CWE-427 · Uncontrolled Search Path Element (page 12)
Page 12 of 13 — CVEs classified under CWE-427, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-14686 | High | 7.8 | 2019-08-21 | A DLL hijacking vulnerability exists in the Trend Micro Security's 2019 consumer family of products (v15) Folder Shield component and the standalone Trend Micr… |
CVE-2019-14687 | High | 7.8 | 2019-08-20 | A DLL hijacking vulnerability exists in Trend Micro Password Manager 5.0 in which, if exploited, would allow an attacker to load an arbitrary unsigned DLL into… |
CVE-2019-14684 | High | 7.8 | 2019-08-20 | A DLL hijacking vulnerability exists in Trend Micro Password Manager 5.0 in which, if exploited, would allow an attacker to load an arbitrary unsigned DLL into… |
CVE-2019-5631 | High | 7.8 | 2019-08-19 | The Rapid7 InsightAppSec broker suffers from a DLL injection vulnerability in the 'prunsrv.exe' component of the product. If exploited, a local user of the sys… |
CVE-2019-8062 | High | 7.8 | 2019-08-14 | Adobe After Effects versions 16 and earlier have an insecure library loading (dll hijacking) vulnerability. Successful exploitation could lead to arbitrary cod… |
CVE-2019-7961 | High | 7.8 | 2019-08-14 | Adobe Prelude CC versions 8.1 and earlier have an insecure library loading (dll hijacking) vulnerability. Successful exploitation could lead to arbitrary code… |
CVE-2019-7931 | High | 7.8 | 2019-08-14 | Adobe Premiere Pro CC versions 13.1.2 and earlier have an insecure library loading (dll hijacking) vulnerability. Successful exploitation could lead to arbitra… |
CVE-2019-7870 | High | 7.8 | 2019-08-14 | Adobe Character Animator versions 2.1 and earlier have an insecure library loading (dll hijacking) vulnerability. Successful exploitation could lead to arbitra… |
CVE-2019-4473 | High | 7.8 | 2019-08-05 | Multiple binaries in IBM SDK, Java Technology Edition 7, 7R, and 8 on the AIX platform use insecure absolute RPATHs, which may facilitate code injection and pr… |
CVE-2019-14242 | Medium | 6.7 | 2019-07-30 | An issue was discovered in Bitdefender products for Windows (Bitdefender Endpoint Security Tool versions prior to 6.6.8.115; and Bitdefender Antivirus Plus, Bi… |
CVE-2019-1010100 | High | 7.8 | 2019-07-19 | Akeo Consulting Rufus 3.0 and earlier is affected by: DLL search order hijacking. The impact is: Arbitrary code execution WITH escalation of privilege. The com… |
CVE-2019-7956 | High | 7.8 | 2019-07-18 | Adobe Dreamweaver direct download installer versions 19.0 and below, 18.0 and below have an Insecure Library Loading (DLL hijacking) vulnerability. Successful… |
CVE-2019-6825 | High | 7.8 | 2019-07-15 | A CWE-427: Uncontrolled Search Path Element vulnerability exists in ProClima (all versions prior to version 8.0.0) which could allow a malicious DLL file, with… |
CVE-2019-5629 | High | 7.8 | 2019-07-13 | Rapid7 Insight Agent, version 2.6.3 and prior, suffers from a local privilege escalation due to an uncontrolled DLL search path. Specifically, when Insight Age… |
CVE-2019-12575 | High | 7.8 | 2019-07-11 | A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v82 for Linux could allow an authenticated, local attacker to run arbitrary… |
CVE-2019-1855 | High | 7.3 | 2019-07-04 | A vulnerability in the loading mechanism of specific dynamic link libraries in Cisco Jabber for Windows could allow an authenticated, local attacker to perform… |
CVE-2019-5443 | High | 7.8 | 2019-07-02 | A non-privileged user or program can put code and a config file in a known non-privileged path (under C:/usr/local/) that will make curl <= 7.65.1 automaticall… |
CVE-2019-12280 | High | 7.8 | 2019-06-25 | PC-Doctor Toolbox before 7.3 has an Uncontrolled Search Path Element. |
CVE-2019-12572 | High | 7.8 | 2019-06-21 | A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client 1.0.2 (build 02363) for Windows could allow an authenticated, local attacker… |
CVE-2019-12133 | High | 7.8 | 2019-06-18 | Multiple Zoho ManageEngine products suffer from local privilege escalation due to improper permissions for the %SYSTEMDRIVE%\ManageEngine directory and its sub… |
