CWE-427 · Uncontrolled Search Path Element (page 10)
Page 10 of 13 — CVEs classified under CWE-427, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-4623 | Medium | 6.5 | 2021-07-26 | IBM i2 iBase 8.9.13 could allow a local authenticated attacker to execute arbitrary code on the system, caused by a DLL search order hijacking flaw. By using a… |
CVE-2020-5316 | High | 7.8 | 2021-07-22 | Dell SupportAssist for Business PCs versions 2.0, 2.0.1, 2.0.2, 2.1, 2.1.1, 2.1.2, 2.1.3 and Dell SupportAssist for Home PCs version 2.0, 2.0.1, 2.0.2, 2.1, 2… |
CVE-2021-1089 | High | 7.8 | 2021-07-22 | NVIDIA GPU Display Driver for Windows contains a vulnerability in nvidia-smi where an uncontrolled DLL loading path may lead to arbitrary code execution, denia… |
CVE-2021-3550 | High | 7.8 | 2021-07-16 | A DLL search path vulnerability was reported in Lenovo PCManager, prior to version 3.0.500.5102, that could allow privilege escalation. |
CVE-2021-36753 | High | 7.8 | 2021-07-15 | sharkdp BAT before 0.18.2 executes less.exe from the current working directory. |
CVE-2020-11634 | High | 7.8 | 2021-07-15 | The Zscaler Client Connector for Windows prior to 2.1.2.105 had a DLL hijacking vulnerability caused due to the configuration of OpenSSL. A local adversary may… |
CVE-2021-3042 | High | 7.8 | 2021-07-15 | A local privilege escalation (PE) vulnerability exists in the Palo Alto Networks Cortex XDR agent on Windows platforms that enables an authenticated local Wind… |
CVE-2020-29157 | High | 7.8 | 2021-07-14 | An issue in RAONWIZ K Editor v2018.0.0.10 allows attackers to perform a DLL hijacking attack when the service or system is restarted. |
CVE-2021-22000 | High | 7.8 | 2021-07-13 | VMware Thinapp version 5.x prior to 5.2.10 contain a DLL hijacking vulnerability due to insecure loading of DLLs. A malicious actor with non-administrative pri… |
CVE-2021-35957 | Medium | 6.7 | 2021-07-13 | Stormshield Endpoint Security Evolution 2.0.0 through 2.0.2 does not accomplish the intended defense against local administrators who can replace the Visual C+… |
CVE-2021-36376 | High | 7.8 | 2021-07-13 | dandavison delta before 0.8.3 on Windows resolves an executable's pathname as a relative path from the current directory. |
CVE-2021-3613 | High | 7.8 | 2021-07-02 | OpenVPN Connect 3.2.0 through 3.3.0 allows local users to load arbitrary dynamic loadable libraries via an OpenSSL configuration file if present, which allows… |
CVE-2021-3606 | High | 7.8 | 2021-07-02 | OpenVPN before version 2.5.3 on Windows allows local users to load arbitrary dynamic loadable libraries via an OpenSSL configuration file if present, which all… |
CVE-2021-28570 | High | 8.3 | 2021-06-28 | Adobe After Effects version 18.1 (and earlier) is affected by an Uncontrolled Search Path element vulnerability. An unauthenticated attacker could exploit this… |
CVE-2021-29949 | High | 7.8 | 2021-06-24 | When loading the shared library that provides the OTR protocol implementation, Thunderbird will initially attempt to open it using a filename that isn't distri… |
CVE-2021-21999 | High | 7.8 | 2021-06-23 | VMware Tools for Windows (11.x.y prior to 11.2.6), VMware Remote Console for Windows (12.x prior to 12.0.1) , VMware App Volumes (2.x prior to 2.18.10 and 4 pr… |
CVE-2021-1567 | High | 7.0 | 2021-06-16 | A vulnerability in the DLL loading mechanism of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to perform a D… |
CVE-2021-34803 | High | 7.8 | 2021-06-16 | TeamViewer before 14.7.48644 on Windows loads untrusted DLLs in certain situations. |
CVE-2021-31840 | High | 7.3 | 2021-06-10 | A vulnerability in the preloading mechanism of specific dynamic link libraries in McAfee Agent for Windows prior to 5.7.3 could allow an authenticated, local a… |
CVE-2021-23023 | High | 7.8 | 2021-06-10 | On version 7.2.1.x before 7.2.1.3 and 7.1.x before 7.1.9.9 Update 1, a DLL hijacking issue exists in cachecleaner.dll included in the BIG-IP Edge Client Window… |
