path Element (page 10)
Page 10 of 13 — CVEs classified under CWE-427, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-0104 | High | 7.8 | 2021-06-09 | Uncontrolled search path element in the installer for the Intel(R) Rapid Storage Technology software, before versions 17.9.0.34, 18.0.0.640 and 18.1.0.24, may… |
CVE-2021-0090 | High | 7.3 | 2021-06-09 | Uncontrolled search path element in Intel(R) DSA before version 20.11.50.9 may allow an authenticated user to potentially enable an escalation of privilege via… |
CVE-2021-0057 | High | 7.8 | 2021-06-09 | Uncontrolled search path in the Intel(R) NUC M15 Laptop Kit Driver Pack software before updated version 1.1 may allow an authenticated user to potentially enab… |
CVE-2020-8702 | High | 7.3 | 2021-06-09 | Uncontrolled search path element in the Intel(R) Processor Diagnostic Tool before version 4.1.5.37 may allow an authenticated user to potentially enable escala… |
CVE-2021-1536 | Medium | 4.8 | 2021-06-04 | A vulnerability in Cisco Webex Meetings Desktop App for Windows, Cisco Webex Meetings Server, Cisco Webex Network Recording Player for Windows, and Cisco Webex… |
CVE-2019-4588 | High | 7.8 | 2021-05-26 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a local user to execute arbitrary code and conduc… |
CVE-2021-20726 | High | 7.8 | 2021-05-24 | Untrusted search path vulnerability in The Installer of Overwolf 2.168.0.n and earlier allows an attacker to gain privileges and execute arbitrary code with th… |
CVE-2021-20722 | High | 7.8 | 2021-05-24 | Untrusted search path vulnerability in the installers of ScanSnap Manager prior to versions V7.0L20 and the Software Download Installer prior to WinSSInst2JP.e… |
CVE-2021-3423 | High | 7.8 | 2021-05-18 | Uncontrolled Search Path Element vulnerability in the openssl component as used in Bitdefender GravityZone Business Security allows an attacker to load a third… |
CVE-2020-24755 | High | 7.8 | 2021-05-17 | In Ubiquiti UniFi Video v3.10.13, when the executable starts, its first library validation is in the current directory. This allows the impersonation and modif… |
CVE-2021-25694 | High | 7.8 | 2021-05-13 | Teradici PCoIP Graphics Agent for Windows prior to 21.03 does not validate NVENC.dll. An attacker could replace the .dll and redirect pixels elsewhere. |
CVE-2021-1496 | High | 7.0 | 2021-05-06 | Multiple vulnerabilities in the install, uninstall, and upgrade processes of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated… |
CVE-2021-1430 | High | 7.0 | 2021-05-06 | Multiple vulnerabilities in the install, uninstall, and upgrade processes of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated… |
CVE-2021-1429 | High | 7.0 | 2021-05-06 | Multiple vulnerabilities in the install, uninstall, and upgrade processes of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated… |
CVE-2021-1428 | High | 7.0 | 2021-05-06 | Multiple vulnerabilities in the install, uninstall, and upgrade processes of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated… |
CVE-2021-1427 | High | 7.0 | 2021-05-06 | Multiple vulnerabilities in the install, uninstall, and upgrade processes of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated… |
CVE-2021-1426 | High | 7.0 | 2021-05-06 | Multiple vulnerabilities in the install, uninstall, and upgrade processes of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated… |
CVE-2021-3464 | High | 7.8 | 2021-04-27 | A DLL search path vulnerability was reported in Lenovo PCManager, prior to version 3.0.400.3252, that could allow privilege escalation. |
CVE-2020-25244 | High | 8.4 | 2021-04-22 | A vulnerability has been identified in LOGO! Soft Comfort (All versions < V8.4). The software insecurely loads libraries which makes it vulnerable to DLL hijac… |
CVE-2021-21070 | Medium | 6.5 | 2021-04-19 | Adobe Robohelp version 2020.0.3 (and earlier) is affected by an uncontrolled search path element vulnerability that could lead to privilege escalation. An atta… |
