CWE-427 · Uncontrolled Search Path Element (page 7)
Page 7 of 13 — CVEs classified under CWE-427, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-31027 | High | 8.2 | 2023-11-02 | NVIDIA GPU Display Driver for Windows contains a vulnerability that allows Windows users with low levels of privilege to escalate privileges when an administra… |
CVE-2023-31016 | High | 7.3 | 2023-11-02 | NVIDIA GPU Display Driver for Windows contains a vulnerability where an uncontrolled search path element may allow an attacker to execute arbitrary code, which… |
CVE-2023-44220 | High | 7.3 | 2023-10-27 | SonicWall NetExtender Windows (32-bit and 64-bit) client 10.2.336 and earlier versions have a DLL Search Order Hijacking vulnerability in the start-up DLL comp… |
CVE-2023-4936 | Medium | 5.5 | 2023-10-11 | It is possible to sideload a compromised DLL during the installation at elevated privilege. |
CVE-2023-5463 | High | 7.8 | 2023-10-09 | A vulnerability was found in XINJE XDPPro up to 3.7.17a. It has been rated as critical. Affected by this issue is some unknown functionality in the library cfg… |
CVE-2023-45248 | High | 7.3 | 2023-10-09 | Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 36… |
CVE-2023-35897 | High | 8.4 | 2023-10-06 | IBM Spectrum Protect Client and IBM Storage Protect for Virtual Environments 8.1.0.0 through 8.1.19.0 could allow a local user to execute arbitrary code on the… |
CVE-2022-4956 | High | 7.8 | 2023-09-30 | A vulnerability classified as critical has been found in Caphyon Advanced Installer 19.7. This affects an unknown part of the component WinSxS DLL Handler. The… |
CVE-2023-41929 | High | 7.3 | 2023-09-18 | A DLL hijacking vulnerability in Samsung Memory Card & UFD Authentication Utility PC Software before 1.0.1 could allow a local attacker to escalate privileges… |
CVE-2023-39374 | High | 7.8 | 2023-09-03 | ForeScout NAC SecureConnector version 11.2 - CWE-427: Uncontrolled Search Path Element |
CVE-2023-40596 | High | 7.0 | 2023-08-30 | In Splunk Enterprise versions earlier than 8.2.12, 9.0.6, and 9.1.1, a dynamic link library (DLL) that ships with Splunk Enterprise references an insecure path… |
CVE-2023-3252 | Medium | 6.8 | 2023-08-29 | An arbitrary file write vulnerability exists where an authenticated, remote attacker with administrator privileges could alter logging variables to overwrite… |
CVE-2023-40352 | High | 7.2 | 2023-08-21 | McAfee Safe Connect before 2.16.1.126 may allow an adversary with system privileges to achieve privilege escalation by loading arbitrary DLLs. |
CVE-2023-3078 | High | 7.8 | 2023-08-17 | An uncontrolled search path vulnerability was reported in the Lenovo Universal Device Client (UDC) that could allow an attacker with local access to execute co… |
CVE-2022-4894 | High | 7.3 | 2023-08-16 | Certain HP and Samsung Printer software packages may potentially be vulnerable to elevation of privilege due to Uncontrolled Search Path Element. |
CVE-2023-34355 | Medium | 6.7 | 2023-08-11 | Uncontrolled search path element for some Intel(R) Server Board M10JNP2SB integrated BMC video drivers before version 3.0 for Microsoft Windows and before vers… |
CVE-2023-29151 | Medium | 6.7 | 2023-08-11 | Uncontrolled search path element in some Intel(R) PSR SDK before version 1.0.0.20 may allow an authenticated user to potentially enable escalation of privilege… |
CVE-2023-28823 | Medium | 6.7 | 2023-08-11 | Uncontrolled search path in some Intel(R) oneAPI Toolkit and component software installers before version 4.3.1.493 may allow an authenticated user to potentia… |
CVE-2023-28405 | Medium | 6.7 | 2023-08-11 | Uncontrolled search path in the Intel(R) Distribution of OpenVINO(TM) Toolkit before version 2022.3.0 may allow an authenticated user to potentially enable esc… |
