CWE-427 · Uncontrolled Search Path Element (page 11)
Page 11 of 13 — CVEs classified under CWE-427, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2020-27955 | Critical | 9.8 | 2020-11-05 | Git LFS 2.12.0 allows Remote Code Execution. |
CVE-2020-27708 | High | 7.8 | 2020-11-02 | A vulnerability exists in the Origin Client that could allow a non-Administrative user to elevate their access to either Administrator or System. Once the user… |
CVE-2020-5145 | High | 8.6 | 2020-10-28 | SonicWall Global VPN client version 4.10.4.0314 and earlier have an insecure library loading (DLL hijacking) vulnerability. Successful exploitation could lead… |
CVE-2020-24425 | High | 7.5 | 2020-10-21 | Dreamweaver version 20.2 (and earlier) is affected by an uncontrolled search path element vulnerability that could lead to privilege escalation. Successful exp… |
CVE-2020-24424 | High | 7.0 | 2020-10-21 | Adobe Premiere Pro version 14.4 (and earlier) is affected by an uncontrolled search path element that could result in arbitrary code execution in the context o… |
CVE-2020-24423 | High | 7.0 | 2020-10-21 | Adobe Media Encoder version 14.4 (and earlier) for Windows is affected by an uncontrolled search path vulnerability that could result in arbitrary code executi… |
CVE-2020-24420 | High | 7.0 | 2020-10-21 | Adobe Photoshop for Windows version 21.2.1 (and earlier) is affected by an uncontrolled search path element vulnerability that could result in arbitrary code e… |
CVE-2020-24419 | High | 7.0 | 2020-10-21 | Adobe After Effects version 17.1.1 (and earlier) for Windows is affected by an uncontrolled search path vulnerability that could result in arbitrary code execu… |
CVE-2020-24422 | High | 7.0 | 2020-10-21 | Adobe Creative Cloud Desktop Application version 5.2 (and earlier) and 2.1 (and earlier) for Windows is affected by an uncontrolled search path vulnerability t… |
CVE-2020-8345 | High | 7.3 | 2020-10-14 | A DLL search path vulnerability was reported in the Lenovo HardwareScan Plugin for the Lenovo Vantage hardware scan feature prior to version 1.0.46.11 that cou… |
CVE-2020-26947 | High | 7.8 | 2020-10-10 | monero-wallet-gui in Monero GUI before 0.17.1.0 includes the . directory in an embedded RPATH (with a preference ahead of /usr/lib), which allows local users t… |
CVE-2019-19115 | High | 7.8 | 2020-10-08 | An escalation of privilege vulnerability in Nahimic APO Software Component Driver 1.4.2, 1.5.0, 1.5.1, 1.6.1 and 1.6.2 allows an attacker to execute code with… |
CVE-2020-26894 | High | 7.8 | 2020-10-08 | LiveCode v9.6.1 on Windows allows local, low-privileged users to gain privileges by creating a malicious "cmd.exe" in the folder of the vulnerable LiveCode app… |
CVE-2020-3535 | High | 7.8 | 2020-10-08 | A vulnerability in the loading mechanism of specific DLLs in the Cisco Webex Teams client for Windows could allow an authenticated, local attacker to load a ma… |
CVE-2020-24356 | Medium | 6.4 | 2020-10-02 | `cloudflared` versions prior to 2020.8.1 contain a local privilege escalation vulnerability on Windows systems. When run on a Windows system, `cloudflared` sea… |
CVE-2020-26538 | High | 7.8 | 2020-10-02 | An issue was discovered in Foxit Reader and PhantomPDF before 10.1. It allows attackers to execute arbitrary code via a Trojan horse taskkill.exe in the curren… |
CVE-2020-15663 | High | 8.8 | 2020-10-01 | If Firefox is installed to a user-writable directory, the Mozilla Maintenance Service would execute updater.exe from the install location with system privilege… |
CVE-2020-6654 | High | 7.8 | 2020-09-30 | A DLL Hijacking vulnerability in Eaton's 9000x Programming and Configuration Software v 2.0.38 and prior allows an attacker to execute arbitrary code by replac… |
CVE-2020-3979 | High | 7.8 | 2020-09-18 | InstallBuilder for Qt Windows (versions prior to 20.7.0) installers look for plugins at a predictable location at initialization time, writable by non-admin us… |