CVE-2020-9681 | Medium | 6.5 | 2021-04-16 | Adobe Genuine Service version 6.6 (and earlier) is affected by an Uncontrolled Search Path element vulnerability. An authenticated attacker could exploit this… |
CVE-2020-9667 | Medium | 6.5 | 2021-04-16 | Adobe Genuine Service version 6.6 (and earlier) is affected by an Uncontrolled Search Path element vulnerability. An authenticated attacker with admin privileg… |
CVE-2021-28098 | High | 7.8 | 2021-04-14 | An issue was discovered in Forescout CounterACT before 8.1.4. A local privilege escalation vulnerability is present in the logging function. SecureConnector ru… |
CVE-2021-28647 | High | 7.8 | 2021-04-13 | Trend Micro Password Manager version 5 (Consumer) is vulnerable to a DLL Hijacking vulnerability which could allow an attacker to inject a malicious DLL file d… |
CVE-2021-21545 | High | 7.8 | 2021-04-12 | Dell Peripheral Manager 1.3.1 or greater contains remediation for a local privilege escalation vulnerability that could be potentially exploited to gain arbitr… |
CVE-2021-1386 | High | 7.0 | 2021-04-08 | A vulnerability in the dynamic link library (DLL) loading mechanism in Cisco Advanced Malware Protection (AMP) for Endpoints Windows Connector, ClamAV for Wind… |
CVE-2021-22195 | High | 8.6 | 2021-04-01 | Client side code execution in gitlab-vscode-extension v3.15.0 and earlier allows attacker to execute code on user system |
CVE-2020-6790 | High | 7.8 | 2021-03-25 | Calling an executable through an Uncontrolled Search Path Element in the Bosch Video Streaming Gateway installer up to and including version 6.45.10 potentiall… |
CVE-2020-6789 | High | 7.8 | 2021-03-25 | Loading a DLL through an Uncontrolled Search Path Element in the Bosch Monitor Wall installer up to and including version 10.00.0164 potentially allows an atta… |
CVE-2020-6788 | High | 7.8 | 2021-03-25 | Loading a DLL through an Uncontrolled Search Path Element in the Bosch Configuration Manager installer up to and including version 7.21.0078 potentially allows… |
CVE-2020-6787 | High | 7.8 | 2021-03-25 | Loading a DLL through an Uncontrolled Search Path Element in the Bosch Video Client installer up to and including version 1.7.6.079 potentially allows an attac… |
CVE-2020-6786 | High | 7.8 | 2021-03-25 | Loading a DLL through an Uncontrolled Search Path Element in the Bosch Video Recording Manager installer up to and including version 3.82.0055 for 3.82, up to… |
CVE-2020-6785 | High | 7.8 | 2021-03-25 | Loading a DLL through an Uncontrolled Search Path Element in Bosch BVMS and BVMS Viewer in versions 10.1.0, 10.0.1, 10.0.0 and 9.0.0 and older potentially allo… |
CVE-2020-6771 | High | 7.8 | 2021-03-25 | Loading a DLL through an Uncontrolled Search Path Element in Bosch IP Helper up to and including version 1.00.0008 potentially allows an attacker to execute ar… |
CVE-2021-28822 | High | 8.8 | 2021-03-23 | The Enterprise Message Service Server (tibemsd), Enterprise Message Service Central Administration (tibemsca), Enterprise Message Service JSON configuration ge… |
CVE-2021-28820 | High | 8.8 | 2021-03-23 | The FTL Server (tibftlserver), FTL C API, FTL Golang API, FTL Java API, and FTL .Net API components of TIBCO Software Inc.'s TIBCO FTL - Community Edition, TIB… |
CVE-2021-28955 | Critical | 9.8 | 2021-03-22 | git-bug before 0.7.2 has an Uncontrolled Search Path Element. It will execute git.bat from the current directory in certain PATH situations (most often seen on… |
CVE-2021-28954 | High | 7.8 | 2021-03-21 | In Chris Walz bit before 1.0.5 on Windows, attackers can run arbitrary code via a .exe file in a crafted repository. |
CVE-2021-28953 | High | 7.8 | 2021-03-21 | The unofficial C/C++ Advanced Lint extension before 1.9.0 for Visual Studio Code allows attackers to execute arbitrary binaries if the user opens a crafted rep… |
CVE-2020-9367 | High | 7.8 | 2021-03-18 | The MPS Agent in Zoho ManageEngine Desktop Central MSP build MSP build 10.0.486 is vulnerable to DLL Hijacking: dcinventory.exe and dcconfig.exe try to load CS… |