CVE-2023-28380 | High | 8.8 | 2023-08-11 | Uncontrolled search path for the Intel(R) AI Hackathon software before version 2.0.0 may allow an unauthenticated user to potentially enable escalation of priv… |
CVE-2023-25944 | Medium | 6.7 | 2023-08-11 | Uncontrolled search path element in some Intel(R) VCUST Tool software downloaded before February 3nd 2023 may allow an authenticated user to potentially enable… |
CVE-2023-25182 | Medium | 4.2 | 2023-08-11 | Uncontrolled search path element in the Intel(R) Unite(R) Client software for Mac before version 4.2.11 may allow an authenticated user to potentially enable e… |
CVE-2023-24016 | Medium | 6.7 | 2023-08-11 | Uncontrolled search path element in some Intel(R) Quartus(R) Prime Pro and Standard edition software for linux may allow an authenticated user to potentially e… |
CVE-2023-23577 | Medium | 6.7 | 2023-08-11 | Uncontrolled search path element for some ITE Tech consumer infrared drivers before version 5.5.2.1 for Intel(R) NUC may allow an authenticated user to potenti… |
CVE-2023-22841 | Medium | 6.7 | 2023-08-11 | Unquoted search path in the software installer for the System Firmware Update Utility (SysFwUpdt) for some Intel(R) Server Boards and Intel(R) Server Systems B… |
CVE-2022-43456 | Medium | 6.7 | 2023-08-11 | Uncontrolled search path in some Intel(R) RST software before versions 16.8.5.1014.5, 17.11.3.1010.2, 18.7.6.1011.2 and 19.5.2.1049.5 may allow an authenticate… |
CVE-2022-25864 | Medium | 6.7 | 2023-08-11 | Uncontrolled search path in some Intel(R) oneMKL software before version 2022.0 may allow an authenticated user to potentially enable escalation of privilege v… |
CVE-2022-47636 | High | 7.8 | 2023-08-10 | A DLL hijacking vulnerability has been discovered in OutSystems Service Studio 11 11.53.30 build 61739. When a user open a .oml file (OutSystems Modeling Langu… |
CVE-2023-36344 | High | 7.8 | 2023-08-08 | An issue in Diebold Nixdorf Vynamic View Console v.5.3.1 and before allows a local attacker to execute arbitrary code via not restricting the search path for r… |
CVE-2021-41544 | High | 7.8 | 2023-08-08 | A vulnerability has been identified in Siemens Software Center (All versions < V3.0). A DLL Hijacking vulnerability could allow a local attacker to execute cod… |
CVE-2023-37490 | High | 7.6 | 2023-08-08 | SAP Business Objects Installer - versions 420, 430, allows an authenticated attacker within the network to overwrite an executable file created in a temporary… |
CVE-2023-3662 | High | 7.3 | 2023-08-03 | In CODESYS Development System versions from 3.5.17.0 and prior to 3.5.19.20 a vulnerability allows for execution of binaries from the current working directory… |
CVE-2022-43703 | High | 7.8 | 2023-07-27 | An installer that loads or executes files using an unconstrained search path may be vulnerable to substitute files under control of an attacker being loaded or… |
CVE-2023-36853 | High | 7.8 | 2023-07-19 | In Keysight Geolocation Server v2.4.2 and prior, a low privileged attacker could create a local ZIP file containing a malicious script in any location. T… |
CVE-2023-37849 | Medium | 6.5 | 2023-07-13 | A DLL hijacking vulnerability in Panda Security VPN for Windows prior to version v15.14.8 allows attackers to execute arbitrary code via placing a crafted DLL… |
CVE-2023-31543 | Critical | 9.8 | 2023-06-30 | A dependency confusion in pipreqs v0.3.0 to v0.4.11 allows attackers to execute arbitrary code via uploading a crafted PyPI package to the chosen repository se… |
CVE-2023-28929 | High | 7.8 | 2023-06-26 | Trend Micro Security 2021, 2022, and 2023 (Consumer) are vulnerable to a DLL Hijacking vulnerability which could allow an attacker to use a specific executable… |
