CWE-427 · Uncontrolled Search Path Element (page 11)
Page 11 of 13 — CVEs classified under CWE-427, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-24162 | High | 7.8 | 2020-09-03 | The Shenzhen Tencent app 5.8.2.5300 for PC platforms (from Tencent App Center) has a DLL hijacking vulnerability. Attackers can use this vulnerability to execu… |
CVE-2020-24161 | High | 7.8 | 2020-09-03 | Guangzhou NetEase Mail Master 4.14.1.1004 on Windows has a DLL hijacking vulnerability. Attackers can use this vulnerability to execute malicious code. |
CVE-2020-24160 | High | 7.8 | 2020-09-03 | Shenzhen Tencent TIM Windows client 3.0.0.21315 has a DLL hijacking vulnerability, which can be exploited by attackers to execute malicious code. |
CVE-2020-24159 | High | 7.8 | 2020-09-03 | NetEase Youdao Dictionary has a DLL hijacking vulnerability, which can be exploited by attackers to gain server permissions. This affects Guangzhou NetEase You… |
CVE-2020-24158 | High | 7.8 | 2020-09-03 | 360 Speed Browser 12.0.1247.0 has a DLL hijacking vulnerability, which can be exploited by attackers to execute malicious code. It is a dual-core browser owned… |
CVE-2020-25045 | High | 7.8 | 2020-09-02 | Installers of Kaspersky Security Center and Kaspersky Security Center Web Console prior to 12 & prior to 12 Patch A were vulnerable to a DLL hijacking attack t… |
CVE-2020-15167 | High | 8.2 | 2020-09-02 | In Miller (command line utility) using the configuration file support introduced in version 5.9.0, it is possible for an attacker to cause Miller to run arbitr… |
CVE-2020-5419 | Medium | 6.7 | 2020-08-31 | RabbitMQ versions 3.8.x prior to 3.8.7 are prone to a Windows-specific binary planting security vulnerability that allows for arbitrary code execution. An atta… |
CVE-2020-14349 | High | 7.1 | 2020-08-24 | It was found that PostgreSQL versions before 12.4, before 11.9 and before 10.14 did not properly sanitize the search_path during logical replication. An authen… |
CVE-2020-9724 | High | 7.8 | 2020-08-19 | Adobe Lightroom versions 9.2.0.10 and earlier have an insecure library loading vulnerability. Successful exploitation could lead to privilege escalation. |
CVE-2020-3433 | High | 7.8 | 2020-08-17 | A vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local atta… |
CVE-2020-9767 | High | 7.8 | 2020-08-14 | A vulnerability related to Dynamic-link Library (“DLL”) loading in the Zoom Sharing Service would allow an attacker who had local access to a machine on which… |
CVE-2020-7360 | High | 7.4 | 2020-08-13 | An Uncontrolled Search Path Element (CWE-427) vulnerability in SmartControl version 4.3.15 and versions released before April 15, 2020 may allow an authenticat… |
CVE-2020-8687 | High | 7.8 | 2020-08-13 | Uncontrolled search path in the installer for Intel(R) RSTe Software RAID Driver for the Intel(R) Server Board M10JNP2SB before version 4.7.0.1119 may allow an… |
CVE-2020-15596 | Medium | 6.7 | 2020-08-12 | The ALPS ALPINE touchpad driver before 8.2206.1717.634, as used on various Dell, HP, and Lenovo laptops, allows attackers to conduct Path Disclosure attacks vi… |
CVE-2020-13177 | High | 7.8 | 2020-08-11 | The support bundler in Teradici PCoIP Standard Agent for Windows and Graphics Agent for Windows versions prior to 20.04.1 and 20.07.0 does not use hard coded p… |
CVE-2020-15657 | High | 7.8 | 2020-08-10 | Firefox could be made to load attacker-supplied DLL files from the installation directory. This required an attacker that is already capable of placing files i… |
CVE-2020-16143 | High | 7.8 | 2020-07-29 | The seafile-client client 7.0.8 for Seafile is vulnerable to DLL hijacking because it loads exchndl.dll from the current working directory. |
CVE-2020-10610 | High | 7.8 | 2020-07-24 | In OSIsoft PI System multiple products and versions, a local attacker can modify a search path and plant a binary to exploit the affected PI System software to… |
