CWE-427 · Uncontrolled Search Path Element (page 7)
Page 7 of 13 — CVEs classified under CWE-427, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-47453 | High | 7.8 | 2023-11-30 | An Untrusted search path vulnerability in Sohu Video Player 7.0.15.0 allows local users to gain escalated privileges through the version.dll file in the curren… |
CVE-2023-47452 | High | 7.8 | 2023-11-30 | An Untrusted search path vulnerability in notepad++ 6.5 allows local users to gain escalated privileges through the msimg32.dll file in the current working dir… |
CVE-2023-6401 | Medium | 5.3 | 2023-11-30 | A vulnerability classified as problematic was found in NotePad++ up to 8.1. Affected by this vulnerability is an unknown functionality of the file dbghelp.exe… |
CVE-2023-4770 | Medium | 6.5 | 2023-11-30 | An uncontrolled search path element vulnerability has been found on 4D and 4D server Windows executables applications, affecting version 19 R8 100218. This vul… |
CVE-2023-4931 | Medium | 6.3 | 2023-11-27 | Uncontrolled search path element vulnerability in Plesk Installer affects version 3.27.0.0. A local attacker could execute arbitrary code by injecting DLL file… |
CVE-2023-41790 | High | 7.6 | 2023-11-23 | Uncontrolled Search Path Element vulnerability in Pandora FMS on all allows Leveraging/Manipulating Configuration File Search Paths. This vulnerability allows… |
CVE-2023-41787 | Medium | 6.0 | 2023-11-23 | Uncontrolled Search Path Element vulnerability in Pandora FMS on all allows Leveraging/Manipulating Configuration File Search Paths. This vulnerability allows… |
CVE-2023-29069 | High | 7.8 | 2023-11-22 | A maliciously crafted DLL file can be forced to install onto a non-default location, and attacker can overwrite parts of the product with malicious DLLs. These… |
CVE-2023-46814 | High | 7.8 | 2023-11-22 | A binary hijacking vulnerability exists within the VideoLAN VLC media player before 3.0.19 on Windows. The uninstaller attempts to execute code with elevated p… |
CVE-2023-6235 | High | 7.8 | 2023-11-21 | An uncontrolled search path element vulnerability has been found in the Duet Display product, affecting version 2.5.9.1. An attacker could place an arbitrary l… |
CVE-2023-22818 | High | 7.3 | 2023-11-15 | Multiple DLL Search Order Hijack vulnerabilities were addressed in the SanDisk Security Installer for Windows that could allow attackers with local access to e… |
CVE-2023-34430 | Medium | 6.7 | 2023-11-14 | Uncontrolled search path in some Intel Battery Life Diagnostic Tool software before version 2.2.1 may allow an authenticated user to potentially enable escalat… |
CVE-2023-34350 | Medium | 6.7 | 2023-11-14 | Uncontrolled search path element in some Intel(R) XTU software before version 7.12.0.15 may allow an authenticated user to potentially enable escalation of pri… |
CVE-2023-33874 | Medium | 6.7 | 2023-11-14 | Uncontrolled search path in some Intel(R) NUC 12 Pro Kits & Mini PCs - NUC12WS Intel(R) HID Event Filter Driver installation software before version 2.2.2.1 fo… |
CVE-2023-32660 | Medium | 6.7 | 2023-11-14 | Uncontrolled search path in some Intel(R) NUC Kit NUC6i7KYK Thunderbolt(TM) 3 Firmware Update Tool installation software before version 46 may allow an authent… |
CVE-2023-29504 | Medium | 6.7 | 2023-11-14 | Uncontrolled search path element in some Intel(R) RealSense(TM) Dynamic Calibration software before version 2.13.1.0 may allow an authenticated user to potenti… |
CVE-2023-29161 | Medium | 6.7 | 2023-11-14 | Uncontrolled search path in some Intel(R) OFU software before version 14.1.31 may allow an authenticated user to potentially enable escalation of privilege via… |
CVE-2023-28740 | Medium | 6.7 | 2023-11-14 | Uncontrolled search path element in some Intel(R) QAT drivers for Windows - HW Version 2.0 before version 2.0.4 may allow an authenticated user to potentially… |
CVE-2023-28388 | Medium | 6.7 | 2023-11-14 | Uncontrolled search path element in some Intel(R) Chipset Device Software before version 10.1.19444.8378 may allow an authenticated user to potentially enable… |