CVE-2020-7358 | Medium | 5.8 | 2020-09-18 | In AppSpider installer versions prior to 7.2.126, the AppSpider installer calls an executable which can be placed in the appropriate directory by an attacker w… |
CVE-2020-7312 | High | 7.8 | 2020-09-10 | DLL Search Order Hijacking Vulnerability in the installer in McAfee Agent (MA) for Windows prior to 5.6.6 allows local users to execute arbitrary code and esca… |
CVE-2019-3881 | High | 7.8 | 2020-09-04 | Bundler prior to 2.1.0 uses a predictable path in /tmp/, created with insecure permissions as a storage location for gems, if locations under the user's home d… |
CVE-2020-24162 | High | 7.8 | 2020-09-03 | The Shenzhen Tencent app 5.8.2.5300 for PC platforms (from Tencent App Center) has a DLL hijacking vulnerability. Attackers can use this vulnerability to execu… |
CVE-2020-24161 | High | 7.8 | 2020-09-03 | Guangzhou NetEase Mail Master 4.14.1.1004 on Windows has a DLL hijacking vulnerability. Attackers can use this vulnerability to execute malicious code. |
CVE-2020-24160 | High | 7.8 | 2020-09-03 | Shenzhen Tencent TIM Windows client 3.0.0.21315 has a DLL hijacking vulnerability, which can be exploited by attackers to execute malicious code. |
CVE-2020-24159 | High | 7.8 | 2020-09-03 | NetEase Youdao Dictionary has a DLL hijacking vulnerability, which can be exploited by attackers to gain server permissions. This affects Guangzhou NetEase You… |
CVE-2020-24158 | High | 7.8 | 2020-09-03 | 360 Speed Browser 12.0.1247.0 has a DLL hijacking vulnerability, which can be exploited by attackers to execute malicious code. It is a dual-core browser owned… |
CVE-2020-25045 | High | 7.8 | 2020-09-02 | Installers of Kaspersky Security Center and Kaspersky Security Center Web Console prior to 12 & prior to 12 Patch A were vulnerable to a DLL hijacking attack t… |
CVE-2020-15167 | High | 8.2 | 2020-09-02 | In Miller (command line utility) using the configuration file support introduced in version 5.9.0, it is possible for an attacker to cause Miller to run arbitr… |
CVE-2020-5419 | Medium | 6.7 | 2020-08-31 | RabbitMQ versions 3.8.x prior to 3.8.7 are prone to a Windows-specific binary planting security vulnerability that allows for arbitrary code execution. An atta… |
CVE-2020-14349 | High | 7.1 | 2020-08-24 | It was found that PostgreSQL versions before 12.4, before 11.9 and before 10.14 did not properly sanitize the search_path during logical replication. An authen… |
CVE-2020-9724 | High | 7.8 | 2020-08-19 | Adobe Lightroom versions 9.2.0.10 and earlier have an insecure library loading vulnerability. Successful exploitation could lead to privilege escalation. |
CVE-2020-3433 | High | 7.8 | 2020-08-17 | A vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local atta… |
CVE-2020-9767 | High | 7.8 | 2020-08-14 | A vulnerability related to Dynamic-link Library (“DLL”) loading in the Zoom Sharing Service would allow an attacker who had local access to a machine on which… |
CVE-2020-7360 | High | 7.4 | 2020-08-13 | An Uncontrolled Search Path Element (CWE-427) vulnerability in SmartControl version 4.3.15 and versions released before April 15, 2020 may allow an authenticat… |
CVE-2020-8687 | High | 7.8 | 2020-08-13 | Uncontrolled search path in the installer for Intel(R) RSTe Software RAID Driver for the Intel(R) Server Board M10JNP2SB before version 4.7.0.1119 may allow an… |
CVE-2020-15596 | Medium | 6.7 | 2020-08-12 | The ALPS ALPINE touchpad driver before 8.2206.1717.634, as used on various Dell, HP, and Lenovo laptops, allows attackers to conduct Path Disclosure attacks vi… |
CVE-2020-13177 | High | 7.8 | 2020-08-11 | The support bundler in Teradici PCoIP Standard Agent for Windows and Graphics Agent for Windows versions prior to 20.04.1 and 20.07.0 does not use hard coded p… |
CVE-2020-15657 | High | 7.8 | 2020-08-10 | Firefox could be made to load attacker-supplied DLL files from the installation directory. This required an attacker that is already capable of placing files i… |