CVE-2020-15724 | High | 7.8 | 2020-07-21 | In the version 12.1.0.1005 and below of 360 Total Security, when the Gamefolde calls GameChrome.exe, there exists a local privilege escalation vulnerability. A… |
CVE-2020-15723 | High | 7.8 | 2020-07-21 | In the version 12.1.0.1004 and below of 360 Total Security, when the main process of 360 Total Security calls GameChrome.exe, there exists a local privilege es… |
CVE-2020-15722 | High | 7.8 | 2020-07-21 | In version 12.1.0.1004 and below of 360 Total Security,when TPI calls the browser process, there exists a local privilege escalation vulnerability. An attacker… |
CVE-2020-12423 | High | 7.8 | 2020-07-09 | When the Windows DLL "webauthn.dll" was missing from the Operating System, and a malicious one was placed in a folder in the user's %PATH%, Firefox may have lo… |
CVE-2020-9100 | High | 7.8 | 2020-07-06 | Earlier than HiSuite 10.1.0.500 have a DLL hijacking vulnerability. This vulnerability exists due to some DLL file is loaded by HiSuite improperly. And it allo… |
CVE-2020-15523 | High | 7.8 | 2020-07-04 | In Python 3.6 through 3.6.10, 3.7 through 3.7.8, 3.8 through 3.8.4rc1, and 3.9 through 3.9.0b4 on Windows, a Trojan horse python3.dll might be used in cases wh… |
CVE-2019-20419 | High | 7.8 | 2020-07-03 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to execute arbitrary code via a DLL hijacking vulnerability in Tomcat. The af… |
CVE-2020-13279 | High | 8.6 | 2020-06-22 | Client side code execution in gitlab-vscode-extension v2.2.0 allows attacker to execute code on user system |
CVE-2019-20856 | Critical | 9.8 | 2020-06-19 | An issue was discovered in Mattermost Desktop App before 4.3.0 on macOS. It allows dylib injection. |
CVE-2020-11613 | High | 7.8 | 2020-06-11 | Mids' Reborn Hero Designer 2.6.0.7 has an elevation of privilege vulnerability due to default and insecure permissions being set for the installation folder. B… |
CVE-2020-7585 | High | 7.8 | 2020-06-10 | A vulnerability has been identified in SIMATIC PCS 7 V8.2 and earlier (All versions), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP3), SIMATIC PDM (All versions <… |
CVE-2019-3613 | Medium | 5.9 | 2020-06-10 | DLL Search Order Hijacking vulnerability in McAfee Agent (MA) prior to 5.6.4 allows attackers with local access to execute arbitrary code via execution from a… |
CVE-2020-9858 | High | 7.8 | 2020-06-09 | A dynamic library loading issue was addressed with improved path searching. This issue is fixed in Windows Migration Assistant 2.2.0.0 (v. 1A11). Running the i… |
CVE-2020-5357 | High | 7.1 | 2020-05-28 | Dell Dock Firmware Update Utilities for Dell Client Consumer and Commercial docking stations contain an Arbitrary File Overwrite vulnerability. The vulnerabili… |
CVE-2020-13110 | High | 7.8 | 2020-05-16 | The kerberos package before 1.0.0 for Node.js allows arbitrary code execution and privilege escalation via injection of malicious DLLs through use of the kerbe… |
CVE-2020-10616 | High | 8.8 | 2020-05-14 | Opto 22 SoftPAC Project Version 9.6 and prior. SoftPAC does not specify the path of multiple imported .dll files. Therefore, an attacker can replace them and e… |
CVE-2020-10626 | High | 7.8 | 2020-05-14 | In Fazecast jSerialComm, Version 2.2.2 and prior, an uncontrolled search path element vulnerability could allow a malicious DLL file with the same name of any… |
CVE-2020-6244 | High | 7.8 | 2020-05-12 | SAP Business Client, version 7.0, allows an attacker after a successful social engineering attack to inject malicious code as a DLL file in untrusted directori… |
CVE-2019-20781 | High | 7.8 | 2020-04-29 | An issue was discovered in LG Bridge before April 2019 on Windows. DLL Hijacking can occur. |
CVE-2020-5740 | High | 7.8 | 2020-04-22 | Improper Input Validation in Plex Media Server on Windows allows a local, unauthenticated attacker to execute arbitrary Python code with SYSTEM privileges. |
CVE-2020-8895 | High | 7.8 | 2020-04-21 | Untrusted Search Path vulnerability in the windows installer of Google Earth Pro versions prior to 7.3.3 allows an attacker to insert malicious local files to… |