CVE-2021-22665 | High | 7.8 | 2021-03-18 | Rockwell Automation DriveTools SP v5.13 and below and Drives AOP v4.12 and below both contain a vulnerability that a local attacker with limited privileges may… |
CVE-2020-26155 | High | 7.8 | 2021-03-18 | Multiple files and folders in Utimaco SecurityServer 4.20.0.4 and 4.31.1.0. are installed with Read/Write permissions for authenticated users, which allows for… |
CVE-2021-21518 | High | 7.8 | 2021-03-12 | Dell SupportAssist Client for Consumer PCs versions 3.7.x, 3.6.x, 3.4.x, 3.3.x, Dell SupportAssist Client for Business PCs versions 2.0.x, 2.1.x, 2.2.x, and De… |
CVE-2021-20674 | High | 7.8 | 2021-03-12 | Untrusted search path vulnerability in Installer of MagicConnect Client program distributed before 2021 March 1 allows an attacker to gain privileges and via a… |
CVE-2020-28646 | High | 7.8 | 2021-02-26 | ownCloud owncloud/client before 2.7 allows DLL Injection. The desktop client loaded development plugins from certain directories when they were present. |
CVE-2021-1366 | High | 7.8 | 2021-02-17 | A vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local atta… |
CVE-2020-24485 | High | 7.8 | 2021-02-17 | Improper conditions check in the Intel(R) FPGA OPAE Driver for Linux before kernel version 4.17 may allow an authenticated user to potentially enable escalatio… |
CVE-2020-24451 | High | 7.3 | 2021-02-17 | Uncontrolled search path in the Intel(R) Optane(TM) DC Persistent Memory installer for Windows* before version 1.00.00.3506 may allow an authenticated user to… |
CVE-2020-25238 | High | 7.8 | 2021-02-09 | A vulnerability has been identified in PCS neo (Administration Console) (All versions < V3.1), TIA Portal (V15, V15.1 and V16). Manipulating certain files in s… |
CVE-2020-35145 | High | 7.8 | 2021-01-29 | Acronis True Image for Windows prior to 2021 Update 3 allowed local privilege escalation due to a DLL hijacking vulnerability in multiple components, aka an Un… |
CVE-2021-25247 | High | 7.8 | 2021-01-27 | A DLL hijacking vulnerability Trend Micro HouseCall for Home Networks version 5.3.1063 and below could allow an attacker to use a malicious DLL to escalate pri… |
CVE-2021-3115 | High | 7.5 | 2021-01-26 | Go before 1.14.14 and 1.15.x before 1.15.7 on Windows is vulnerable to Command Injection and remote code execution when using the "go get" command to fetch mod… |
CVE-2021-1280 | High | 7.8 | 2021-01-20 | A vulnerability in the loading mechanism of specific DLLs of Cisco Advanced Malware Protection (AMP) for Endpoints for Windows and Immunet for Windows could al… |
CVE-2021-21011 | High | 7.0 | 2021-01-13 | Adobe Captivate 2019 version 11.5.1.499 (and earlier) is affected by an uncontrolled search path element vulnerability that could lead to privilege escalation… |
CVE-2021-21010 | High | 7.0 | 2021-01-13 | InCopy version 15.1.1 (and earlier) for Windows is affected by an uncontrolled search path vulnerability that could result in arbitrary code execution in the c… |
CVE-2021-21008 | High | 7.0 | 2021-01-13 | Adobe Animate version 21.0 (and earlier) is affected by an uncontrolled search path element that could result in arbitrary code execution in the context of the… |
CVE-2021-21007 | High | 7.0 | 2021-01-13 | Adobe Illustrator version 25.0 (and earlier) is affected by an uncontrolled search path element that could result in arbitrary code execution in the context of… |
CVE-2021-1240 | Medium | 4.8 | 2021-01-13 | A vulnerability in the loading process of specific DLLs in Cisco Proximity Desktop for Windows could allow an authenticated, local attacker to load a malicious… |
CVE-2021-1237 | High | 7.8 | 2021-01-13 | A vulnerability in the Network Access Manager and Web Security Agent components of Cisco AnyConnect Secure Mobility Client for Windows could allow an authentic… |
CVE-2021-20616 | High | 7.8 | 2021-01-13 | Untrusted search path vulnerability in the installer of SKYSEA Client View Ver.1.020.05b to Ver.16.001.01g allows an attacker to gain privileges via a Trojan h… |