CVE-2023-27513 | Medium | 6.7 | 2023-11-14 | Uncontrolled search path element in some Intel(R) Server Information Retrieval Utility software before version 16.0.9 may allow an authenticated user to potent… |
CVE-2023-4632 | High | 7.8 | 2023-11-08 | An uncontrolled search path vulnerability was reported in Lenovo System Update that could allow an attacker with local access to execute code with elevated pri… |
CVE-2023-47113 | High | 7.3 | 2023-11-08 | BleachBit cleans files to free disk space and to maintain privacy. BleachBit for Windows up to version 4.4.2 is vulnerable to a DLL Hijacking vulnerability. By… |
CVE-2023-0898 | Medium | 5.3 | 2023-11-07 | General Electric MiCOM S1 Agile is vulnerable to an attacker achieving code execution by placing malicious DLL files in the directory of the application. |
CVE-2023-31027 | High | 8.2 | 2023-11-02 | NVIDIA GPU Display Driver for Windows contains a vulnerability that allows Windows users with low levels of privilege to escalate privileges when an administra… |
CVE-2023-31016 | High | 7.3 | 2023-11-02 | NVIDIA GPU Display Driver for Windows contains a vulnerability where an uncontrolled search path element may allow an attacker to execute arbitrary code, which… |
CVE-2023-44220 | High | 7.3 | 2023-10-27 | SonicWall NetExtender Windows (32-bit and 64-bit) client 10.2.336 and earlier versions have a DLL Search Order Hijacking vulnerability in the start-up DLL comp… |
CVE-2023-4936 | Medium | 5.5 | 2023-10-11 | It is possible to sideload a compromised DLL during the installation at elevated privilege. |
CVE-2023-5463 | High | 7.8 | 2023-10-09 | A vulnerability was found in XINJE XDPPro up to 3.7.17a. It has been rated as critical. Affected by this issue is some unknown functionality in the library cfg… |
CVE-2023-45248 | High | 7.3 | 2023-10-09 | Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 36… |
CVE-2023-35897 | High | 8.4 | 2023-10-06 | IBM Spectrum Protect Client and IBM Storage Protect for Virtual Environments 8.1.0.0 through 8.1.19.0 could allow a local user to execute arbitrary code on the… |
CVE-2022-4956 | High | 7.8 | 2023-09-30 | A vulnerability classified as critical has been found in Caphyon Advanced Installer 19.7. This affects an unknown part of the component WinSxS DLL Handler. The… |
CVE-2023-41929 | High | 7.3 | 2023-09-18 | A DLL hijacking vulnerability in Samsung Memory Card & UFD Authentication Utility PC Software before 1.0.1 could allow a local attacker to escalate privileges… |
CVE-2023-39374 | High | 7.8 | 2023-09-03 | ForeScout NAC SecureConnector version 11.2 - CWE-427: Uncontrolled Search Path Element |
CVE-2023-40596 | High | 7.0 | 2023-08-30 | In Splunk Enterprise versions earlier than 8.2.12, 9.0.6, and 9.1.1, a dynamic link library (DLL) that ships with Splunk Enterprise references an insecure path… |
CVE-2023-3252 | Medium | 6.8 | 2023-08-29 | An arbitrary file write vulnerability exists where an authenticated, remote attacker with administrator privileges could alter logging variables to overwrite… |
CVE-2023-40352 | High | 7.2 | 2023-08-21 | McAfee Safe Connect before 2.16.1.126 may allow an adversary with system privileges to achieve privilege escalation by loading arbitrary DLLs. |
CVE-2023-3078 | High | 7.8 | 2023-08-17 | An uncontrolled search path vulnerability was reported in the Lenovo Universal Device Client (UDC) that could allow an attacker with local access to execute co… |
CVE-2022-4894 | High | 7.3 | 2023-08-16 | Certain HP and Samsung Printer software packages may potentially be vulnerable to elevation of privilege due to Uncontrolled Search Path Element. |
CVE-2023-34355 | Medium | 6.7 | 2023-08-11 | Uncontrolled search path element for some Intel(R) Server Board M10JNP2SB integrated BMC video drivers before version 3.0 for Microsoft Windows and before vers… |
CVE-2023-29151 | Medium | 6.7 | 2023-08-11 | Uncontrolled search path element in some Intel(R) PSR SDK before version 1.0.0.20 may allow an authenticated user to potentially enable escalation of privilege… |
