CWE-427 · Uncontrolled Search Path Element (page 12)
Page 12 of 13 — CVEs classified under CWE-427, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2019-7365 | High | 7.8 | 2019-12-03 | DLL preloading vulnerability in Autodesk Desktop Application versions 7.0.16.29 and earlier. An attacker may trick a user into downloading a malicious DLL file… |
CVE-2019-16001 | Medium | 5.3 | 2019-11-26 | A vulnerability in the loading mechanism of specific dynamic link libraries in Cisco Webex Teams for Windows could allow an authenticated, local attacker to pe… |
CVE-2019-18215 | High | 7.8 | 2019-11-18 | An issue was discovered in signmgr.dll 6.5.0.819 in Comodo Internet Security through 12.0. A DLL Preloading vulnerability allows an attacker to implant an unsi… |
CVE-2019-12758 | Medium | 6.7 | 2019-11-15 | Symantec Endpoint Protection, prior to 14.2 RU2, may be susceptible to an unsigned code execution vulnerability, which may allow an individual to execute code… |
CVE-2019-7962 | High | 7.8 | 2019-11-14 | Adobe Illustrator CC versions 23.1 and earlier have an insecure library loading (dll hijacking) vulnerability. Successful exploitation could lead to privilege… |
CVE-2019-7960 | High | 7.8 | 2019-11-14 | Adobe Animate CC versions 19.2.1 and earlier have an insecure library loading (dll hijacking) vulnerability. Successful exploitation could lead to privilege es… |
CVE-2019-5695 | Medium | 6.5 | 2019-11-12 | NVIDIA GeForce Experience (prior to 3.20.1) and Windows GPU Display Driver (all versions) contains a vulnerability in the local service provider component in w… |
CVE-2019-5701 | High | 7.8 | 2019-11-09 | NVIDIA GeForce Experience, all versions prior to 3.20.0.118, contains a vulnerability when GameStream is enabled in which an attacker with local system access… |
CVE-2019-5694 | Medium | 6.5 | 2019-11-09 | NVIDIA Windows GPU Display Driver, R390 driver version, contains a vulnerability in NVIDIA Control Panel in which it incorrectly loads Windows system DLLs with… |
CVE-2019-6692 | High | 7.8 | 2019-10-24 | A malicious DLL preload vulnerability in Fortinet FortiClient for Windows 6.2.0 and below allows a privileged attacker to perform arbitrary code execution via… |
CVE-2019-17093 | High | 7.8 | 2019-10-23 | An issue was discovered in Avast antivirus before 19.8 and AVG antivirus before 19.8. A DLL Preloading vulnerability allows an attacker to implant %WINDIR%\sys… |
CVE-2019-9491 | High | 7.8 | 2019-10-21 | Trend Micro Anti-Threat Toolkit (ATTK) versions 1.62.0.1218 and below have a vulnerability that may allow an attacker to place malicious files in the same dire… |
CVE-2019-17665 | High | 7.8 | 2019-10-16 | NSA Ghidra before 9.0.2 is vulnerable to DLL hijacking because it loads jansi.dll from the current working directory. |
CVE-2019-6333 | Medium | 6.7 | 2019-10-11 | A potential security vulnerability has been identified with certain versions of HP Touchpoint Analytics prior to version 4.1.4.2827. This vulnerability may all… |
CVE-2019-3745 | High | 7.3 | 2019-10-07 | The vulnerability is limited to the installers of Dell Encryption Enterprise versions prior to 10.4.0 and Dell Endpoint Security Suite Enterprise versions prio… |
CVE-2019-16407 | High | 7.3 | 2019-10-02 | JetBrains ReSharper installers for versions before 2019.2 had a DLL Hijacking vulnerability. |
CVE-2019-3726 | Medium | 6.7 | 2019-09-24 | An Uncontrolled Search Path Vulnerability is applicable to the following: Dell Update Package (DUP) Framework file versions prior to 19.1.0.413, and Framework… |
CVE-2019-8076 | High | 7.8 | 2019-09-12 | Adobe application manager installer version 10.0 have an Insecure Library Loading (DLL hijacking) vulnerability. Successful exploitation could lead to Arbitrar… |
CVE-2019-11773 | High | 7.8 | 2019-09-12 | Prior to 0.1, AIX builds of Eclipse OMR contain unused RPATHs which may facilitate code injection and privilege elevation by local users. |