CVE-2019-20780 | Critical | 9.8 | 2020-04-17 | An issue was discovered on LG mobile devices with Android OS 7.0, 7.1, 7.2, 8.0, and 8.1 software. Certain security settings, related to whether packages are v… |
CVE-2019-20769 | High | 7.8 | 2020-04-17 | An issue was discovered in LG PC Suite for LG G3 and earlier (aka LG PC Suite v5.3.27 and earlier). DLL Hijacking can occur via a Trojan horse DLL in the curre… |
CVE-2020-10515 | Critical | 9.8 | 2020-04-02 | STARFACE UCC Client before 6.7.1.204 on WIndows allows binary planting to execute code with System rights, aka usd-2020-0006. |
CVE-2020-8146 | High | 7.8 | 2020-04-01 | In UniFi Video v3.10.1 (for Windows 7/8/10 x64) there is a Local Privileges Escalation to SYSTEM from arbitrary file deletion and DLL hijack vulnerabilities. T… |
CVE-2020-3803 | High | 7.8 | 2020-03-25 | Adobe Acrobat and Reader versions 2020.006.20034 and earlier, 2017.011.30158 and earlier, 2017.011.30158 and earlier, 2015.006.30510 and earlier, and 2015.006… |
CVE-2020-10649 | High | 7.8 | 2020-03-25 | DevActSvc.exe in ASUS Device Activation before 1.0.7.0 for Windows 10 notebooks and PCs could lead to unsigned code execution with no additional restrictions w… |
CVE-2020-7474 | High | 7.8 | 2020-03-23 | A CWE-427: Uncontrolled Search Path Element vulnerability exists in ProSoft Configurator (v1.002 and prior), for the PMEPXM0100 (H) module, which could cause t… |
CVE-2020-9290 | High | 7.8 | 2020-03-15 | An Unsafe Search Path vulnerability in FortiClient for Windows online installer 6.2.3 and below may allow a local attacker with control over the directory in w… |
CVE-2020-9287 | High | 7.8 | 2020-03-15 | An Unsafe Search Path vulnerability in FortiClient EMS online installer 6.2.1 and below may allow a local attacker with control over the directory in which For… |
CVE-2020-8469 | High | 7.8 | 2020-03-12 | Trend Micro Password Manager for Windows version 5.0 is affected by a DLL hijacking vulnerability would could potentially allow an attacker privleged escalatio… |
CVE-2020-0565 | High | 7.8 | 2020-03-12 | Uncontrolled search path in Intel(R) Graphics Drivers before version 26.20.100.7158 may allow an authenticated user to potentially enable escalation of privile… |
CVE-2020-0515 | High | 7.8 | 2020-03-12 | Uncontrolled search path element in the installer for Intel(R) Graphics Drivers before versions 26.20.100.7584, 15.45.30.5103, 15.40.44.5107, 15.36.38.5117, an… |
CVE-2020-5324 | High | 7.1 | 2020-02-21 | Dell Client Consumer and Commercial Platforms contain an Arbitrary File Overwrite Vulnerability. The vulnerability is limited to the Dell Firmware Update Utili… |
CVE-2020-8601 | High | 7.8 | 2020-02-20 | Trend Micro Vulnerability Protection 2.0 is affected by a vulnerability that could allow an attack to use the product installer to load other DLL files located… |
CVE-2019-14688 | High | 7.0 | 2020-02-20 | Trend Micro has repackaged installers for several Trend Micro products that were found to utilize a version of an install package that had a DLL hijack vulnera… |
CVE-2020-3153 | Medium | 6.5 | 2020-02-19 | A vulnerability in the installer component of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated local attacker to copy user-supp… |
CVE-2020-8959 | High | 7.8 | 2020-02-19 | Western Digital WesternDigitalSSDDashboardSetup.exe before 3.0.2.0 allows DLL Hijacking. |
CVE-2020-5821 | High | 7.8 | 2020-02-11 | Symantec Endpoint Protection (SEP) and Symantec Endpoint Protection Small Business Edition (SEP SBE), prior to 14.2 RU2 MP1 and prior to 14.2.5569.2100 respect… |
CVE-2019-20406 | High | 7.8 | 2020-02-06 | The usage of Tomcat in Confluence on the Microsoft Windows operating system before version 7.0.5, and from version 7.1.0 before version 7.1.1 allows local syst… |
CVE-2019-20400 | High | 7.8 | 2020-02-06 | The usage of Tomcat in Jira before version 8.5.2 allows local attackers with permission to write a dll file to a directory in the global path environmental var… |