CVE-2023-28823 | Medium | 6.7 | 2023-08-11 | Uncontrolled search path in some Intel(R) oneAPI Toolkit and component software installers before version 4.3.1.493 may allow an authenticated user to potentia… |
CVE-2023-28405 | Medium | 6.7 | 2023-08-11 | Uncontrolled search path in the Intel(R) Distribution of OpenVINO(TM) Toolkit before version 2022.3.0 may allow an authenticated user to potentially enable esc… |
CVE-2023-28380 | High | 8.8 | 2023-08-11 | Uncontrolled search path for the Intel(R) AI Hackathon software before version 2.0.0 may allow an unauthenticated user to potentially enable escalation of priv… |
CVE-2023-25944 | Medium | 6.7 | 2023-08-11 | Uncontrolled search path element in some Intel(R) VCUST Tool software downloaded before February 3nd 2023 may allow an authenticated user to potentially enable… |
CVE-2023-25182 | Medium | 4.2 | 2023-08-11 | Uncontrolled search path element in the Intel(R) Unite(R) Client software for Mac before version 4.2.11 may allow an authenticated user to potentially enable e… |
CVE-2023-24016 | Medium | 6.7 | 2023-08-11 | Uncontrolled search path element in some Intel(R) Quartus(R) Prime Pro and Standard edition software for linux may allow an authenticated user to potentially e… |
CVE-2023-23577 | Medium | 6.7 | 2023-08-11 | Uncontrolled search path element for some ITE Tech consumer infrared drivers before version 5.5.2.1 for Intel(R) NUC may allow an authenticated user to potenti… |
CVE-2023-22841 | Medium | 6.7 | 2023-08-11 | Unquoted search path in the software installer for the System Firmware Update Utility (SysFwUpdt) for some Intel(R) Server Boards and Intel(R) Server Systems B… |
CVE-2022-43456 | Medium | 6.7 | 2023-08-11 | Uncontrolled search path in some Intel(R) RST software before versions 16.8.5.1014.5, 17.11.3.1010.2, 18.7.6.1011.2 and 19.5.2.1049.5 may allow an authenticate… |
CVE-2022-25864 | Medium | 6.7 | 2023-08-11 | Uncontrolled search path in some Intel(R) oneMKL software before version 2022.0 may allow an authenticated user to potentially enable escalation of privilege v… |
CVE-2022-47636 | High | 7.8 | 2023-08-10 | A DLL hijacking vulnerability has been discovered in OutSystems Service Studio 11 11.53.30 build 61739. When a user open a .oml file (OutSystems Modeling Langu… |
CVE-2023-36344 | High | 7.8 | 2023-08-08 | An issue in Diebold Nixdorf Vynamic View Console v.5.3.1 and before allows a local attacker to execute arbitrary code via not restricting the search path for r… |
CVE-2021-41544 | High | 7.8 | 2023-08-08 | A vulnerability has been identified in Siemens Software Center (All versions < V3.0). A DLL Hijacking vulnerability could allow a local attacker to execute cod… |
CVE-2023-37490 | High | 7.6 | 2023-08-08 | SAP Business Objects Installer - versions 420, 430, allows an authenticated attacker within the network to overwrite an executable file created in a temporary… |
CVE-2023-3662 | High | 7.3 | 2023-08-03 | In CODESYS Development System versions from 3.5.17.0 and prior to 3.5.19.20 a vulnerability allows for execution of binaries from the current working directory… |
CVE-2022-43703 | High | 7.8 | 2023-07-27 | An installer that loads or executes files using an unconstrained search path may be vulnerable to substitute files under control of an attacker being loaded or… |
CVE-2023-36853 | High | 7.8 | 2023-07-19 | In Keysight Geolocation Server v2.4.2 and prior, a low privileged attacker could create a local ZIP file containing a malicious script in any location. T… |
CVE-2023-37849 | Medium | 6.5 | 2023-07-13 | A DLL hijacking vulnerability in Panda Security VPN for Windows prior to version v15.14.8 allows attackers to execute arbitrary code via placing a crafted DLL… |
CVE-2023-31543 | Critical | 9.8 | 2023-06-30 | A dependency confusion in pipreqs v0.3.0 to v0.4.11 allows attackers to execute arbitrary code via uploading a crafted PyPI package to the chosen repository se… |
CVE-2023-28929 | High | 7.8 | 2023-06-26 | Trend Micro Security 2021, 2022, and 2023 (Consumer) are vulnerable to a DLL Hijacking vulnerability which could allow an attacker to use a specific executable… |