CVE-2023-2005 | Medium | 6.3 | 2023-06-26 | Vulnerability in Tenable Tenable.Io, Tenable Nessus, Tenable Security Center.This issue affects Tenable.Io: before Plugin Feed ID #202306261202 ; Nessus: befor… |
CVE-2023-27908 | High | 7.8 | 2023-06-23 | A maliciously crafted DLL file can be forced to write beyond allocated boundaries in the Autodesk installer when parsing the DLL files and could lead to a Priv… |
CVE-2023-0142 | Medium | 6.5 | 2023-06-13 | Uncontrolled search path element vulnerability in Backup Management functionality in Synology DiskStation Manager (DSM) before 6.2.4-25556-8, 7.0.1-42218-7 and… |
CVE-2023-0976 | Medium | 6.3 | 2023-06-07 | A command Injection Vulnerability in TA for mac-OS prior to version 5.7.9 allows local users to place an arbitrary file into the /Library/Trellix/Agent/bin/ f… |
CVE-2023-3091 | High | 7.0 | 2023-06-04 | ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in Captura up to 8.0.0. It has been declared as critical. This vulnerability affects unknown code in… |
CVE-2023-28080 | Medium | 6.7 | 2023-05-30 | PowerPath for Windows, versions 7.0, 7.1 & 7.2 contains DLL Hijacking Vulnerabilities. A regular user (non-admin) can exploit these issues to potentially esca… |
CVE-2023-25005 | High | 7.8 | 2023-05-12 | A maliciously crafted DLL file can be forced to read beyond allocated boundaries in Autodesk InfraWorks 2023, and 2021 when parsing the DLL files could lead to… |
CVE-2023-25428 | High | 7.8 | 2023-05-12 | A DLL Hijacking issue discovered in Soft-o Free Password Manager 1.1.20 allows attackers to create arbitrary DLLs leading to code execution. |
CVE-2023-31197 | Medium | 6.7 | 2023-05-12 | Uncontrolled search path in the Intel(R) Trace Analyzer and Collector before version 2020 update 3 may allow an authenticated user to potentially enable escala… |
CVE-2023-27386 | Medium | 6.7 | 2023-05-10 | Uncontrolled search path in some Intel(R) Pathfinder for RISC-V software may allow an authenticated user to potentially enable escalation of privilege via loca… |
CVE-2023-27298 | High | 8.8 | 2023-05-10 | Uncontrolled search path in the WULT software maintained by Intel(R) before version 1.0.0 (commit id 592300b) may allow an unauthenticated user to potentially… |
CVE-2023-22355 | Medium | 6.7 | 2023-05-10 | Uncontrolled search path in some Intel(R) oneAPI Toolkit and component software installers before version 4.3.0.251 may allow an authenticated user to potentia… |
CVE-2022-43474 | Medium | 6.7 | 2023-05-10 | Uncontrolled search path for the DSP Builder software installer before version 22.4 for Intel(R) FPGAs Pro Edition may allow an authenticated user to potential… |
CVE-2022-41998 | Medium | 6.7 | 2023-05-10 | Uncontrolled search path in the Intel(R) DCM software before version 5.1 may allow an authenticated user to potentially enable escalation of privilege via loca… |
CVE-2022-41982 | Medium | 6.7 | 2023-05-10 | Uncontrolled search path element in the Intel(R) VTune(TM) Profiler software before version 2023.0 may allow an authenticated user to potentially enable escala… |
CVE-2022-41693 | Medium | 6.7 | 2023-05-10 | Uncontrolled search path in the Intel(R) Quartus(R) Prime Pro edition software before version 22.3 may allow an authenticated user to potentially enable escala… |
CVE-2022-41628 | Medium | 6.7 | 2023-05-10 | Uncontrolled search path element in the HotKey Services for some Intel(R) NUC P14E Laptop Element software for Windows 10 before version 1.1.44 may allow an au… |
CVE-2022-38101 | Medium | 6.7 | 2023-05-10 | Uncontrolled search path in some Intel(R) NUC Chaco Canyon BIOS update software before version iFlashV Windows 5.13.00.2105 may allow an authenticated user to… |
CVE-2022-34848 | Medium | 6.7 | 2023-05-10 | Uncontrolled search path for the Intel(R) NUC Pro Software Suite before version 2.0.0.3 may allow an authenticated user to potentially enable escalation of pri… |