CVE-2019-4447 | High | 7.8 | 2019-08-26 | IBM DB2 High Performance Unload load for LUW 6.1, 6.1.0.1, 6.1.0.1 IF1, 6.1.0.2, 6.1.0.2 IF1, and 6.1.0.1 IF2 db2hpum_debug is a setuid root binary which trust… |
CVE-2019-7364 | High | 7.8 | 2019-08-23 | DLL preloading vulnerability in versions 2017, 2018, 2019, and 2020 of Autodesk Advanced Steel, Civil 3D, AutoCAD, AutoCAD LT, AutoCAD Architecture, AutoCAD El… |
CVE-2019-7362 | High | 7.8 | 2019-08-23 | DLL preloading vulnerability in Autodesk Design Review versions 2011, 2012, 2013, and 2018. An attacker may trick a user into opening a malicious DWF file that… |
CVE-2019-14686 | High | 7.8 | 2019-08-21 | A DLL hijacking vulnerability exists in the Trend Micro Security's 2019 consumer family of products (v15) Folder Shield component and the standalone Trend Micr… |
CVE-2019-14687 | High | 7.8 | 2019-08-20 | A DLL hijacking vulnerability exists in Trend Micro Password Manager 5.0 in which, if exploited, would allow an attacker to load an arbitrary unsigned DLL into… |
CVE-2019-14684 | High | 7.8 | 2019-08-20 | A DLL hijacking vulnerability exists in Trend Micro Password Manager 5.0 in which, if exploited, would allow an attacker to load an arbitrary unsigned DLL into… |
CVE-2019-5631 | High | 7.8 | 2019-08-19 | The Rapid7 InsightAppSec broker suffers from a DLL injection vulnerability in the 'prunsrv.exe' component of the product. If exploited, a local user of the sys… |
CVE-2019-8062 | High | 7.8 | 2019-08-14 | Adobe After Effects versions 16 and earlier have an insecure library loading (dll hijacking) vulnerability. Successful exploitation could lead to arbitrary cod… |
CVE-2019-7961 | High | 7.8 | 2019-08-14 | Adobe Prelude CC versions 8.1 and earlier have an insecure library loading (dll hijacking) vulnerability. Successful exploitation could lead to arbitrary code… |
CVE-2019-7931 | High | 7.8 | 2019-08-14 | Adobe Premiere Pro CC versions 13.1.2 and earlier have an insecure library loading (dll hijacking) vulnerability. Successful exploitation could lead to arbitra… |
CVE-2019-7870 | High | 7.8 | 2019-08-14 | Adobe Character Animator versions 2.1 and earlier have an insecure library loading (dll hijacking) vulnerability. Successful exploitation could lead to arbitra… |
CVE-2019-4473 | High | 7.8 | 2019-08-05 | Multiple binaries in IBM SDK, Java Technology Edition 7, 7R, and 8 on the AIX platform use insecure absolute RPATHs, which may facilitate code injection and pr… |
CVE-2019-14242 | Medium | 6.7 | 2019-07-30 | An issue was discovered in Bitdefender products for Windows (Bitdefender Endpoint Security Tool versions prior to 6.6.8.115; and Bitdefender Antivirus Plus, Bi… |
CVE-2019-1010100 | High | 7.8 | 2019-07-19 | Akeo Consulting Rufus 3.0 and earlier is affected by: DLL search order hijacking. The impact is: Arbitrary code execution WITH escalation of privilege. The com… |
CVE-2019-7956 | High | 7.8 | 2019-07-18 | Adobe Dreamweaver direct download installer versions 19.0 and below, 18.0 and below have an Insecure Library Loading (DLL hijacking) vulnerability. Successful… |
CVE-2019-6825 | High | 7.8 | 2019-07-15 | A CWE-427: Uncontrolled Search Path Element vulnerability exists in ProClima (all versions prior to version 8.0.0) which could allow a malicious DLL file, with… |
CVE-2019-5629 | High | 7.8 | 2019-07-13 | Rapid7 Insight Agent, version 2.6.3 and prior, suffers from a local privilege escalation due to an uncontrolled DLL search path. Specifically, when Insight Age… |
CVE-2019-12575 | High | 7.8 | 2019-07-11 | A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v82 for Linux could allow an authenticated, local attacker to run arbitrary… |
CVE-2019-1855 | High | 7.3 | 2019-07-04 | A vulnerability in the loading mechanism of specific dynamic link libraries in Cisco Jabber for Windows could allow an authenticated, local attacker to perform… |
CVE-2019-5443 | High | 7.8 | 2019-07-02 | A non-privileged user or program can put code and a config file in a known non-privileged path (under C:/usr/local/) that will make curl <= 7.65.1 automaticall… |