CVE-2019-20358 | High | 7.8 | 2020-01-30 | Trend Micro Anti-Threat Toolkit (ATTK) versions 1.62.0.1218 and below have a vulnerability that may allow an attacker to place malicious files in the same dire… |
CVE-2013-0725 | High | 7.8 | 2020-01-30 | ERDAS ER Viewer 13.0 has dwmapi.dll and irml.dll libraries arbitrary code execution vulnerabilities |
CVE-2020-8315 | Medium | 5.5 | 2020-01-28 | In Python (CPython) 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1, an insecure dependency load upon launch on Windows 7 may result in an attacke… |
CVE-2019-6858 | High | 7.8 | 2020-01-22 | A CWE-427:Uncontrolled Search Path Element vulnerability exists in MSX Configurator (Software Version prior to V1.0.8.1), which could cause privilege escalatio… |
CVE-2019-14600 | Medium | 6.7 | 2020-01-17 | Uncontrolled search path element in the installer for Intel(R) SNMP Subagent Stand-Alone for Windows* may allow an authenticated user to potentially enable esc… |
CVE-2016-6592 | High | 7.8 | 2020-01-14 | A vulnerability was found in Symantec Norton Download Manager versions prior to 5.6. A remote user can create a specially crafted DLL file that, when placed on… |
CVE-2016-5311 | High | 7.8 | 2020-01-09 | A Privilege Escalation vulnerability exists in Symantec Norton Antivirus, Norton AntiVirus with Backup, Norton Security, Norton Security with Backup, Norton In… |
CVE-2019-19954 | High | 7.3 | 2019-12-24 | Signal Desktop before 1.29.1 on Windows allows local users to gain privileges by creating a Trojan horse %SYSTEMDRIVE%\node_modules\.bin\wmic.exe file. |
CVE-2019-5539 | High | 7.8 | 2019-12-23 | VMware Workstation (15.x prior to 15.5.1) and Horizon View Agent (7.10.x prior to 7.10.1 and 7.5.x prior to 7.5.4) contain a DLL hijacking vulnerability due to… |
CVE-2019-19689 | High | 7.8 | 2019-12-18 | Trend Micro HouseCall for Home Networks (versions below 5.3.0.1063) could be exploited via a DLL Hijack related to a vulnerability on the packer that the progr… |
CVE-2019-19235 | High | 7.0 | 2019-12-18 | AsLdrSrv.exe in ASUS ATK Package before V1.0.0061 (for Windows 10 notebook PCs) could lead to unsigned code execution with no additional execution. The user mu… |
CVE-2019-18670 | High | 7.8 | 2019-12-17 | In the Quick Access Service (QAAdminAgent.exe) in Acer Quick Access V2.01.3000 through 2.01.3027 and V3.00.3000 through V3.00.3008, a REGULAR user can load an… |
CVE-2019-3667 | Medium | 6.6 | 2019-12-11 | DLL Search Order Hijacking vulnerability in the Microsoft Windows client in McAfee Tech Check 3.0.0.17 and earlier allows local users to execute arbitrary code… |
CVE-2019-18575 | High | 7.1 | 2019-12-06 | Dell Command Configure versions prior to 4.2.1 contain an uncontrolled search path vulnerability. A locally authenticated malicious user could exploit this vul… |
CVE-2019-19364 | High | 7.8 | 2019-12-04 | A weak malicious user can escalate its privilege whenever CatalystProductionSuite.2019.1.exe (version 1.1.0.21) and CatalystBrowseSuite.2019.1.exe (version 1.1… |
CVE-2019-15638 | High | 7.8 | 2019-12-04 | COPA-DATA zenone32 zenon Editor through 8.10 has an Uncontrolled Search Path Element. |
CVE-2019-3750 | Medium | 5.5 | 2019-12-03 | Dell Command Update versions prior to 3.1 contain an Arbitrary File Deletion Vulnerability. A local authenticated malicious user with low privileges potentiall… |
CVE-2019-3749 | Medium | 5.5 | 2019-12-03 | Dell Command Update versions prior to 3.1 contain an Arbitrary File Deletion Vulnerability. A local authenticated malicious user with low privileges potentiall… |
CVE-2019-7365 | High | 7.8 | 2019-12-03 | DLL preloading vulnerability in Autodesk Desktop Application versions 7.0.16.29 and earlier. An attacker may trick a user into downloading a malicious DLL file… |
CVE-2019-16001 | Medium | 5.3 | 2019-11-26 | A vulnerability in the loading mechanism of specific dynamic link libraries in Cisco Webex Teams for Windows could allow an authenticated, local attacker to pe… |