CVE-2022-32576 | Medium | 6.7 | 2023-05-10 | Uncontrolled search path in the Intel(R) Unite(R) Plugin SDK before version 4.2 may allow an authenticated user to potentially enable escalation of privilege v… |
CVE-2022-27180 | Medium | 4.2 | 2023-05-10 | Uncontrolled search path in the Intel(R) MacCPUID software before version 3.2 may allow an authenticated user to potentially enable escalation of privilege via… |
CVE-2022-21162 | Medium | 6.7 | 2023-05-10 | Uncontrolled search path for the Intel(R) HDMI Firmware Update tool for NUC before version 1.79.1.1 may allow an authenticated user to potentially enable escal… |
CVE-2023-30237 | High | 7.8 | 2023-05-09 | CyberGhostVPN Windows Client before v8.3.10.10015 was discovered to contain a DLL injection vulnerability via the component Dashboard.exe. |
CVE-2023-2355 | High | 7.8 | 2023-04-27 | Local privilege escalation due to a DLL hijacking vulnerability. The following products are affected: Acronis Snap Deploy (Windows) before build 3900. |
CVE-2023-29012 | High | 7.2 | 2023-04-25 | Git for Windows is the Windows port of Git. Prior to version 2.40.1, any user of Git CMD who starts the command in an untrusted directory is impacted by an Unc… |
CVE-2023-29011 | High | 7.5 | 2023-04-25 | Git for Windows, the Windows port of Git, ships with an executable called `connect.exe`, which implements a SOCKS5 proxy that can be used to connect e.g. to SS… |
CVE-2022-34755 | Medium | 6.3 | 2023-04-18 | A CWE-427 - Uncontrolled Search Path Element vulnerability exists that could allow an attacker with a local privileged account to place a specially crafted fi… |
CVE-2023-28140 | Medium | 6.7 | 2023-04-18 | An Executable Hijacking condition exists in the Qualys Cloud Agent for Windows platform in versions before 4.5.3.1. Attackers may load a malicious copy of a D… |
CVE-2023-29187 | Medium | 6.7 | 2023-04-11 | A Windows user with basic user authorization can exploit a DLL hijacking attack in SapSetup (Software Installation Program) - version 9.0, resulting in a privi… |
CVE-2022-48224 | High | 7.3 | 2023-04-04 | An issue was discovered in Acuant AcuFill SDK before 10.22.02.03. It is installed with insecure permissions (full write access within Program Files). Standard… |
CVE-2022-48223 | Medium | 6.7 | 2023-04-04 | An issue was discovered in Acuant AcuFill SDK before 10.22.02.03. During SDK repair, certutil.exe is called by the Acuant installer to repair certificates. Thi… |
CVE-2022-48222 | High | 7.8 | 2023-04-04 | An issue was discovered in Acuant AcuFill SDK before 10.22.02.03. During SDK installation, certutil.exe is called by the Acuant installer to install certificat… |
CVE-2022-48225 | High | 7.3 | 2023-04-04 | An issue was discovered in Acuant AcuFill SDK before 10.22.02.03. It is used to install drivers from several different vendors. The Gemalto Document Reader chi… |
CVE-2023-1745 | Medium | 5.3 | 2023-03-30 | A vulnerability, which was classified as problematic, has been found in KMPlayer 4.2.2.73. This issue affects some unknown processing in the library SHFOLDER.d… |
CVE-2022-28688 | High | 7.8 | 2023-03-29 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of AVEVA Edge 2020 SP2 Patch 0(4201.2111.1802.0000). User intera… |
CVE-2022-28687 | High | 7.8 | 2023-03-29 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of AVEVA Edge 2020 SP2 Patch 0(4201.2111.1802.0000). User intera… |
CVE-2022-28686 | High | 7.8 | 2023-03-29 | This vulnerability allows remote attackers to execute arbitrary code on affected installations of AVEVA Edge 2020 SP2 Patch 0(4201.2111.1802.0000). User intera… |
CVE-2023-0213 | High | 8.8 | 2023-03-29 | Elevation of privilege issue in M-Files Installer versions before 22.6 on Windows allows user to gain SYSTEM privileges via DLL hijacking. |