CVE-2021-3041 | High | 7.8 | 2021-06-10 | A local privilege escalation vulnerability exists in the Palo Alto Networks Cortex XDR agent on Windows platforms that enables an authenticated local Windows u… |
CVE-2021-0108 | High | 7.3 | 2021-06-09 | Uncontrolled search path in the Intel Unite(R) Client for Windows before version 4.2.25031 may allow an authenticated user to potentially enable an escalation… |
CVE-2021-0104 | High | 7.8 | 2021-06-09 | Uncontrolled search path element in the installer for the Intel(R) Rapid Storage Technology software, before versions 17.9.0.34, 18.0.0.640 and 18.1.0.24, may… |
CVE-2021-0090 | High | 7.3 | 2021-06-09 | Uncontrolled search path element in Intel(R) DSA before version 20.11.50.9 may allow an authenticated user to potentially enable an escalation of privilege via… |
CVE-2021-0057 | High | 7.8 | 2021-06-09 | Uncontrolled search path in the Intel(R) NUC M15 Laptop Kit Driver Pack software before updated version 1.1 may allow an authenticated user to potentially enab… |
CVE-2020-8702 | High | 7.3 | 2021-06-09 | Uncontrolled search path element in the Intel(R) Processor Diagnostic Tool before version 4.1.5.37 may allow an authenticated user to potentially enable escala… |
CVE-2021-1536 | Medium | 4.8 | 2021-06-04 | A vulnerability in Cisco Webex Meetings Desktop App for Windows, Cisco Webex Meetings Server, Cisco Webex Network Recording Player for Windows, and Cisco Webex… |
CVE-2019-4588 | High | 7.8 | 2021-05-26 | IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a local user to execute arbitrary code and conduc… |
CVE-2021-20726 | High | 7.8 | 2021-05-24 | Untrusted search path vulnerability in The Installer of Overwolf 2.168.0.n and earlier allows an attacker to gain privileges and execute arbitrary code with th… |
CVE-2021-20722 | High | 7.8 | 2021-05-24 | Untrusted search path vulnerability in the installers of ScanSnap Manager prior to versions V7.0L20 and the Software Download Installer prior to WinSSInst2JP.e… |
CVE-2021-3423 | High | 7.8 | 2021-05-18 | Uncontrolled Search Path Element vulnerability in the openssl component as used in Bitdefender GravityZone Business Security allows an attacker to load a third… |
CVE-2020-24755 | High | 7.8 | 2021-05-17 | In Ubiquiti UniFi Video v3.10.13, when the executable starts, its first library validation is in the current directory. This allows the impersonation and modif… |
CVE-2021-25694 | High | 7.8 | 2021-05-13 | Teradici PCoIP Graphics Agent for Windows prior to 21.03 does not validate NVENC.dll. An attacker could replace the .dll and redirect pixels elsewhere. |
CVE-2021-1496 | High | 7.0 | 2021-05-06 | Multiple vulnerabilities in the install, uninstall, and upgrade processes of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated… |
CVE-2021-1430 | High | 7.0 | 2021-05-06 | Multiple vulnerabilities in the install, uninstall, and upgrade processes of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated… |
CVE-2021-1429 | High | 7.0 | 2021-05-06 | Multiple vulnerabilities in the install, uninstall, and upgrade processes of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated… |
CVE-2021-1428 | High | 7.0 | 2021-05-06 | Multiple vulnerabilities in the install, uninstall, and upgrade processes of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated… |
CVE-2021-1427 | High | 7.0 | 2021-05-06 | Multiple vulnerabilities in the install, uninstall, and upgrade processes of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated… |
CVE-2021-1426 | High | 7.0 | 2021-05-06 | Multiple vulnerabilities in the install, uninstall, and upgrade processes of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated… |
CVE-2021-3464 | High | 7.8 | 2021-04-27 | A DLL search path vulnerability was reported in Lenovo PCManager, prior to version 3.0.400.3252, that could allow privilege escalation. |
CVE-2020-25244 | High | 8.4 | 2021-04-22 | A vulnerability has been identified in LOGO! Soft Comfort (All versions < V8.4). The software insecurely loads libraries which makes it vulnerable to DLL hijac… |