CVE-2019-12280 | High | 7.8 | 2019-06-25 | PC-Doctor Toolbox before 7.3 has an Uncontrolled Search Path Element. |
CVE-2019-12572 | High | 7.8 | 2019-06-21 | A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client 1.0.2 (build 02363) for Windows could allow an authenticated, local attacker… |
CVE-2019-12133 | High | 7.8 | 2019-06-18 | Multiple Zoho ManageEngine products suffer from local privilege escalation due to improper permissions for the %SYSTEMDRIVE%\ManageEngine directory and its sub… |
CVE-2019-5245 | Medium | 5.3 | 2019-06-13 | HiSuite 9.1.0.300 versions and earlier contains a DLL hijacking vulnerability. This vulnerability exists due to some DLL file is loaded by HiSuite improperly… |
CVE-2019-12177 | High | 7.8 | 2019-06-03 | Privilege escalation due to insecure directory permissions affecting ViveportDesktopService in HTC VIVEPORT before 1.0.0.36 allows local attackers to escalate… |
CVE-2019-7093 | High | 7.8 | 2019-05-24 | Creative Cloud Desktop Application (installer) versions 4.7.0.400 and earlier have an insecure library loading (dll hijacking) vulnerability. Successful exploi… |
CVE-2018-7840 | High | 7.8 | 2019-05-22 | A Uncontrolled Search Path Element (CWE-427) vulnerability exists in VideoXpert OpsCenter versions prior to 3.1 which could allow an attacker to cause the syst… |
CVE-2019-11644 | High | 7.8 | 2019-05-17 | In the F-Secure installer in F-Secure SAFE for Windows before 17.6, F-Secure Internet Security before 17.6, F-Secure Anti-Virus before 17.6, F-Secure Client Se… |
CVE-2019-5526 | High | 7.8 | 2019-05-15 | VMware Workstation (15.x before 15.1.0) contains a DLL hijacking issue because some DLL files are improperly loaded by the application. Successful exploitation… |
CVE-2019-5676 | Medium | 6.7 | 2019-05-10 | NVIDIA Windows GPU Display driver software for Windows (all versions) contains a vulnerability in which it incorrectly loads Windows system DLLs without valida… |
CVE-2019-6564 | High | 7.8 | 2019-05-09 | GE Communicator, all versions prior to 4.0.517, allows a non-administrative user to place malicious files within the installer file directory, which may allow… |
CVE-2019-6546 | High | 7.8 | 2019-05-09 | GE Communicator, all versions prior to 4.0.517, allows an attacker to place malicious files within the working directory of the program, which may allow an att… |
CVE-2019-1794 | Medium | 5.1 | 2019-04-18 | A vulnerability in the search path processing of Cisco Directory Connector could allow an authenticated, local attacker to load a binary of their choosing. The… |
CVE-2019-6534 | High | 7.8 | 2019-04-11 | The uncontrolled search path element vulnerability in Gemalto Sentinel UltraPro Client Library ux32w.dll Versions 1.3.0, 1.3.1, and 1.3.2 enables an attacker t… |
CVE-2015-1014 | High | 7.3 | 2019-03-25 | A successful exploit of these vulnerabilities requires the local user to load a crafted DLL file in the system directory on servers running Schneider Electric… |
CVE-2019-9896 | High | 7.8 | 2019-03-21 | In PuTTY versions before 0.71 on Windows, local attackers could hijack the application by putting a malicious help file in the same directory as the executable. |
CVE-2019-4094 | High | 7.8 | 2019-03-21 | IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 binaries load shared libraries from an untrusted path potentially g… |
CVE-2018-1890 | Medium | 5.6 | 2019-03-11 | IBM SDK, Java Technology Edition Version 8 on the AIX platform uses absolute RPATHs which may facilitate code injection and privilege elevation by local users… |
CVE-2019-9634 | High | 7.8 | 2019-03-08 | Go through 1.12 on Windows misuses certain LoadLibrary functionality, leading to DLL injection. |
CVE-2019-9546 | Critical | 9.8 | 2019-03-01 | SolarWinds Orion Platform before 2018.4 Hotfix 2 allows privilege escalation through the RabbitMQ service. |
CVE-2019-9116 | High | 7.8 | 2019-02-25 | DLL hijacking is possible in Sublime Text 3 version 3.1.1 build 3176 on 32-bit Windows platforms because a Trojan horse api-ms-win-core-fibers-l1-1-1.dll or ap… |