CVE-2023-2005 | Medium | 6.3 | 2023-06-26 | Vulnerability in Tenable Tenable.Io, Tenable Nessus, Tenable Security Center.This issue affects Tenable.Io: before Plugin Feed ID #202306261202 ; Nessus: befor… |
CVE-2023-27908 | High | 7.8 | 2023-06-23 | A maliciously crafted DLL file can be forced to write beyond allocated boundaries in the Autodesk installer when parsing the DLL files and could lead to a Priv… |
CVE-2023-0142 | Medium | 6.5 | 2023-06-13 | Uncontrolled search path element vulnerability in Backup Management functionality in Synology DiskStation Manager (DSM) before 6.2.4-25556-8, 7.0.1-42218-7 and… |
CVE-2023-0976 | Medium | 6.3 | 2023-06-07 | A command Injection Vulnerability in TA for mac-OS prior to version 5.7.9 allows local users to place an arbitrary file into the /Library/Trellix/Agent/bin/ f… |
CVE-2023-3091 | High | 7.0 | 2023-06-04 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in Captura up to 8.0.0. It has been declared as critical. This vulnerability affects unknown code in… |
CVE-2023-28080 | Medium | 6.7 | 2023-05-30 | PowerPath for Windows, versions 7.0, 7.1 & 7.2 contains DLL Hijacking Vulnerabilities. A regular user (non-admin) can exploit these issues to potentially esca… |
CVE-2023-25005 | High | 7.8 | 2023-05-12 | A maliciously crafted DLL file can be forced to read beyond allocated boundaries in Autodesk InfraWorks 2023, and 2021 when parsing the DLL files could lead to… |
CVE-2023-25428 | High | 7.8 | 2023-05-12 | A DLL Hijacking issue discovered in Soft-o Free Password Manager 1.1.20 allows attackers to create arbitrary DLLs leading to code execution. |
CVE-2023-31197 | Medium | 6.7 | 2023-05-12 | Uncontrolled search path in the Intel(R) Trace Analyzer and Collector before version 2020 update 3 may allow an authenticated user to potentially enable escala… |
CVE-2023-27386 | Medium | 6.7 | 2023-05-10 | Uncontrolled search path in some Intel(R) Pathfinder for RISC-V software may allow an authenticated user to potentially enable escalation of privilege via loca… |
CVE-2023-27298 | High | 8.8 | 2023-05-10 | Uncontrolled search path in the WULT software maintained by Intel(R) before version 1.0.0 (commit id 592300b) may allow an unauthenticated user to potentially… |
CVE-2023-22355 | Medium | 6.7 | 2023-05-10 | Uncontrolled search path in some Intel(R) oneAPI Toolkit and component software installers before version 4.3.0.251 may allow an authenticated user to potentia… |
CVE-2022-43474 | Medium | 6.7 | 2023-05-10 | Uncontrolled search path for the DSP Builder software installer before version 22.4 for Intel(R) FPGAs Pro Edition may allow an authenticated user to potential… |
CVE-2022-41998 | Medium | 6.7 | 2023-05-10 | Uncontrolled search path in the Intel(R) DCM software before version 5.1 may allow an authenticated user to potentially enable escalation of privilege via loca… |
CVE-2022-41982 | Medium | 6.7 | 2023-05-10 | Uncontrolled search path element in the Intel(R) VTune(TM) Profiler software before version 2023.0 may allow an authenticated user to potentially enable escala… |
CVE-2022-41693 | Medium | 6.7 | 2023-05-10 | Uncontrolled search path in the Intel(R) Quartus(R) Prime Pro edition software before version 22.3 may allow an authenticated user to potentially enable escala… |
CVE-2022-41628 | Medium | 6.7 | 2023-05-10 | Uncontrolled search path element in the HotKey Services for some Intel(R) NUC P14E Laptop Element software for Windows 10 before version 1.1.44 may allow an au… |
CVE-2022-38101 | Medium | 6.7 | 2023-05-10 | Uncontrolled search path in some Intel(R) NUC Chaco Canyon BIOS update software before version iFlashV Windows 5.13.00.2105 may allow an authenticated user to… |
CVE-2022-34848 | Medium | 6.7 | 2023-05-10 | Uncontrolled search path for the Intel(R) NUC Pro Software Suite before version 2.0.0.3 may allow an authenticated user to potentially enable escalation of pri… |