CVE-2019-5245 | Medium | 5.3 | 2019-06-13 | HiSuite 9.1.0.300 versions and earlier contains a DLL hijacking vulnerability. This vulnerability exists due to some DLL file is loaded by HiSuite improperly… |
CVE-2019-12177 | High | 7.8 | 2019-06-03 | Privilege escalation due to insecure directory permissions affecting ViveportDesktopService in HTC VIVEPORT before 1.0.0.36 allows local attackers to escalate… |
CVE-2019-7093 | High | 7.8 | 2019-05-24 | Creative Cloud Desktop Application (installer) versions 4.7.0.400 and earlier have an insecure library loading (dll hijacking) vulnerability. Successful exploi… |
CVE-2018-7840 | High | 7.8 | 2019-05-22 | A Uncontrolled Search Path Element (CWE-427) vulnerability exists in VideoXpert OpsCenter versions prior to 3.1 which could allow an attacker to cause the syst… |
CVE-2019-11644 | High | 7.8 | 2019-05-17 | In the F-Secure installer in F-Secure SAFE for Windows before 17.6, F-Secure Internet Security before 17.6, F-Secure Anti-Virus before 17.6, F-Secure Client Se… |
CVE-2019-5526 | High | 7.8 | 2019-05-15 | VMware Workstation (15.x before 15.1.0) contains a DLL hijacking issue because some DLL files are improperly loaded by the application. Successful exploitation… |
CVE-2019-5676 | Medium | 6.7 | 2019-05-10 | NVIDIA Windows GPU Display driver software for Windows (all versions) contains a vulnerability in which it incorrectly loads Windows system DLLs without valida… |
CVE-2019-6564 | High | 7.8 | 2019-05-09 | GE Communicator, all versions prior to 4.0.517, allows a non-administrative user to place malicious files within the installer file directory, which may allow… |
CVE-2019-6546 | High | 7.8 | 2019-05-09 | GE Communicator, all versions prior to 4.0.517, allows an attacker to place malicious files within the working directory of the program, which may allow an att… |
CVE-2019-1794 | Medium | 5.1 | 2019-04-18 | A vulnerability in the search path processing of Cisco Directory Connector could allow an authenticated, local attacker to load a binary of their choosing. The… |
CVE-2019-6534 | High | 7.8 | 2019-04-11 | The uncontrolled search path element vulnerability in Gemalto Sentinel UltraPro Client Library ux32w.dll Versions 1.3.0, 1.3.1, and 1.3.2 enables an attacker t… |
CVE-2015-1014 | High | 7.3 | 2019-03-25 | A successful exploit of these vulnerabilities requires the local user to load a crafted DLL file in the system directory on servers running Schneider Electric… |
CVE-2019-9896 | High | 7.8 | 2019-03-21 | In PuTTY versions before 0.71 on Windows, local attackers could hijack the application by putting a malicious help file in the same directory as the executable. |
CVE-2019-4094 | High | 7.8 | 2019-03-21 | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 binaries load shared libraries from an untrusted path potentially g… |
CVE-2018-1890 | Medium | 5.6 | 2019-03-11 | IBM SDK, Java Technology Edition Version 8 on the AIX platform uses absolute RPATHs which may facilitate code injection and privilege elevation by local users… |
CVE-2019-9634 | High | 7.8 | 2019-03-08 | Go through 1.12 on Windows misuses certain LoadLibrary functionality, leading to DLL injection. |
CVE-2019-9546 | Critical | 9.8 | 2019-03-01 | SolarWinds Orion Platform before 2018.4 Hotfix 2 allows privilege escalation through the RabbitMQ service. |
CVE-2019-9116 | High | 7.8 | 2019-02-25 | DLL hijacking is possible in Sublime Text 3 version 3.1.1 build 3176 on 32-bit Windows platforms because a Trojan horse api-ms-win-core-fibers-l1-1-1.dll or ap… |
CVE-2019-7653 | Critical | 9.8 | 2019-02-09 | The Debian python-rdflib-tools 4.2.2-1 package for RDFLib 4.2.2 has CLI tools that can load Python modules from the current working directory, allowing code in… |
CVE-2018-16177 | High | 7.8 | 2019-01-09 | Untrusted search path vulnerability in The installer of Windows 10 Fall Creators Update Modify module for Security Measures tool allows an attacker to gain pri… |