CVE-2020-16143 | High | 7.8 | 2020-07-29 | The seafile-client client 7.0.8 for Seafile is vulnerable to DLL hijacking because it loads exchndl.dll from the current working directory. |
CVE-2020-10610 | High | 7.8 | 2020-07-24 | In OSIsoft PI System multiple products and versions, a local attacker can modify a search path and plant a binary to exploit the affected PI System software to… |
CVE-2020-15724 | High | 7.8 | 2020-07-21 | In the version 12.1.0.1005 and below of 360 Total Security, when the Gamefolde calls GameChrome.exe, there exists a local privilege escalation vulnerability. A… |
CVE-2020-15723 | High | 7.8 | 2020-07-21 | In the version 12.1.0.1004 and below of 360 Total Security, when the main process of 360 Total Security calls GameChrome.exe, there exists a local privilege es… |
CVE-2020-15722 | High | 7.8 | 2020-07-21 | In version 12.1.0.1004 and below of 360 Total Security,when TPI calls the browser process, there exists a local privilege escalation vulnerability. An attacker… |
CVE-2020-12423 | High | 7.8 | 2020-07-09 | When the Windows DLL "webauthn.dll" was missing from the Operating System, and a malicious one was placed in a folder in the user's %PATH%, Firefox may have lo… |
CVE-2020-9100 | High | 7.8 | 2020-07-06 | Earlier than HiSuite 10.1.0.500 have a DLL hijacking vulnerability. This vulnerability exists due to some DLL file is loaded by HiSuite improperly. And it allo… |
CVE-2020-15523 | High | 7.8 | 2020-07-04 | In Python 3.6 through 3.6.10, 3.7 through 3.7.8, 3.8 through 3.8.4rc1, and 3.9 through 3.9.0b4 on Windows, a Trojan horse python3.dll might be used in cases wh… |
CVE-2019-20419 | High | 7.8 | 2020-07-03 | Affected versions of Atlassian Jira Server and Data Center allow remote attackers to execute arbitrary code via a DLL hijacking vulnerability in Tomcat. The af… |
CVE-2020-13279 | High | 8.6 | 2020-06-22 | Client side code execution in gitlab-vscode-extension v2.2.0 allows attacker to execute code on user system |
CVE-2019-20856 | Critical | 9.8 | 2020-06-19 | An issue was discovered in Mattermost Desktop App before 4.3.0 on macOS. It allows dylib injection. |
CVE-2020-11613 | High | 7.8 | 2020-06-11 | Mids' Reborn Hero Designer 2.6.0.7 has an elevation of privilege vulnerability due to default and insecure permissions being set for the installation folder. B… |
CVE-2020-7585 | High | 7.8 | 2020-06-10 | A vulnerability has been identified in SIMATIC PCS 7 V8.2 and earlier (All versions), SIMATIC PCS 7 V9.0 (All versions < V9.0 SP3), SIMATIC PDM (All versions <… |
CVE-2019-3613 | Medium | 5.9 | 2020-06-10 | DLL Search Order Hijacking vulnerability in McAfee Agent (MA) prior to 5.6.4 allows attackers with local access to execute arbitrary code via execution from a… |
CVE-2020-9858 | High | 7.8 | 2020-06-09 | A dynamic library loading issue was addressed with improved path searching. This issue is fixed in Windows Migration Assistant 2.2.0.0 (v. 1A11). Running the i… |
CVE-2020-5357 | High | 7.1 | 2020-05-28 | Dell Dock Firmware Update Utilities for Dell Client Consumer and Commercial docking stations contain an Arbitrary File Overwrite vulnerability. The vulnerabili… |
CVE-2020-13110 | High | 7.8 | 2020-05-16 | The kerberos package before 1.0.0 for Node.js allows arbitrary code execution and privilege escalation via injection of malicious DLLs through use of the kerbe… |
CVE-2020-10616 | High | 8.8 | 2020-05-14 | Opto 22 SoftPAC Project Version 9.6 and prior. SoftPAC does not specify the path of multiple imported .dll files. Therefore, an attacker can replace them and e… |
CVE-2020-10626 | High | 7.8 | 2020-05-14 | In Fazecast jSerialComm, Version 2.2.2 and prior, an uncontrolled search path element vulnerability could allow a malicious DLL file with the same name of any… |
CVE-2020-6244 | High | 7.8 | 2020-05-12 | SAP Business Client, version 7.0, allows an attacker after a successful social engineering attack to inject malicious code as a DLL file in untrusted directori… |
CVE-2019-20781 | High | 7.8 | 2020-04-29 | An issue was discovered in LG Bridge before April 2019 on Windows. DLL Hijacking can occur. |
