CWE-427 · Uncontrolled Search Path Element (page 4)
Page 4 of 13 — CVEs classified under CWE-427, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2025-5129 | High | 7.0 | 2025-05-24 | A vulnerability has been found in Sangfor 零信任访问控制系统 aTrust 2.3.10.60 and classified as critical. Affected by this vulnerability is an unknown functionality in… |
CVE-2024-13946 | Medium | 6.8 | 2025-05-22 | DLL's are not digitally signed when loaded in ASPECT's configuration toolset exposing the application to binary planting during device commissioning.This issue… |
CVE-2025-2272 | High | 7.0 | 2025-05-22 | Uncontrolled Search Path Element vulnerability in Forcepoint FIE Endpoint allows Privilege Escalation, Code Injection, Hijacking a privileged process.This issu… |
CVE-2025-27997 | High | 8.4 | 2025-05-21 | An issue in Blizzard Battle.net v2.40.0.15267 allows attackers to escalate privileges via placing a crafted shell script or executable into the C:\ProgramData… |
CVE-2025-4769 | High | 7.0 | 2025-05-16 | A vulnerability classified as critical was found in CBEWIN Anytxt Searcher 1.3.1128.0. This vulnerability affects unknown code of the file ATService.exe. The m… |
CVE-2025-43553 | High | 7.8 | 2025-05-13 | Substance3D - Modeler versions 1.21.0 and earlier are affected by an Uncontrolled Search Path Element vulnerability that could result in arbitrary code executi… |
CVE-2025-21099 | Medium | 6.7 | 2025-05-13 | Uncontrolled search path for some Intel(R) Graphics software may allow an authenticated user to potentially enable escalation of privilege via local access. |
CVE-2025-20108 | Medium | 6.7 | 2025-05-13 | Uncontrolled search path element for some Intel(R) Network Adapter Driver installers for Windows 11 before version 29.4 may allow an authenticated user to pote… |
CVE-2025-20079 | Medium | 6.7 | 2025-05-13 | Uncontrolled search path for some Intel(R) Advisor software may allow an authenticated user to potentially enable escalation of privilege via local access. |
CVE-2025-20043 | Medium | 6.7 | 2025-05-13 | Uncontrolled search path for some Intel(R) RealSense™ SDK software before version 2.56.2 may allow an authenticated user to potentially enable escalation of pr… |
CVE-2025-20041 | Medium | 6.7 | 2025-05-13 | Uncontrolled search path for some Intel(R) Graphics software for Intel(R) Arc™ graphics and Intel(R) Iris(R) Xe graphics before version 32.0.101.6325/32.0.101… |
CVE-2025-20015 | Medium | 6.7 | 2025-05-13 | Uncontrolled search path element for some Intel(R) Ethernet Connection software before version 29.4 may allow an authenticated user to potentially enable escal… |
CVE-2024-47800 | Medium | 6.7 | 2025-05-13 | Uncontrolled search path for some Intel(R) Graphics Driver software may allow an authenticated user to potentially enable escalation of privilege via local acc… |
CVE-2024-47795 | Medium | 6.7 | 2025-05-13 | Uncontrolled search path for some Intel(R) oneAPI DPC++/C++ Compiler software before version 2025.0.0 may allow an authenticated user to potentially enable esc… |
CVE-2024-46895 | Medium | 6.7 | 2025-05-13 | Uncontrolled search path for some Intel(R) Arc™ & Iris(R) Xe graphics software before version 32.0.101.6083/32.0.101.5736 may allow an authenticated user t… |
CVE-2024-39833 | Medium | 6.7 | 2025-05-13 | Uncontrolled search path for some Intel(R) QAT software before version 2.3.0 may allow an authenticated user to potentially enable escalation of privilege via… |
CVE-2024-31073 | Medium | 6.7 | 2025-05-13 | Uncontrolled search path for some Intel(R) oneAPI Level Zero software may allow an authenticated user to potentially enable escalation of privilege via local a… |
CVE-2023-31358 | High | 7.3 | 2025-05-13 | A DLL hijacking vulnerability in the AMD Manageability API could allow an attacker to achieve privilege escalation, potentially resulting in arbitrary code exe… |