CVE-2022-32576 | Medium | 6.7 | 2023-05-10 | Uncontrolled search path in the Intel(R) Unite(R) Plugin SDK before version 4.2 may allow an authenticated user to potentially enable escalation of privilege v… |
CVE-2022-27180 | Medium | 4.2 | 2023-05-10 | Uncontrolled search path in the Intel(R) MacCPUID software before version 3.2 may allow an authenticated user to potentially enable escalation of privilege via… |
CVE-2022-21162 | Medium | 6.7 | 2023-05-10 | Uncontrolled search path for the Intel(R) HDMI Firmware Update tool for NUC before version 1.79.1.1 may allow an authenticated user to potentially enable escal… |
CVE-2023-30237 | High | 7.8 | 2023-05-09 | CyberGhostVPN Windows Client before v8.3.10.10015 was discovered to contain a DLL injection vulnerability via the component Dashboard.exe. |
CVE-2023-2355 | High | 7.8 | 2023-04-27 | Local privilege escalation due to a DLL hijacking vulnerability. The following products are affected: Acronis Snap Deploy (Windows) before build 3900. |
CVE-2023-29012 | High | 7.2 | 2023-04-25 | Git for Windows is the Windows port of Git. Prior to version 2.40.1, any user of Git CMD who starts the command in an untrusted directory is impacted by an Unc… |
CVE-2023-29011 | High | 7.5 | 2023-04-25 | Git for Windows, the Windows port of Git, ships with an executable called `connect.exe`, which implements a SOCKS5 proxy that can be used to connect e.g. to SS… |
CVE-2022-34755 | Medium | 6.3 | 2023-04-18 | A CWE-427 - Uncontrolled Search Path Element vulnerability exists that could allow an attacker with a local privileged account to place a specially crafted fi… |
CVE-2023-28140 | Medium | 6.7 | 2023-04-18 | An Executable Hijacking condition exists in the Qualys Cloud Agent for Windows platform in versions before 4.5.3.1. Attackers may load a malicious copy of a D… |
CVE-2023-29187 | Medium | 6.7 | 2023-04-11 | A Windows user with basic user authorization can exploit a DLL hijacking attack in SapSetup (Software Installation Program) - version 9.0, resulting in a privi… |
CVE-2022-48224 | High | 7.3 | 2023-04-04 | An issue was discovered in Acuant AcuFill SDK before 10.22.02.03. It is installed with insecure permissions (full write access within Program Files). Standard… |
CVE-2022-48223 | Medium | 6.7 | 2023-04-04 | An issue was discovered in Acuant AcuFill SDK before 10.22.02.03. During SDK repair, certutil.exe is called by the Acuant installer to repair certificates. Thi… |
CVE-2022-48222 | High | 7.8 | 2023-04-04 | An issue was discovered in Acuant AcuFill SDK before 10.22.02.03. During SDK installation, certutil.exe is called by the Acuant installer to install certificat… |
CVE-2022-48225 | High | 7.3 | 2023-04-04 | An issue was discovered in Acuant AcuFill SDK before 10.22.02.03. It is used to install drivers from several different vendors. The Gemalto Document Reader chi… |
CVE-2023-1745 | Medium | 5.3 | 2023-03-30 | A vulnerability, which was classified as problematic, has been found in KMPlayer 4.2.2.73. This issue affects some unknown processing in the library SHFOLDER.d… |
CVE-2022-28688 | High | 7.8 | 2023-03-29 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of AVEVA Edge 2020 SP2 Patch 0(4201.2111.1802.0000). User intera… |
CVE-2022-28687 | High | 7.8 | 2023-03-29 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of AVEVA Edge 2020 SP2 Patch 0(4201.2111.1802.0000). User intera… |
CVE-2022-28686 | High | 7.8 | 2023-03-29 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of AVEVA Edge 2020 SP2 Patch 0(4201.2111.1802.0000). User intera… |
CVE-2023-0213 | High | 8.8 | 2023-03-29 | Elevation of privilege issue in M-Files Installer versions before 22.6 on Windows allows user to gain SYSTEM privileges via DLL hijacking. |
CVE-2023-28596 | High | 7.8 | 2023-03-27 | Zoom Client for IT Admin macOS installers before version 5.13.5 contain a local privilege escalation vulnerability. A local low-privileged user could exploit t… |
CVE-2022-38745 | High | 7.8 | 2023-03-24 | Apache OpenOffice versions before 4.1.14 may be configured to add an empty entry to the Java class path. This may lead to run arbitrary Java code from the curr… |