CVE-2020-5740 | High | 7.8 | 2020-04-22 | Improper Input Validation in Plex Media Server on Windows allows a local, unauthenticated attacker to execute arbitrary Python code with SYSTEM privileges. |
CVE-2020-8895 | High | 7.8 | 2020-04-21 | Untrusted Search Path vulnerability in the windows installer of Google Earth Pro versions prior to 7.3.3 allows an attacker to insert malicious local files to… |
CVE-2019-20780 | Critical | 9.8 | 2020-04-17 | An issue was discovered on LG mobile devices with Android OS 7.0, 7.1, 7.2, 8.0, and 8.1 software. Certain security settings, related to whether packages are v… |
CVE-2019-20769 | High | 7.8 | 2020-04-17 | An issue was discovered in LG PC Suite for LG G3 and earlier (aka LG PC Suite v5.3.27 and earlier). DLL Hijacking can occur via a Trojan horse DLL in the curre… |
CVE-2020-10515 | Critical | 9.8 | 2020-04-02 | STARFACE UCC Client before 6.7.1.204 on WIndows allows binary planting to execute code with System rights, aka usd-2020-0006. |
CVE-2020-8146 | High | 7.8 | 2020-04-01 | In UniFi Video v3.10.1 (for Windows 7/8/10 x64) there is a Local Privileges Escalation to SYSTEM from arbitrary file deletion and DLL hijack vulnerabilities. T… |
CVE-2020-3803 | High | 7.8 | 2020-03-25 | Adobe Acrobat and Reader versions 2020.006.20034 and earlier, 2017.011.30158 and earlier, 2017.011.30158 and earlier, 2015.006.30510 and earlier, and 2015.006… |
CVE-2020-10649 | High | 7.8 | 2020-03-25 | DevActSvc.exe in ASUS Device Activation before 1.0.7.0 for Windows 10 notebooks and PCs could lead to unsigned code execution with no additional restrictions w… |
CVE-2020-7474 | High | 7.8 | 2020-03-23 | A CWE-427: Uncontrolled Search Path Element vulnerability exists in ProSoft Configurator (v1.002 and prior), for the PMEPXM0100 (H) module, which could cause t… |
CVE-2020-9290 | High | 7.8 | 2020-03-15 | An Unsafe Search Path vulnerability in FortiClient for Windows online installer 6.2.3 and below may allow a local attacker with control over the directory in w… |
CVE-2020-9287 | High | 7.8 | 2020-03-15 | An Unsafe Search Path vulnerability in FortiClient EMS online installer 6.2.1 and below may allow a local attacker with control over the directory in which For… |
CVE-2020-8469 | High | 7.8 | 2020-03-12 | Trend Micro Password Manager for Windows version 5.0 is affected by a DLL hijacking vulnerability would could potentially allow an attacker privleged escalatio… |
CVE-2020-0565 | High | 7.8 | 2020-03-12 | Uncontrolled search path in Intel(R) Graphics Drivers before version 26.20.100.7158 may allow an authenticated user to potentially enable escalation of privile… |
CVE-2020-0515 | High | 7.8 | 2020-03-12 | Uncontrolled search path element in the installer for Intel(R) Graphics Drivers before versions 26.20.100.7584, 15.45.30.5103, 15.40.44.5107, 15.36.38.5117, an… |
CVE-2020-5324 | High | 7.1 | 2020-02-21 | Dell Client Consumer and Commercial Platforms contain an Arbitrary File Overwrite Vulnerability. The vulnerability is limited to the Dell Firmware Update Utili… |
CVE-2020-8601 | High | 7.8 | 2020-02-20 | Trend Micro Vulnerability Protection 2.0 is affected by a vulnerability that could allow an attack to use the product installer to load other DLL files located… |
CVE-2019-14688 | High | 7.0 | 2020-02-20 | Trend Micro has repackaged installers for several Trend Micro products that were found to utilize a version of an install package that had a DLL hijack vulnera… |
CVE-2020-3153 | Medium | 6.5 | 2020-02-19 | A vulnerability in the installer component of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated local attacker to copy user-supp… |
CVE-2020-8959 | High | 7.8 | 2020-02-19 | Western Digital WesternDigitalSSDDashboardSetup.exe before 3.0.2.0 allows DLL Hijacking. |
CVE-2020-5821 | High | 7.8 | 2020-02-11 | Symantec Endpoint Protection (SEP) and Symantec Endpoint Protection Small Business Edition (SEP SBE), prior to 14.2 RU2 MP1 and prior to 14.2.5569.2100 respect… |