CVE-2021-21070 | Medium | 6.5 | 2021-04-19 | Adobe Robohelp version 2020.0.3 (and earlier) is affected by an uncontrolled search path element vulnerability that could lead to privilege escalation. An atta… |
CVE-2020-9681 | Medium | 6.5 | 2021-04-16 | Adobe Genuine Service version 6.6 (and earlier) is affected by an Uncontrolled Search Path element vulnerability. An authenticated attacker could exploit this… |
CVE-2020-9667 | Medium | 6.5 | 2021-04-16 | Adobe Genuine Service version 6.6 (and earlier) is affected by an Uncontrolled Search Path element vulnerability. An authenticated attacker with admin privileg… |
CVE-2021-28098 | High | 7.8 | 2021-04-14 | An issue was discovered in Forescout CounterACT before 8.1.4. A local privilege escalation vulnerability is present in the logging function. SecureConnector ru… |
CVE-2021-28647 | High | 7.8 | 2021-04-13 | Trend Micro Password Manager version 5 (Consumer) is vulnerable to a DLL Hijacking vulnerability which could allow an attacker to inject a malicious DLL file d… |
CVE-2021-21545 | High | 7.8 | 2021-04-12 | Dell Peripheral Manager 1.3.1 or greater contains remediation for a local privilege escalation vulnerability that could be potentially exploited to gain arbitr… |
CVE-2021-1386 | High | 7.0 | 2021-04-08 | A vulnerability in the dynamic link library (DLL) loading mechanism in Cisco Advanced Malware Protection (AMP) for Endpoints Windows Connector, ClamAV for Wind… |
CVE-2021-22195 | High | 8.6 | 2021-04-01 | Client side code execution in gitlab-vscode-extension v3.15.0 and earlier allows attacker to execute code on user system |
CVE-2020-6790 | High | 7.8 | 2021-03-25 | Calling an executable through an Uncontrolled Search Path Element in the Bosch Video Streaming Gateway installer up to and including version 6.45.10 potentiall… |
CVE-2020-6789 | High | 7.8 | 2021-03-25 | Loading a DLL through an Uncontrolled Search Path Element in the Bosch Monitor Wall installer up to and including version 10.00.0164 potentially allows an atta… |
CVE-2020-6788 | High | 7.8 | 2021-03-25 | Loading a DLL through an Uncontrolled Search Path Element in the Bosch Configuration Manager installer up to and including version 7.21.0078 potentially allows… |
CVE-2020-6787 | High | 7.8 | 2021-03-25 | Loading a DLL through an Uncontrolled Search Path Element in the Bosch Video Client installer up to and including version 1.7.6.079 potentially allows an attac… |
CVE-2020-6786 | High | 7.8 | 2021-03-25 | Loading a DLL through an Uncontrolled Search Path Element in the Bosch Video Recording Manager installer up to and including version 3.82.0055 for 3.82, up to… |
CVE-2020-6785 | High | 7.8 | 2021-03-25 | Loading a DLL through an Uncontrolled Search Path Element in Bosch BVMS and BVMS Viewer in versions 10.1.0, 10.0.1, 10.0.0 and 9.0.0 and older potentially allo… |
CVE-2020-6771 | High | 7.8 | 2021-03-25 | Loading a DLL through an Uncontrolled Search Path Element in Bosch IP Helper up to and including version 1.00.0008 potentially allows an attacker to execute ar… |
CVE-2021-28822 | High | 8.8 | 2021-03-23 | The Enterprise Message Service Server (tibemsd), Enterprise Message Service Central Administration (tibemsca), Enterprise Message Service JSON configuration ge… |
CVE-2021-28820 | High | 8.8 | 2021-03-23 | The FTL Server (tibftlserver), FTL C API, FTL Golang API, FTL Java API, and FTL .Net API components of TIBCO Software Inc.'s TIBCO FTL - Community Edition, TIB… |
CVE-2021-28955 | Critical | 9.8 | 2021-03-22 | git-bug before 0.7.2 has an Uncontrolled Search Path Element. It will execute git.bat from the current directory in certain PATH situations (most often seen on… |
CVE-2021-28954 | High | 7.8 | 2021-03-21 | In Chris Walz bit before 1.0.5 on Windows, attackers can run arbitrary code via a .exe file in a crafted repository. |
CVE-2021-28953 | High | 7.8 | 2021-03-21 | The unofficial C/C++ Advanced Lint extension before 1.9.0 for Visual Studio Code allows attackers to execute arbitrary binaries if the user opens a crafted rep… |