CVE-2025-32917 | High | 8.8 | 2025-05-13 | Privilege escalation in jar_signature agent plugin in Checkmk versions <2.4.0b7 (beta), <2.3.0p32, <2.2.0p42, and 2.1.0p49 (EOL) allow user with write access t… |
CVE-2025-35471 | High | 7.3 | 2025-05-13 | conda-forge openssl-feedstock before 066e83c (2024-05-20), on Microsoft Windows, configures OpenSSL to use an OPENSSLDIR file path that can be written to by no… |
CVE-2025-4539 | High | 7.0 | 2025-05-11 | A vulnerability was found in Hainan ToDesk 4.7.6.3. It has been declared as critical. This vulnerability affects unknown code in the library profapi.dll of the… |
CVE-2025-4532 | High | 7.0 | 2025-05-11 | A vulnerability classified as critical has been found in Shanghai Bairui Information Technology SunloginClient 15.8.3.19819. This affects an unknown part in th… |
CVE-2025-4525 | High | 7.0 | 2025-05-10 | A vulnerability, which was classified as critical, has been found in Discord 1.0.9188 on Windows. Affected by this issue is some unknown functionality in the l… |
CVE-2025-4455 | High | 7.0 | 2025-05-09 | A vulnerability was found in Patch My PC Home Updater up to 5.1.3.0. It has been rated as critical. This issue affects some unknown processing in the library a… |
CVE-2025-4272 | High | 7.0 | 2025-05-05 | A vulnerability was found in Mechrevo Control Console 1.0.2.70. It has been rated as critical. Affected by this issue is some unknown functionality in the libr… |
CVE-2025-23177 | High | 7.6 | 2025-04-29 | CWE-427: Uncontrolled Search Path Element |
CVE-2025-2769 | High | 7.8 | 2025-04-23 | Bdrive NetDrive Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on… |
CVE-2025-2768 | High | 7.8 | 2025-04-23 | Bdrive NetDrive Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on… |
CVE-2025-43950 | High | 7.8 | 2025-04-22 | DPMAdirektPro 4.1.5 is vulnerable to DLL Hijacking. It happens by placing a malicious DLL in a directory (in the absence of a legitimate DLL), which is then lo… |
CVE-2024-12530 | | 2025-04-17 | Uncontrolled Search Path Element vulnerability in OpenText Secure Content Manager on Windows allows DLL Side-Loading.This issue affects Secure Content Manager… | |
CVE-2025-32780 | High | 7.3 | 2025-04-15 | BleachBit cleans files to free disk space and to maintain privacy. BleachBit for Windows up to version 4.6.2 is vulnerable to a DLL Hijacking vulnerability. By… |
CVE-2025-29817 | Medium | 5.7 | 2025-04-15 | Uncontrolled search path element in Power Automate allows an authorized attacker to disclose information over a network. |
CVE-2025-29803 | High | 7.3 | 2025-04-12 | Uncontrolled search path element in Visual Studio Tools for Applications and SQL Server Management Studio allows an authorized attacker to elevate privileges l… |
CVE-2025-2630 | High | 7.3 | 2025-04-09 | There is a DLL hijacking vulnerability due to an uncontrolled search path that exists in NI LabVIEW. This vulnerability may result in arbitrary code execution… |
CVE-2025-2629 | High | 7.3 | 2025-04-09 | There is a DLL hijacking vulnerability due to an uncontrolled search path that exists in NI LabVIEW when loading NI Error Reporting. This vulnerability may re… |
CVE-2025-29802 | High | 7.3 | 2025-04-08 | Improper access control in Visual Studio allows an authorized attacker to elevate privileges locally. |
CVE-2025-22458 | High | 7.8 | 2025-04-08 | DLL hijacking in Ivanti Endpoint Manager before version 2024 SU1 or before version 2022 SU7 allows an authenticated attacker to escalate to System. |
CVE-2024-11859 | | 2025-04-07 | DLL Search Order Hijacking vulnerability potentially allowed an attacker with administrator privileges to load a malicious dynamic-link library and execute its… | |
CVE-2025-3051 | Medium | 6.5 | 2025-04-01 | Linux::Statm::Tiny for Perl before 0.0701 allows untrusted code from the current working directory ('.') to be loaded similar to CVE-2016-1238. If an attacker… |