CVE-2020-26050 | High | 7.8 | 2021-01-12 | SaferVPN for Windows Ver 5.0.3.3 through 5.0.4.15 could allow local privilege escalation from low privileged users to SYSTEM via a crafted openssl configuratio… |
CVE-2020-35483 | High | 7.8 | 2021-01-11 | AnyDesk before 6.1.0 on Windows, when run in portable mode on a system where the attacker has write access to the application directory, allows this attacker t… |
CVE-2020-5681 | High | 7.8 | 2020-12-24 | Untrusted search path vulnerability in self-extracting files created by EpsonNet SetupManager versions 2.2.14 and earlier, and Offirio SynergyWare PrintDirecto… |
CVE-2020-24578 | Medium | 6.5 | 2020-12-22 | An issue was discovered on D-Link DSL-2888A devices with firmware prior to AU_2.31_V1.1.47ae55. It has a misconfigured FTP service that allows a malicious netw… |
CVE-2020-29654 | High | 7.8 | 2020-12-12 | Western Digital Dashboard before 3.2.2.9 allows DLL Hijacking that leads to compromise of the SYSTEM account. |
CVE-2020-24447 | High | 7.0 | 2020-12-11 | Adobe Lightroom Classic version 10.0 (and earlier) for Windows is affected by an uncontrolled search path vulnerability that could result in arbitrary code exe… |
CVE-2020-24440 | High | 7.0 | 2020-12-11 | Adobe Prelude version 9.0.1 (and earlier) is affected by an uncontrolled search path element that could result in arbitrary code execution in the context of th… |
CVE-2020-2049 | High | 7.8 | 2020-12-09 | A local privilege escalation vulnerability exists in Palo Alto Networks Cortex XDR Agent on the Windows platform that allows an authenticated local Windows use… |
CVE-2020-28950 | High | 7.8 | 2020-12-04 | The installer of Kaspersky Anti-Ransomware Tool (KART) prior to KART 4.0 Patch C was vulnerable to a DLL hijacking attack that allowed an attacker to elevate p… |
CVE-2020-27348 | Medium | 6.8 | 2020-12-04 | In some conditions, a snap package built by snapcraft includes the current directory in LD_LIBRARY_PATH, allowing a malicious snap to gain code execution withi… |
CVE-2020-6021 | High | 7.8 | 2020-12-03 | Check Point Endpoint Security Client for Windows before version E84.20 allows write access to the directory from which the installation repair takes place. Sin… |
CVE-2020-25738 | Medium | 5.5 | 2020-11-27 | CyberArk Endpoint Privilege Manager (EPM) 11.1.0.173 allows attackers to bypass a Credential Theft protection mechanism by injecting a DLL into a process that… |
CVE-2020-5674 | High | 7.8 | 2020-11-24 | Untrusted search path vulnerability in the installers of multiple SEIKO EPSON products allows an attacker to gain privileges via a Trojan horse DLL in an unspe… |
CVE-2020-12329 | High | 7.8 | 2020-11-12 | Uncontrolled search path in the Intel(R) VTune(TM) Profiler before version 2020 Update 1 may allow an authenticated user to potentially enable escalation of pr… |
CVE-2020-12320 | High | 7.8 | 2020-11-12 | Uncontrolled search path in Intel(R) SCS Add-on for Microsoft* SCCM before version 2.1.10 may allow an authenticated user to potentially enable escalation of p… |
CVE-2020-13771 | High | 7.8 | 2020-11-12 | Various components in Ivanti Endpoint Manager through 2020.1.1 rely on Windows search order when loading a (nonexistent) library file, allowing (under certain… |
CVE-2020-5992 | High | 7.8 | 2020-11-11 | NVIDIA GeForce NOW application software on Windows, all versions prior to 2.0.25.119, contains a vulnerability in its open-source software dependency in which… |
CVE-2020-25174 | High | 7.8 | 2020-11-06 | A DLL hijacking vulnerability in the B. Braun OnlineSuite Version AP 3.0 and earlier allows local attackers to execute code on the system as a high privileged… |
CVE-2020-27955 | Critical | 9.8 | 2020-11-05 | Git LFS 2.12.0 allows Remote Code Execution. |
CVE-2020-27708 | High | 7.8 | 2020-11-02 | A vulnerability exists in the Origin Client that could allow a non-Administrative user to elevate their access to either Administrator or System. Once the user… |