CVE-2020-9367 | High | 7.8 | 2021-03-18 | The MPS Agent in Zoho ManageEngine Desktop Central MSP build MSP build 10.0.486 is vulnerable to DLL Hijacking: dcinventory.exe and dcconfig.exe try to load CS… |
CVE-2021-22665 | High | 7.8 | 2021-03-18 | Rockwell Automation DriveTools SP v5.13 and below and Drives AOP v4.12 and below both contain a vulnerability that a local attacker with limited privileges may… |
CVE-2020-26155 | High | 7.8 | 2021-03-18 | Multiple files and folders in Utimaco SecurityServer 4.20.0.4 and 4.31.1.0. are installed with Read/Write permissions for authenticated users, which allows for… |
CVE-2021-21518 | High | 7.8 | 2021-03-12 | Dell SupportAssist Client for Consumer PCs versions 3.7.x, 3.6.x, 3.4.x, 3.3.x, Dell SupportAssist Client for Business PCs versions 2.0.x, 2.1.x, 2.2.x, and De… |
CVE-2021-20674 | High | 7.8 | 2021-03-12 | Untrusted search path vulnerability in Installer of MagicConnect Client program distributed before 2021 March 1 allows an attacker to gain privileges and via a… |
CVE-2020-28646 | High | 7.8 | 2021-02-26 | ownCloud owncloud/client before 2.7 allows DLL Injection. The desktop client loaded development plugins from certain directories when they were present. |
CVE-2021-1366 | High | 7.8 | 2021-02-17 | A vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local atta… |
CVE-2020-24485 | High | 7.8 | 2021-02-17 | Improper conditions check in the Intel(R) FPGA OPAE Driver for Linux before kernel version 4.17 may allow an authenticated user to potentially enable escalatio… |
CVE-2020-24451 | High | 7.3 | 2021-02-17 | Uncontrolled search path in the Intel(R) Optane(TM) DC Persistent Memory installer for Windows* before version 1.00.00.3506 may allow an authenticated user to… |
CVE-2020-25238 | High | 7.8 | 2021-02-09 | A vulnerability has been identified in PCS neo (Administration Console) (All versions < V3.1), TIA Portal (V15, V15.1 and V16). Manipulating certain files in s… |
CVE-2020-35145 | High | 7.8 | 2021-01-29 | Acronis True Image for Windows prior to 2021 Update 3 allowed local privilege escalation due to a DLL hijacking vulnerability in multiple components, aka an Un… |
CVE-2021-25247 | High | 7.8 | 2021-01-27 | A DLL hijacking vulnerability Trend Micro HouseCall for Home Networks version 5.3.1063 and below could allow an attacker to use a malicious DLL to escalate pri… |
CVE-2021-3115 | High | 7.5 | 2021-01-26 | Go before 1.14.14 and 1.15.x before 1.15.7 on Windows is vulnerable to Command Injection and remote code execution when using the "go get" command to fetch mod… |
CVE-2021-1280 | High | 7.8 | 2021-01-20 | A vulnerability in the loading mechanism of specific DLLs of Cisco Advanced Malware Protection (AMP) for Endpoints for Windows and Immunet for Windows could al… |
CVE-2021-21011 | High | 7.0 | 2021-01-13 | Adobe Captivate 2019 version 11.5.1.499 (and earlier) is affected by an uncontrolled search path element vulnerability that could lead to privilege escalation… |
CVE-2021-21010 | High | 7.0 | 2021-01-13 | InCopy version 15.1.1 (and earlier) for Windows is affected by an uncontrolled search path vulnerability that could result in arbitrary code execution in the c… |
CVE-2021-21008 | High | 7.0 | 2021-01-13 | Adobe Animate version 21.0 (and earlier) is affected by an uncontrolled search path element that could result in arbitrary code execution in the context of the… |
CVE-2021-21007 | High | 7.0 | 2021-01-13 | Adobe Illustrator version 25.0 (and earlier) is affected by an uncontrolled search path element that could result in arbitrary code execution in the context of… |
CVE-2021-1240 | Medium | 4.8 | 2021-01-13 | A vulnerability in the loading process of specific DLLs in Cisco Proximity Desktop for Windows could allow an authenticated, local attacker to load a malicious… |