CVE-2019-18215 | High | 7.8 | 2019-11-18 | An issue was discovered in signmgr.dll 6.5.0.819 in Comodo Internet Security through 12.0. A DLL Preloading vulnerability allows an attacker to implant an unsi… |
CVE-2019-12758 | Medium | 6.7 | 2019-11-15 | Symantec Endpoint Protection, prior to 14.2 RU2, may be susceptible to an unsigned code execution vulnerability, which may allow an individual to execute code… |
CVE-2019-7962 | High | 7.8 | 2019-11-14 | Adobe Illustrator CC versions 23.1 and earlier have an insecure library loading (dll hijacking) vulnerability. Successful exploitation could lead to privilege… |
CVE-2019-7960 | High | 7.8 | 2019-11-14 | Adobe Animate CC versions 19.2.1 and earlier have an insecure library loading (dll hijacking) vulnerability. Successful exploitation could lead to privilege es… |
CVE-2019-5695 | Medium | 6.5 | 2019-11-12 | NVIDIA GeForce Experience (prior to 3.20.1) and Windows GPU Display Driver (all versions) contains a vulnerability in the local service provider component in w… |
CVE-2019-5701 | High | 7.8 | 2019-11-09 | NVIDIA GeForce Experience, all versions prior to 3.20.0.118, contains a vulnerability when GameStream is enabled in which an attacker with local system access… |
CVE-2019-5694 | Medium | 6.5 | 2019-11-09 | NVIDIA Windows GPU Display Driver, R390 driver version, contains a vulnerability in NVIDIA Control Panel in which it incorrectly loads Windows system DLLs with… |
CVE-2019-6692 | High | 7.8 | 2019-10-24 | A malicious DLL preload vulnerability in Fortinet FortiClient for Windows 6.2.0 and below allows a privileged attacker to perform arbitrary code execution via… |
CVE-2019-17093 | High | 7.8 | 2019-10-23 | An issue was discovered in Avast antivirus before 19.8 and AVG antivirus before 19.8. A DLL Preloading vulnerability allows an attacker to implant %WINDIR%\sys… |
CVE-2019-9491 | High | 7.8 | 2019-10-21 | Trend Micro Anti-Threat Toolkit (ATTK) versions 1.62.0.1218 and below have a vulnerability that may allow an attacker to place malicious files in the same dire… |
CVE-2019-17665 | High | 7.8 | 2019-10-16 | NSA Ghidra before 9.0.2 is vulnerable to DLL hijacking because it loads jansi.dll from the current working directory. |
CVE-2019-6333 | Medium | 6.7 | 2019-10-11 | A potential security vulnerability has been identified with certain versions of HP Touchpoint Analytics prior to version 4.1.4.2827. This vulnerability may all… |
CVE-2019-3745 | High | 7.3 | 2019-10-07 | The vulnerability is limited to the installers of Dell Encryption Enterprise versions prior to 10.4.0 and Dell Endpoint Security Suite Enterprise versions prio… |
CVE-2019-16407 | High | 7.3 | 2019-10-02 | JetBrains ReSharper installers for versions before 2019.2 had a DLL Hijacking vulnerability. |
CVE-2019-3726 | Medium | 6.7 | 2019-09-24 | An Uncontrolled Search Path Vulnerability is applicable to the following: Dell Update Package (DUP) Framework file versions prior to 19.1.0.413, and Framework… |
CVE-2019-8076 | High | 7.8 | 2019-09-12 | Adobe application manager installer version 10.0 have an Insecure Library Loading (DLL hijacking) vulnerability. Successful exploitation could lead to Arbitrar… |
CVE-2019-11773 | High | 7.8 | 2019-09-12 | Prior to 0.1, AIX builds of Eclipse OMR contain unused RPATHs which may facilitate code injection and privilege elevation by local users. |
CVE-2019-4447 | High | 7.8 | 2019-08-26 | IBM DB2 High Performance Unload load for LUW 6.1, 6.1.0.1, 6.1.0.1 IF1, 6.1.0.2, 6.1.0.2 IF1, and 6.1.0.1 IF2 db2hpum_debug is a setuid root binary which trust… |
CVE-2019-7364 | High | 7.8 | 2019-08-23 | DLL preloading vulnerability in versions 2017, 2018, 2019, and 2020 of Autodesk Advanced Steel, Civil 3D, AutoCAD, AutoCAD LT, AutoCAD Architecture, AutoCAD El… |
CVE-2019-7362 | High | 7.8 | 2019-08-23 | DLL preloading vulnerability in Autodesk Design Review versions 2011, 2012, 2013, and 2018. An attacker may trick a user into opening a malicious DWF file that… |