CVE-2019-7653 | Critical | 9.8 | 2019-02-09 | The Debian python-rdflib-tools 4.2.2-1 package for RDFLib 4.2.2 has CLI tools that can load Python modules from the current working directory, allowing code in… |
CVE-2018-16177 | High | 7.8 | 2019-01-09 | Untrusted search path vulnerability in The installer of Windows 10 Fall Creators Update Modify module for Security Measures tool allows an attacker to gain pri… |
CVE-2018-20211 | High | 7.8 | 2019-01-02 | ExifTool 8.32 allows local users to gain privileges by creating a %TEMP%\par-%username%\cache-exiftool-8.32 folder with a victim's username, and then copying a… |
CVE-2018-15452 | Medium | 5.5 | 2018-11-13 | A vulnerability in the DLL loading component of Cisco Advanced Malware Protection (AMP) for Endpoints on Windows could allow an authenticated, local attacker t… |
CVE-2018-7799 | High | 7.8 | 2018-11-02 | A DLL hijacking vulnerability exists in Schneider Electric Software Update (SESU), all versions prior to V2.2.0, which could allow an attacker to execute arbit… |
CVE-2018-14812 | High | 7.8 | 2018-10-24 | An uncontrolled search path element (DLL Hijacking) vulnerability has been identified in Fuji Electric Energy Savings Estimator versions V.1.0.2.0 and prior. E… |
CVE-2018-15976 | High | 7.8 | 2018-10-17 | Adobe Technical Communications Suite versions 1.0.5.1 and below have an insecure library loading (dll hijacking) vulnerability. Successful exploitation could l… |
CVE-2018-11072 | High | 7.8 | 2018-10-02 | Dell Digital Delivery versions prior to 3.5.1 contain a DLL Injection Vulnerability. A local authenticated malicious user with advance knowledge of the applica… |
CVE-2018-12163 | Medium | 4.8 | 2018-09-12 | A DLL injection vulnerability in the Intel IoT Developers Kit 4.0 installer may allow an authenticated user to potentially escalate privileges using file modif… |
CVE-2018-12160 | Medium | 5.3 | 2018-09-12 | DLL injection vulnerability in software installer for Intel Data Center Migration Center Software v3.1 and before may allow an authenticated user to potentiall… |
CVE-2018-13806 | High | 7.8 | 2018-09-12 | A vulnerability has been identified in SIEMENS TD Keypad Designer (All versions). A DLL hijacking vulnerability exists in all versions of SIEMENS TD Keypad Des… |
CVE-2018-14797 | High | 7.8 | 2018-08-23 | Emerson DeltaV DCS versions 11.3.1, 12.3.1, 13.3.0, 13.3.1, R5 allow a specially crafted DLL file to be placed in the search path and loaded as an internal and… |
CVE-2018-5238 | High | 7.8 | 2018-08-22 | Norton Power Eraser (prior to 5.3.0.24) and SymDiag (prior to 2.1.242) may be susceptible to a DLL Preloading vulnerability, which is a type of issue that can… |
CVE-2018-5235 | Medium | 6.0 | 2018-08-22 | Norton Utilities (prior to 16.0.3.44) may be susceptible to a DLL Preloading vulnerability, which is a type of issue that can occur when an application looks t… |
CVE-2018-8090 | High | 7.8 | 2018-07-25 | Quick Heal Total Security 64 bit 17.00 (QHTS64.exe), (QHTSFT64.exe) - Version 10.0.1.38; Quick Heal Total Security 32 bit 17.00 (QHTS32.exe), (QHTSFT32.exe) -… |
CVE-2018-12805 | Critical | 9.8 | 2018-07-20 | Adobe Connect versions 9.7.5 and earlier have an Insecure Library Loading vulnerability. Successful exploitation could lead to privilege escalation. |
CVE-2018-11049 | High | 7.3 | 2018-07-11 | RSA Identity Governance and Lifecycle, RSA Via Lifecycle and Governance, and RSA IMG releases have an uncontrolled search vulnerability. The installation scrip… |
CVE-2018-1000622 | High | 7.8 | 2018-07-09 | The Rust Programming Language rustdoc version Between 0.8 and 1.27.0 contains a CWE-427: Uncontrolled Search Path Element vulnerability in rustdoc plugins that… |
CVE-2017-7836 | High | 7.8 | 2018-06-11 | The "pingsender" executable used by the Firefox Health Report dynamically loads a system copy of libcurl, which an attacker could replace. This allows for priv… |
CVE-2018-4938 | High | 7.8 | 2018-05-19 | Adobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have an exploitable Insecure Library Loading vulnerability. Succes… |