CVE-2018-20211 | High | 7.8 | 2019-01-02 | ExifTool 8.32 allows local users to gain privileges by creating a %TEMP%\par-%username%\cache-exiftool-8.32 folder with a victim's username, and then copying a… |
CVE-2018-15452 | Medium | 5.5 | 2018-11-13 | A vulnerability in the DLL loading component of Cisco Advanced Malware Protection (AMP) for Endpoints on Windows could allow an authenticated, local attacker t… |
CVE-2018-7799 | High | 7.8 | 2018-11-02 | A DLL hijacking vulnerability exists in Schneider Electric Software Update (SESU), all versions prior to V2.2.0, which could allow an attacker to execute arbit… |
CVE-2018-14812 | High | 7.8 | 2018-10-24 | An uncontrolled search path element (DLL Hijacking) vulnerability has been identified in Fuji Electric Energy Savings Estimator versions V.1.0.2.0 and prior. E… |
CVE-2018-15976 | High | 7.8 | 2018-10-17 | Adobe Technical Communications Suite versions 1.0.5.1 and below have an insecure library loading (dll hijacking) vulnerability. Successful exploitation could l… |
CVE-2018-11072 | High | 7.8 | 2018-10-02 | Dell Digital Delivery versions prior to 3.5.1 contain a DLL Injection Vulnerability. A local authenticated malicious user with advance knowledge of the applica… |
CVE-2018-12163 | Medium | 4.8 | 2018-09-12 | A DLL injection vulnerability in the Intel IoT Developers Kit 4.0 installer may allow an authenticated user to potentially escalate privileges using file modif… |
CVE-2018-12160 | Medium | 5.3 | 2018-09-12 | DLL injection vulnerability in software installer for Intel Data Center Migration Center Software v3.1 and before may allow an authenticated user to potentiall… |
CVE-2018-13806 | High | 7.8 | 2018-09-12 | A vulnerability has been identified in SIEMENS TD Keypad Designer (All versions). A DLL hijacking vulnerability exists in all versions of SIEMENS TD Keypad Des… |
CVE-2018-14797 | High | 7.8 | 2018-08-23 | Emerson DeltaV DCS versions 11.3.1, 12.3.1, 13.3.0, 13.3.1, R5 allow a specially crafted DLL file to be placed in the search path and loaded as an internal and… |
CVE-2018-5238 | High | 7.8 | 2018-08-22 | Norton Power Eraser (prior to 5.3.0.24) and SymDiag (prior to 2.1.242) may be susceptible to a DLL Preloading vulnerability, which is a type of issue that can… |
CVE-2018-5235 | Medium | 6.0 | 2018-08-22 | Norton Utilities (prior to 16.0.3.44) may be susceptible to a DLL Preloading vulnerability, which is a type of issue that can occur when an application looks t… |
CVE-2018-8090 | High | 7.8 | 2018-07-25 | Quick Heal Total Security 64 bit 17.00 (QHTS64.exe), (QHTSFT64.exe) - Version 10.0.1.38; Quick Heal Total Security 32 bit 17.00 (QHTS32.exe), (QHTSFT32.exe) -… |
CVE-2018-12805 | Critical | 9.8 | 2018-07-20 | Adobe Connect versions 9.7.5 and earlier have an Insecure Library Loading vulnerability. Successful exploitation could lead to privilege escalation. |
CVE-2018-11049 | High | 7.3 | 2018-07-11 | RSA Identity Governance and Lifecycle, RSA Via Lifecycle and Governance, and RSA IMG releases have an uncontrolled search vulnerability. The installation scrip… |
CVE-2018-1000622 | High | 7.8 | 2018-07-09 | The Rust Programming Language rustdoc version Between 0.8 and 1.27.0 contains a CWE-427: Uncontrolled Search Path Element vulnerability in rustdoc plugins that… |
CVE-2017-7836 | High | 7.8 | 2018-06-11 | The "pingsender" executable used by the Firefox Health Report dynamically loads a system copy of libcurl, which an attacker could replace. This allows for priv… |
CVE-2018-4938 | High | 7.8 | 2018-05-19 | Adobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have an exploitable Insecure Library Loading vulnerability. Succes… |
CVE-2018-3649 | High | 7.8 | 2018-05-10 | DLL injection vulnerability in the installation executables (Autorun.exe and Setup.exe) for Intel's wireless drivers and related software in Intel Dual Band Wi… |
CVE-2017-5175 | High | 7.8 | 2018-05-09 | Advantech WebAccess 8.1 and earlier contains a DLL hijacking vulnerability which may allow an attacker to run a malicious DLL file within the search path resul… |