CVE-2025-30673 | Medium | 6.5 | 2025-04-01 | Sub::HandlesVia for Perl before 0.050002 allows untrusted code from the current working directory ('.') to be loaded similar to CVE-2016-1238. If an attacker… |
CVE-2025-30672 | Medium | 6.5 | 2025-04-01 | Mite for Perl before 0.013000 generates code with the current working directory ('.') added to the @INC path similar to CVE-2016-1238. If an attacker can plac… |
CVE-2025-26631 | High | 7.3 | 2025-03-11 | Uncontrolled search path element in Visual Studio Code allows an authorized attacker to elevate privileges locally. |
CVE-2025-25003 | High | 7.3 | 2025-03-11 | Uncontrolled search path element in Visual Studio allows an authorized attacker to elevate privileges locally. |
CVE-2025-24998 | High | 7.3 | 2025-03-11 | Uncontrolled search path element in Visual Studio allows an authorized attacker to elevate privileges locally. |
CVE-2020-23438 | High | 7.8 | 2025-03-04 | Wondershare filmora 9.2.11 is affected by Trojan Dll hijacking leading to privilege escalation. |
CVE-2024-10930 | High | 7.8 | 2025-03-04 | An Uncontrolled Search Path Element vulnerability exists which could allow a malicious actor to perform DLL hijacking and execute arbitrary code with escalated… |
CVE-2025-1804 | High | 7.0 | 2025-03-01 | A vulnerability was found in Blizzard Battle.Net up to 2.39.0.15212 on Windows and classified as critical. Affected by this issue is some unknown functionality… |
CVE-2024-55898 | High | 8.5 | 2025-02-24 | IBM i 7.2, 7.3, 7.4, and 7.5 could allow a user with the capability to compile or restore a program to gain elevated privileges due to an unqualified library c… |
CVE-2022-28339 | High | 7.3 | 2025-02-22 | Trend Micro HouseCall for Home Networks version 5.3.1302 and below contains an uncontrolled search patch element vulnerability that could allow an attacker wit… |
CVE-2025-1223 | Medium | 6.1 | 2025-02-20 | An attacker can gain application privileges in order to perform limited modification and/or read arbitrary data in Citrix Secure Access Client for Mac |
CVE-2025-26624 | | 2025-02-18 | Rufus is a utility that helps format and create bootable USB flash drives. A DLL hijacking vulnerability in Rufus 4.6.2208 and earlier versions allows an attac… | |
CVE-2024-57964 | High | 7.3 | 2025-02-18 | Insecure Loading of Dynamic Link Libraries have been discovered in HVAC Energy Saving Program, which could allow local attackers to potentially disclose inform… |
CVE-2024-57963 | High | 7.3 | 2025-02-18 | Insecure Loading of Dynamic Link Libraries have been discovered in USB-CONVERTERCABLE DRIVER, which could allow local attackers to potentially disclose informa… |
CVE-2024-47006 | Medium | 6.7 | 2025-02-12 | Uncontrolled search path for the Intel(R) RealSense D400 Series Universal Windows Platform (UWP) Driver for Windows(R) 10 all versions may allow an authenticat… |
CVE-2024-42492 | Medium | 6.7 | 2025-02-12 | Uncontrolled search path element in some BIOS and System Firmware Update Package for Intel(R) Server M50FCP family before version R01.02.0002 may allow a privi… |
CVE-2024-42405 | Medium | 6.7 | 2025-02-12 | Uncontrolled search path for some Intel(R) Quartus(R) Prime Software before version 23.1.1 Patch 1.01std may allow an authenticated user to potentially enable… |
CVE-2024-39813 | Medium | 6.7 | 2025-02-12 | Uncontrolled search path for some EPCT software before version 1.42.8.0 may allow an authenticated user to potentially enable escalation of privilege via local… |
CVE-2024-39372 | Medium | 6.7 | 2025-02-12 | Uncontrolled search path for the Intel(R) XTU software for Windows before version 7.14.2.14 may allow an authenticated user to potentially enable escalation of… |
CVE-2024-39365 | Medium | 6.7 | 2025-02-12 | Uncontrolled search path for the FPGA Support Package for the Intel(R) oneAPI DPC++/C++ Compiler software for Windows before version 2024.2 may allow an authen… |