CVE-2021-1237 | High | 7.8 | 2021-01-13 | A vulnerability in the Network Access Manager and Web Security Agent components of Cisco AnyConnect Secure Mobility Client for Windows could allow an authentic… |
CVE-2021-20616 | High | 7.8 | 2021-01-13 | Untrusted search path vulnerability in the installer of SKYSEA Client View Ver.1.020.05b to Ver.16.001.01g allows an attacker to gain privileges via a Trojan h… |
CVE-2020-26050 | High | 7.8 | 2021-01-12 | SaferVPN for Windows Ver 5.0.3.3 through 5.0.4.15 could allow local privilege escalation from low privileged users to SYSTEM via a crafted openssl configuratio… |
CVE-2020-35483 | High | 7.8 | 2021-01-11 | AnyDesk before 6.1.0 on Windows, when run in portable mode on a system where the attacker has write access to the application directory, allows this attacker t… |
CVE-2020-5681 | High | 7.8 | 2020-12-24 | Untrusted search path vulnerability in self-extracting files created by EpsonNet SetupManager versions 2.2.14 and earlier, and Offirio SynergyWare PrintDirecto… |
CVE-2020-24578 | Medium | 6.5 | 2020-12-22 | An issue was discovered on D-Link DSL-2888A devices with firmware prior to AU_2.31_V1.1.47ae55. It has a misconfigured FTP service that allows a malicious netw… |
CVE-2020-29654 | High | 7.8 | 2020-12-12 | Western Digital Dashboard before 3.2.2.9 allows DLL Hijacking that leads to compromise of the SYSTEM account. |
CVE-2020-24447 | High | 7.0 | 2020-12-11 | Adobe Lightroom Classic version 10.0 (and earlier) for Windows is affected by an uncontrolled search path vulnerability that could result in arbitrary code exe… |
CVE-2020-24440 | High | 7.0 | 2020-12-11 | Adobe Prelude version 9.0.1 (and earlier) is affected by an uncontrolled search path element that could result in arbitrary code execution in the context of th… |
CVE-2020-2049 | High | 7.8 | 2020-12-09 | A local privilege escalation vulnerability exists in Palo Alto Networks Cortex XDR Agent on the Windows platform that allows an authenticated local Windows use… |
CVE-2020-28950 | High | 7.8 | 2020-12-04 | The installer of Kaspersky Anti-Ransomware Tool (KART) prior to KART 4.0 Patch C was vulnerable to a DLL hijacking attack that allowed an attacker to elevate p… |
CVE-2020-27348 | Medium | 6.8 | 2020-12-04 | In some conditions, a snap package built by snapcraft includes the current directory in LD_LIBRARY_PATH, allowing a malicious snap to gain code execution withi… |
CVE-2020-6021 | High | 7.8 | 2020-12-03 | Check Point Endpoint Security Client for Windows before version E84.20 allows write access to the directory from which the installation repair takes place. Sin… |
CVE-2020-25738 | Medium | 5.5 | 2020-11-27 | CyberArk Endpoint Privilege Manager (EPM) 11.1.0.173 allows attackers to bypass a Credential Theft protection mechanism by injecting a DLL into a process that… |
CVE-2020-5674 | High | 7.8 | 2020-11-24 | Untrusted search path vulnerability in the installers of multiple SEIKO EPSON products allows an attacker to gain privileges via a Trojan horse DLL in an unspe… |
CVE-2020-12329 | High | 7.8 | 2020-11-12 | Uncontrolled search path in the Intel(R) VTune(TM) Profiler before version 2020 Update 1 may allow an authenticated user to potentially enable escalation of pr… |
CVE-2020-12320 | High | 7.8 | 2020-11-12 | Uncontrolled search path in Intel(R) SCS Add-on for Microsoft* SCCM before version 2.1.10 may allow an authenticated user to potentially enable escalation of p… |
CVE-2020-13771 | High | 7.8 | 2020-11-12 | Various components in Ivanti Endpoint Manager through 2020.1.1 rely on Windows search order when loading a (nonexistent) library file, allowing (under certain… |
CVE-2020-5992 | High | 7.8 | 2020-11-11 | NVIDIA GeForce NOW application software on Windows, all versions prior to 2.0.25.119, contains a vulnerability in its open-source software dependency in which… |
CVE-2020-25174 | High | 7.8 | 2020-11-06 | A DLL hijacking vulnerability in the B. Braun OnlineSuite Version AP 3.0 and earlier allows local attackers to execute code on the system as a high privileged… |