CVE-2020-5145 | High | 8.6 | 2020-10-28 | SonicWall Global VPN client version 4.10.4.0314 and earlier have an insecure library loading (DLL hijacking) vulnerability. Successful exploitation could lead… |
CVE-2020-24425 | High | 7.5 | 2020-10-21 | Dreamweaver version 20.2 (and earlier) is affected by an uncontrolled search path element vulnerability that could lead to privilege escalation. Successful exp… |
CVE-2020-24424 | High | 7.0 | 2020-10-21 | Adobe Premiere Pro version 14.4 (and earlier) is affected by an uncontrolled search path element that could result in arbitrary code execution in the context o… |
CVE-2020-24423 | High | 7.0 | 2020-10-21 | Adobe Media Encoder version 14.4 (and earlier) for Windows is affected by an uncontrolled search path vulnerability that could result in arbitrary code executi… |
CVE-2020-24420 | High | 7.0 | 2020-10-21 | Adobe Photoshop for Windows version 21.2.1 (and earlier) is affected by an uncontrolled search path element vulnerability that could result in arbitrary code e… |
CVE-2020-24419 | High | 7.0 | 2020-10-21 | Adobe After Effects version 17.1.1 (and earlier) for Windows is affected by an uncontrolled search path vulnerability that could result in arbitrary code execu… |
CVE-2020-24422 | High | 7.0 | 2020-10-21 | Adobe Creative Cloud Desktop Application version 5.2 (and earlier) and 2.1 (and earlier) for Windows is affected by an uncontrolled search path vulnerability t… |
CVE-2020-8345 | High | 7.3 | 2020-10-14 | A DLL search path vulnerability was reported in the Lenovo HardwareScan Plugin for the Lenovo Vantage hardware scan feature prior to version 1.0.46.11 that cou… |
CVE-2020-26947 | High | 7.8 | 2020-10-10 | monero-wallet-gui in Monero GUI before 0.17.1.0 includes the . directory in an embedded RPATH (with a preference ahead of /usr/lib), which allows local users t… |
CVE-2019-19115 | High | 7.8 | 2020-10-08 | An escalation of privilege vulnerability in Nahimic APO Software Component Driver 1.4.2, 1.5.0, 1.5.1, 1.6.1 and 1.6.2 allows an attacker to execute code with… |
CVE-2020-26894 | High | 7.8 | 2020-10-08 | LiveCode v9.6.1 on Windows allows local, low-privileged users to gain privileges by creating a malicious "cmd.exe" in the folder of the vulnerable LiveCode app… |
CVE-2020-3535 | High | 7.8 | 2020-10-08 | A vulnerability in the loading mechanism of specific DLLs in the Cisco Webex Teams client for Windows could allow an authenticated, local attacker to load a ma… |
CVE-2020-24356 | Medium | 6.4 | 2020-10-02 | `cloudflared` versions prior to 2020.8.1 contain a local privilege escalation vulnerability on Windows systems. When run on a Windows system, `cloudflared` sea… |
CVE-2020-26538 | High | 7.8 | 2020-10-02 | An issue was discovered in Foxit Reader and PhantomPDF before 10.1. It allows attackers to execute arbitrary code via a Trojan horse taskkill.exe in the curren… |
CVE-2020-15663 | High | 8.8 | 2020-10-01 | If Firefox is installed to a user-writable directory, the Mozilla Maintenance Service would execute updater.exe from the install location with system privilege… |
CVE-2020-6654 | High | 7.8 | 2020-09-30 | A DLL Hijacking vulnerability in Eaton's 9000x Programming and Configuration Software v 2.0.38 and prior allows an attacker to execute arbitrary code by replac… |
CVE-2020-3979 | High | 7.8 | 2020-09-18 | InstallBuilder for Qt Windows (versions prior to 20.7.0) installers look for plugins at a predictable location at initialization time, writable by non-admin us… |
CVE-2020-7358 | Medium | 5.8 | 2020-09-18 | In AppSpider installer versions prior to 7.2.126, the AppSpider installer calls an executable which can be placed in the appropriate directory by an attacker w… |
CVE-2020-7312 | High | 7.8 | 2020-09-10 | DLL Search Order Hijacking Vulnerability in the installer in McAfee Agent (MA) for Windows prior to 5.6.6 allows local users to execute arbitrary code and esca… |
CVE-2019-3881 | High | 7.8 | 2020-09-04 | Bundler prior to 2.1.0 uses a predictable path in /tmp/, created with insecure permissions as a storage location for gems, if locations under the user's home d… |