CVE-2018-3649 | High | 7.8 | 2018-05-10 | DLL injection vulnerability in the installation executables (Autorun.exe and Setup.exe) for Intel's wireless drivers and related software in Intel Dual Band Wi… |
CVE-2017-5175 | High | 7.8 | 2018-05-09 | Advantech WebAccess 8.1 and earlier contains a DLL hijacking vulnerability which may allow an attacker to run a malicious DLL file within the search path resul… |
CVE-2017-14010 | High | 7.8 | 2018-04-26 | In SpiderControl MicroBrowser Windows XP, Vista 7, 8 and 10, Versions 1.6.30.144 and prior, an uncontrolled search path element vulnerability has been identifi… |
CVE-2018-6766 | High | 7.8 | 2018-03-27 | Swisscom TVMediaHelper 1.1.0.50 contains a vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary code on the targeted system… |
CVE-2018-6765 | High | 7.8 | 2018-03-27 | Swisscom MySwisscomAssistant 2.17.1.1065 contains a vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary code on the targete… |
CVE-2018-5457 | High | 7.0 | 2018-02-06 | A uncontrolled search path element issue was discovered in Vyaire Medical CareFusion Upgrade Utility used with Windows XP systems, Versions 2.0.2.2 and prior v… |
CVE-2017-5170 | High | 7.2 | 2018-01-18 | An Uncontrolled Search Path Element issue was discovered in Moxa SoftNVR-IA Live Viewer, Version 3.30.3122 and prior versions. An uncontrolled search path elem… |
CVE-2017-16777 | High | 7.8 | 2017-11-16 | If HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) 5.0.3 is installed but VMware Fusion is not, a local attacker can create a fake applicati… |
CVE-2017-12314 | High | 7.8 | 2017-11-16 | A vulnerability in the Cisco FindIT Network Discovery Utility could allow an authenticated, local attacker to perform a DLL preloading attack, potentially caus… |
CVE-2017-12313 | Medium | 6.7 | 2017-11-16 | An untrusted search path (aka DLL Preload) vulnerability in the Cisco Network Academy Packet Tracer software could allow an authenticated, local attacker to ex… |
CVE-2017-14020 | High | 7.8 | 2017-11-13 | In AutomationDirect CLICK Programming Software (Part Number C0-PGMSW) Versions 2.10 and prior; C-More Programming Software (Part Number EA9-PGMSW) Versions 6.3… |
CVE-2017-14029 | High | 7.8 | 2017-11-06 | An Uncontrolled Search Path Element issue was discovered in Trihedral VTScada 11.3.03 and prior. The program will execute specially crafted malicious dll files… |
CVE-2017-14017 | High | 7.8 | 2017-10-19 | An Uncontrolled Search Path Element issue was discovered in Progea Movicon Version 11.5.1181 and prior. An uncontrolled search path element vulnerability has b… |
CVE-2017-12579 | High | 7.8 | 2017-10-19 | An insecure suid wrapper binary in the HashiCorp Vagrant VMware Fusion plugin (aka vagrant-vmware-fusion) 4.0.24 and earlier allows a non-root user to obtain a… |
CVE-2017-12266 | Medium | 4.2 | 2017-10-05 | A vulnerability in the routine that loads DLL files in Cisco Meeting App for Windows could allow an authenticated, local attacker to run an executable file wit… |
CVE-2017-13993 | High | 7.8 | 2017-10-05 | An Uncontrolled Search Path or Element issue was discovered in i-SENS SmartLog Diabetes Management Software, Version 2.4.0 and prior versions. An uncontrolled… |
CVE-2017-5147 | Medium | 5.3 | 2017-09-09 | An Uncontrolled Search Path Element issue was discovered in AzeoTech DAQFactory versions prior to 17.1. An uncontrolled search path element vulnerability has b… |
CVE-2017-11158 | High | 7.8 | 2017-08-31 | Multiple untrusted search path vulnerabilities in the installer in Synology Cloud Station Drive before 4.2.5-4396 on Windows allow local attackers to execute a… |
CVE-2017-12717 | High | 7.8 | 2017-08-30 | An Uncontrolled Search Path Element issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. A maliciously crafted dll file placed earlier… |
CVE-2014-8393 | High | 7.8 | 2017-08-29 | DLL Hijacking vulnerability in CorelDRAW X7, Corel Photo-Paint X7, Corel PaintShop Pro X7, Corel Painter 2015, and Corel PDF Fusion. |