CVE-2017-14010 | High | 7.8 | 2018-04-26 | In SpiderControl MicroBrowser Windows XP, Vista 7, 8 and 10, Versions 1.6.30.144 and prior, an uncontrolled search path element vulnerability has been identifi… |
CVE-2018-6766 | High | 7.8 | 2018-03-27 | Swisscom TVMediaHelper 1.1.0.50 contains a vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary code on the targeted system… |
CVE-2018-6765 | High | 7.8 | 2018-03-27 | Swisscom MySwisscomAssistant 2.17.1.1065 contains a vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary code on the targete… |
CVE-2018-5457 | High | 7.0 | 2018-02-06 | A uncontrolled search path element issue was discovered in Vyaire Medical CareFusion Upgrade Utility used with Windows XP systems, Versions 2.0.2.2 and prior v… |
CVE-2017-5170 | High | 7.2 | 2018-01-18 | An Uncontrolled Search Path Element issue was discovered in Moxa SoftNVR-IA Live Viewer, Version 3.30.3122 and prior versions. An uncontrolled search path elem… |
CVE-2017-16777 | High | 7.8 | 2017-11-16 | If HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) 5.0.3 is installed but VMware Fusion is not, a local attacker can create a fake applicati… |
CVE-2017-12314 | High | 7.8 | 2017-11-16 | A vulnerability in the Cisco FindIT Network Discovery Utility could allow an authenticated, local attacker to perform a DLL preloading attack, potentially caus… |
CVE-2017-12313 | Medium | 6.7 | 2017-11-16 | An untrusted search path (aka DLL Preload) vulnerability in the Cisco Network Academy Packet Tracer software could allow an authenticated, local attacker to ex… |
CVE-2017-14020 | High | 7.8 | 2017-11-13 | In AutomationDirect CLICK Programming Software (Part Number C0-PGMSW) Versions 2.10 and prior; C-More Programming Software (Part Number EA9-PGMSW) Versions 6.3… |
CVE-2017-14029 | High | 7.8 | 2017-11-06 | An Uncontrolled Search Path Element issue was discovered in Trihedral VTScada 11.3.03 and prior. The program will execute specially crafted malicious dll files… |
CVE-2017-14017 | High | 7.8 | 2017-10-19 | An Uncontrolled Search Path Element issue was discovered in Progea Movicon Version 11.5.1181 and prior. An uncontrolled search path element vulnerability has b… |
CVE-2017-12579 | High | 7.8 | 2017-10-19 | An insecure suid wrapper binary in the HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) 4.0.24 and earlier allows a non-root user to obtain a… |
CVE-2017-12266 | Medium | 4.2 | 2017-10-05 | A vulnerability in the routine that loads DLL files in Cisco Meeting App for Windows could allow an authenticated, local attacker to run an executable file wit… |
CVE-2017-13993 | High | 7.8 | 2017-10-05 | An Uncontrolled Search Path or Element issue was discovered in i-SENS SmartLog Diabetes Management Software, Version 2.4.0 and prior versions. An uncontrolled… |
CVE-2017-5147 | Medium | 5.3 | 2017-09-09 | An Uncontrolled Search Path Element issue was discovered in AzeoTech DAQFactory versions prior to 17.1. An uncontrolled search path element vulnerability has b… |
CVE-2017-11158 | High | 7.8 | 2017-08-31 | Multiple untrusted search path vulnerabilities in the installer in Synology Cloud Station Drive before 4.2.5-4396 on Windows allow local attackers to execute a… |
CVE-2017-12717 | High | 7.8 | 2017-08-30 | An Uncontrolled Search Path Element issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. A maliciously crafted dll file placed earlier… |
CVE-2014-8393 | High | 7.8 | 2017-08-29 | DLL Hijacking vulnerability in CorelDRAW X7, Corel Photo-Paint X7, Corel PaintShop Pro X7, Corel Painter 2015, and Corel PDF Fusion. |
CVE-2017-11159 | High | 7.8 | 2017-08-23 | Multiple untrusted search path vulnerabilities in installer in Synology Photo Station Uploader before 1.4.2-084 on Windows allows local attackers to execute ar… |
CVE-2017-13130 | High | 7.8 | 2017-08-23 | mcmnm in BMC Patrol allows local users to gain privileges via a crafted libmcmclnx.so file in the current working directory, because it is setuid root and the… |