CVE-2019-20406 | High | 7.8 | 2020-02-06 | The usage of Tomcat in Confluence on the Microsoft Windows operating system before version 7.0.5, and from version 7.1.0 before version 7.1.1 allows local syst… |
CVE-2019-20400 | High | 7.8 | 2020-02-06 | The usage of Tomcat in Jira before version 8.5.2 allows local attackers with permission to write a dll file to a directory in the global path environmental var… |
CVE-2019-20358 | High | 7.8 | 2020-01-30 | Trend Micro Anti-Threat Toolkit (ATTK) versions 1.62.0.1218 and below have a vulnerability that may allow an attacker to place malicious files in the same dire… |
CVE-2013-0725 | High | 7.8 | 2020-01-30 | ERDAS ER Viewer 13.0 has dwmapi.dll and irml.dll libraries arbitrary code execution vulnerabilities |
CVE-2020-8315 | Medium | 5.5 | 2020-01-28 | In Python (CPython) 3.6 through 3.6.10, 3.7 through 3.7.6, and 3.8 through 3.8.1, an insecure dependency load upon launch on Windows 7 may result in an attacke… |
CVE-2019-6858 | High | 7.8 | 2020-01-22 | A CWE-427:Uncontrolled Search Path Element vulnerability exists in MSX Configurator (Software Version prior to V1.0.8.1), which could cause privilege escalatio… |
CVE-2019-14600 | Medium | 6.7 | 2020-01-17 | Uncontrolled search path element in the installer for Intel(R) SNMP Subagent Stand-Alone for Windows* may allow an authenticated user to potentially enable esc… |
CVE-2016-6592 | High | 7.8 | 2020-01-14 | A vulnerability was found in Symantec Norton Download Manager versions prior to 5.6. A remote user can create a specially crafted DLL file that, when placed on… |
CVE-2016-5311 | High | 7.8 | 2020-01-09 | A Privilege Escalation vulnerability exists in Symantec Norton Antivirus, Norton AntiVirus with Backup, Norton Security, Norton Security with Backup, Norton In… |
CVE-2019-19954 | High | 7.3 | 2019-12-24 | Signal Desktop before 1.29.1 on Windows allows local users to gain privileges by creating a Trojan horse %SYSTEMDRIVE%\node_modules\.bin\wmic.exe file. |
CVE-2019-5539 | High | 7.8 | 2019-12-23 | VMware Workstation (15.x prior to 15.5.1) and Horizon View Agent (7.10.x prior to 7.10.1 and 7.5.x prior to 7.5.4) contain a DLL hijacking vulnerability due to… |
CVE-2019-19689 | High | 7.8 | 2019-12-18 | Trend Micro HouseCall for Home Networks (versions below 5.3.0.1063) could be exploited via a DLL Hijack related to a vulnerability on the packer that the progr… |
CVE-2019-19235 | High | 7.0 | 2019-12-18 | AsLdrSrv.exe in ASUS ATK Package before V1.0.0061 (for Windows 10 notebook PCs) could lead to unsigned code execution with no additional execution. The user mu… |
CVE-2019-18670 | High | 7.8 | 2019-12-17 | In the Quick Access Service (QAAdminAgent.exe) in Acer Quick Access V2.01.3000 through 2.01.3027 and V3.00.3000 through V3.00.3008, a REGULAR user can load an… |
CVE-2019-3667 | Medium | 6.6 | 2019-12-11 | DLL Search Order Hijacking vulnerability in the Microsoft Windows client in McAfee Tech Check 3.0.0.17 and earlier allows local users to execute arbitrary code… |
CVE-2019-18575 | High | 7.1 | 2019-12-06 | Dell Command Configure versions prior to 4.2.1 contain an uncontrolled search path vulnerability. A locally authenticated malicious user could exploit this vul… |
CVE-2019-19364 | High | 7.8 | 2019-12-04 | A weak malicious user can escalate its privilege whenever CatalystProductionSuite.2019.1.exe (version 1.1.0.21) and CatalystBrowseSuite.2019.1.exe (version 1.1… |
CVE-2019-15638 | High | 7.8 | 2019-12-04 | COPA-DATA zenone32 zenon Editor through 8.10 has an Uncontrolled Search Path Element. |
CVE-2019-3750 | Medium | 5.5 | 2019-12-03 | Dell Command Update versions prior to 3.1 contain an Arbitrary File Deletion Vulnerability. A local authenticated malicious user with low privileges potentiall… |
CVE-2019-3749 | Medium | 5.5 | 2019-12-03 | Dell Command Update versions prior to 3.1 contain an Arbitrary File Deletion Vulnerability. A local authenticated malicious user with low privileges potentiall… |