CVE-2024-39284 | Medium | 6.7 | 2025-02-12 | Uncontrolled search path for some Intel(R) Advisor software before version 2024.2 may allow an authenticated user to potentially enable escalation of privilege… |
CVE-2024-36291 | Medium | 6.7 | 2025-02-12 | Uncontrolled search path for some Intel(R) Chipset Software Installation Utility before version 10.1.19867.8574 may allow an authenticated user to potentially… |
CVE-2024-36283 | Medium | 6.7 | 2025-02-12 | Uncontrolled search path for the Intel(R) Thread Director Visualizer software before version 1.0.1 may allow an authenticated user to potentially enable escala… |
CVE-2024-36280 | Medium | 6.7 | 2025-02-12 | Uncontrolled search path for some Intel(R) High Level Synthesis Compiler software before version 24.2 may allow an authenticated user to potentially enable esc… |
CVE-2024-32938 | Medium | 6.7 | 2025-02-12 | Uncontrolled search path for some Intel(R) MPI Library for Windows software before version 2021.13 may allow an authenticated user to potentially enable escala… |
CVE-2024-29223 | Medium | 6.7 | 2025-02-12 | Uncontrolled search path for some Intel(R) QuickAssist Technology software before version 2.2.0 may allow an authenticated user to potentially enable escalatio… |
CVE-2024-24852 | Medium | 6.7 | 2025-02-12 | Uncontrolled search path in some Intel(R) Ethernet Adapter Complete Driver Pack install before versions 29.1 may allow an authenticated user to potentially ena… |
CVE-2024-21830 | Medium | 6.7 | 2025-02-12 | Uncontrolled search path in some Intel(R) VPL software before version 2023.4.0 may allow an authenticated user to potentially enable escalation of privilege vi… |
CVE-2023-31361 | High | 7.3 | 2025-02-11 | A DLL hijacking vulnerability in AMD Integrated Management Technology (AIM-T) Manageability Service could allow an attacker to achieve privilege escalation pot… |
CVE-2025-24039 | High | 7.3 | 2025-02-11 | Visual Studio Code Elevation of Privilege Vulnerability |
CVE-2025-21206 | High | 7.3 | 2025-02-11 | Visual Studio Installer Elevation of Privilege Vulnerability |
CVE-2024-53977 | Medium | 6.7 | 2025-02-11 | A vulnerability has been identified in ModelSim (All versions < V2025.1), Questa (All versions < V2025.1). An example setup script contained in affected applic… |
CVE-2024-48091 | High | 7.8 | 2025-02-07 | Tally Prime Edit Log v2.1 was discovered to contain a DLL hijacking vulnerability via the component TextShaping.dll. This vulnerability allows attackers to exe… |
CVE-2024-57426 | High | 7.3 | 2025-02-06 | NetMod VPN Client 5.3.1 is vulnerable to DLL injection, allowing an attacker to execute arbitrary code by placing a malicious DLL in a directory where the appl… |
CVE-2024-2658 | | 2025-01-30 | A misconfiguration in lmadmin.exe of FlexNet Publisher versions prior to 2024 R1 (11.19.6.0) allows the OpenSSL configuration file to load from a non-existent… | |
CVE-2024-9499 | High | 8.6 | 2025-01-24 | DLL hijacking vulnerabilities, caused by an uncontrolled search path in the USBXpress Win 98SE Dev Kit installer can lead to privilege escalation and arbitrary… |
CVE-2024-9498 | High | 8.6 | 2025-01-24 | DLL hijacking vulnerabilities, caused by an uncontrolled search path in the USBXpress SDK installer can lead to privilege escalation and arbitrary code… |
CVE-2024-9497 | High | 8.6 | 2025-01-24 | DLL hijacking vulnerabilities, caused by an uncontrolled search path in the USBXpress 4 SDK installer can lead to privilege escalation and arbitrary cod… |
CVE-2024-9496 | High | 8.6 | 2025-01-24 | DLL hijacking vulnerabilities, caused by an uncontrolled search path in the USBXpress Dev Kit installer can lead to privilege escalation and arbitrary c… |
CVE-2024-9495 | High | 8.6 | 2025-01-24 | DLL hijacking vulnerabilities, caused by an uncontrolled search path in the CP210x VCP Windows installer can lead to privilege escalation and arbitrary co… |