CVE-2017-6329 | High | 7.8 | 2017-08-21 | Symantec VIP Access for Desktop prior to 2.2.4 can be susceptible to a DLL Pre-Loading vulnerability. These types of issues occur when an application looks to… |
CVE-2017-9661 | High | 7.0 | 2017-08-14 | An Uncontrolled Search Path Element issue was discovered in SIMPlight SCADA Software version 4.3.0.27 and prior. The uncontrolled search path element vulnerabi… |
CVE-2017-9648 | High | 7.8 | 2017-08-14 | An Uncontrolled Search Path Element issue was discovered in Solar Controls WATTConfig M Software Version 2.5.10.1 and prior. An uncontrolled search path elemen… |
CVE-2017-9646 | High | 7.8 | 2017-08-14 | An Uncontrolled Search Path Element issue was discovered in Solar Controls Heating Control Downloader (HCDownloader) Version 1.0.1.15 and prior. An uncontrolle… |
CVE-2017-12653 | High | 7.8 | 2017-08-07 | 360 Total Security 9.0.0.1202 before 2017-07-07 allows Privilege Escalation via a Trojan horse Shcore.dll file in any directory in the PATH, as demonstrated by… |
CVE-2017-2288 | High | 7.8 | 2017-08-02 | Untrusted search path vulnerability in LhaForge Ver.1.6.5 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory. |
CVE-2017-2287 | High | 7.8 | 2017-08-02 | Untrusted search path vulnerability in NFC Port Software remover Ver.1.3.0.1 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an uns… |
CVE-2017-2286 | High | 7.8 | 2017-08-02 | Untrusted search path vulnerability in NFC Port Software Version 5.5.0.6 and earlier (for RC-S310, RC-S320, RC-S330, RC-S370, RC-S380, RC-S380/S), NFC Port Sof… |
CVE-2017-1000010 | High | 7.8 | 2017-07-17 | Audacity 2.1.2 through 2.3.2 is vulnerable to Dll HIjacking in the avformat-55.dll resulting arbitrary code execution. |
CVE-2017-3097 | Critical | 9.8 | 2017-06-20 | Adobe Digital Editions versions 4.5.4 and earlier contain an insecure library loading vulnerability. The vulnerability is due to unsafe library loading functio… |
CVE-2017-3092 | Critical | 9.8 | 2017-06-20 | Adobe Digital Editions versions 4.5.4 and earlier contain an insecure library loading vulnerability. The vulnerability is due to unsafe library loading of edit… |
CVE-2017-3090 | Critical | 9.8 | 2017-06-20 | Adobe Digital Editions versions 4.5.4 and earlier contain an insecure library loading vulnerability. The vulnerability is due to unsafe library loading of brow… |
CVE-2017-4987 | High | 7.3 | 2017-06-19 | In EMC VNX2 versions prior to OE for File 8.1.9.211 and VNX1 versions prior to OE for File 7.1.80.8, a local authenticated user can load a maliciously crafted… |
CVE-2017-7884 | High | 8.4 | 2017-06-16 | In Adam Kropelin adk0212 APC UPS Daemon through 3.14.14, the default installation of APCUPSD allows a local authenticated, but unprivileged, user to run arbitr… |
CVE-2017-2210 | High | 7.8 | 2017-06-09 | Untrusted search path vulnerability in PatchJGD (PatchJGD101.EXE) ver. 1.0.1 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified dir… |
CVE-2017-7966 | High | 8.8 | 2017-06-07 | A DLL Hijacking vulnerability in the programming software in Schneider Electric's SoMachine HVAC v2.1.0 allows a remote attacker to execute arbitrary code on t… |
CVE-2017-5176 | High | 7.0 | 2017-05-19 | A DLL Hijack issue was discovered in Rockwell Automation Connected Components Workbench (CCW). The following versions are affected: Connected Components Workbe… |
CVE-2017-6051 | High | 7.0 | 2017-05-08 | An Uncontrolled Search Path Element issue was discovered in BLF-Tech LLC VisualView HMI Version 9.9.14.0 and prior. The uncontrolled search path element vulner… |
CVE-2017-3013 | High | 7.8 | 2017-04-12 | Adobe Acrobat Reader versions 11.0.19 and earlier, 15.006.30280 and earlier, 15.023.20070 and earlier have an insecure library loading (DLL hijacking) vulnerab… |
CVE-2017-3012 | High | 7.8 | 2017-04-12 | Adobe Acrobat Reader versions 11.0.19 and earlier, 15.006.30280 and earlier, 15.023.20070 and earlier have an insecure library loading (DLL hijacking) vulnerab… |