CVE-2024-9494 | High | 8.6 | 2025-01-24 | DLL hijacking vulnerabilities, caused by an uncontrolled search path in the CP210 VCP Win 2k installer can lead to privilege escalation and arbitrary c… |
CVE-2024-9493 | High | 8.6 | 2025-01-24 | DLL hijacking vulnerabilities, caused by an uncontrolled search path in the ToolStick installer can lead to privilege escalation and arbitrary code executi… |
CVE-2024-9492 | High | 8.6 | 2025-01-24 | DLL hijacking vulnerabilities, caused by an uncontrolled search path in Flash Programming Utility installer can lead to privilege escalation and arbitrary code… |
CVE-2024-9491 | High | 8.6 | 2025-01-24 | DLL hijacking vulnerabilities, caused by an uncontrolled search path in Configuration Wizard 2 installer can lead to privilege escalation and arbitrary code ex… |
CVE-2024-9490 | High | 8.6 | 2025-01-24 | DLL hijacking vulnerabilities, caused by an uncontrolled search path in Silicon Labs (8-bit) IDE installer can lead to privilege escalation and arbitrary code… |
CVE-2024-41739 | High | 8.8 | 2025-01-24 | IBM Cognos Dashboards 4.0.7 and 5.0.0 on Cloud Pak for Data could allow a remote attacker to perform unauthorized actions due to dependency confusion. |
CVE-2024-53588 | High | 7.8 | 2025-01-23 | A DLL hijacking vulnerability in iTop VPN v16.0 allows attackers to execute arbitrary code via placing a crafted DLL file into the path \ProgramData\iTop VPN\D… |
CVE-2025-21127 | High | 7.8 | 2025-01-14 | Photoshop Desktop versions 25.12, 26.1 and earlier are affected by an Uncontrolled Search Path Element vulnerability that could lead to arbitrary code executio… |
CVE-2025-0069 | High | 7.8 | 2025-01-14 | Due to DLL injection vulnerability in SAPSetup, an attacker with either local user privileges or with access to a compromised corporate user�s Windows account… |
CVE-2024-55543 | High | 7.8 | 2025-01-02 | Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect 16 (Windows) before build 39169. |
CVE-2024-55540 | High | 7.8 | 2025-01-02 | Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect 16 (Windows) before build 39169. |
CVE-2024-55955 | Medium | 6.7 | 2024-12-31 | An incorrect permissions assignment vulnerability in Trend Micro Deep Security 20.0 agents between versions 20.0.1-9400 and 20.0.1-23340 could allow a local at… |
CVE-2022-27595 | High | 7.8 | 2024-12-19 | An insecure library loading vulnerability has been reported to affect QVPN Device Client. If exploited, the vulnerability could allow local attackers who have… |
CVE-2024-47576 | Low | 3.3 | 2024-12-10 | SAP Product Lifecycle Costing Client (versions below 4.7.1) application loads on demand a DLL that is available with Windows OS. This DLL is loaded from the co… |
CVE-2024-9852 | High | 7.8 | 2024-11-28 | Uncontrolled Search Path Element vulnerability in Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, Mitsubishi Electric ICONICS Suite versions 10.97.3… |
CVE-2024-8299 | High | 7.8 | 2024-11-28 | Uncontrolled Search Path Element vulnerability in Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, Mitsubishi Electric ICONICS Suite versions 10.97.3… |
CVE-2024-7253 | High | 7.8 | 2024-11-22 | NoMachine Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affect… |
CVE-2024-7244 | High | 7.8 | 2024-11-22 | Panda Security Dome VPN DLL Hijacking Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected in… |
CVE-2024-30376 | High | 7.3 | 2024-11-22 | Famatech Advanced IP Scanner Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate p… |
CVE-2024-48992 | High | 7.8 | 2024-11-19 | Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by tricking needrestart into running the Ruby… |
CVE-2024-48990 | High | 7.8 | 2024-11-19 | Qualys discovered that needrestart, before version 3.8, allows local attackers to execute arbitrary code as root by tricking needrestart into running the Pytho… |