CVE-2023-28596 | High | 7.8 | 2023-03-27 | Zoom Client for IT Admin macOS installers before version 5.13.5 contain a local privilege escalation vulnerability. A local low-privileged user could exploit t… |
CVE-2022-38745 | High | 7.8 | 2023-03-24 | Apache OpenOffice versions before 4.1.14 may be configured to add an empty entry to the Java class path. This may lead to run arbitrary Java code from the curr… |
CVE-2023-28759 | High | 7.8 | 2023-03-23 | An issue was discovered in Veritas NetBackup before 10.0 on Windows. A vulnerability in the way the client validates the path to a DLL prior to loading may all… |
CVE-2022-48422 | High | 7.8 | 2023-03-19 | ONLYOFFICE Docs through 7.3 on certain Linux distributions allows local users to gain privileges via a Trojan horse libgcc_s.so.1 in the current working direct… |
CVE-2021-31637 | High | 7.8 | 2023-03-16 | An issue found in UwAmp v.1.1, 1.2, 1.3, 2.0, 2.1, 2.2, 2.2.1, 3.0.0, 3.0.1, 3.0.2 allows a remote attacker to execute arbitrary code via a crafted DLL. |
CVE-2022-4313 | High | 8.8 | 2023-03-15 | A vulnerability was reported where through modifying the scan variables, an authenticated user in Tenable products, that has Scan Policy Configuration roles, c… |
CVE-2023-24578 | Medium | 5.5 | 2023-03-13 | McAfee Total Protection prior to 16.0.49 allows attackers to elevate user privileges due to DLL sideloading. This could enable a user with lower privileges to… |
CVE-2023-25147 | Medium | 6.7 | 2023-03-10 | An issue in the Trend Micro Apex One agent could allow an attacker who has previously acquired administrative rights via other means to bypass the protection b… |
CVE-2023-25143 | Critical | 9.8 | 2023-03-10 | An uncontrolled search path element vulnerability in the Trend Micro Apex One Server installer could allow an attacker to achieve a remote code execution state… |
CVE-2023-23554 | High | 8.8 | 2023-03-07 | Uncontrolled search path element vulnerability exists in pg_ivm versions prior to 1.5.1. When refreshing an IMMV, pg_ivm executes functions without specifying… |
CVE-2023-26266 | High | 7.3 | 2023-02-21 | In AFL++ 4.05c, the CmpLog component uses the current working directory to resolve and execute unprefixed fuzzing targets, allowing code execution. |
CVE-2022-32972 | High | 7.8 | 2023-02-17 | Infoblox BloxOne Endpoint for Windows through 2.2.7 allows DLL injection that can result in local privilege escalation. |
CVE-2022-41314 | Medium | 6.7 | 2023-02-16 | Uncontrolled search path in some Intel(R) Network Adapter installer software may allow an authenticated user to potentially enable escalation of privilege via… |
CVE-2022-37340 | Medium | 6.7 | 2023-02-16 | Uncontrolled search path in some Intel(R) QAT drivers for Windows before version 1.6 may allow an authenticated user to potentially enable escalation of privil… |
CVE-2022-37329 | Medium | 6.7 | 2023-02-16 | Uncontrolled search path in some Intel(R) Quartus(R) Prime Pro and Standard Edition software may allow an authenticated user to potentially enable escalation o… |
CVE-2022-36398 | Medium | 6.7 | 2023-02-16 | Uncontrolled search path in the Intel(R) Battery Life Diagnostic Tool software before version 2.2.0 may allow an authenticated user to potentially enable escal… |
CVE-2022-26512 | Medium | 6.7 | 2023-02-16 | Uncontrolled search path element in the Intel(R) FPGA Add-on for Intel(R) oneAPI Base Toolkit before version 2022.2 may allow an authenticated user to potentia… |
CVE-2022-26425 | Medium | 6.7 | 2023-02-16 | Uncontrolled search path element in the Intel(R) oneAPI Collective Communications Library (oneCCL) before version 2021.6 for Intel(R) oneAPI Base Toolkit may a… |
CVE-2022-26421 | Medium | 6.7 | 2023-02-16 | Uncontrolled search path element in the Intel(R) oneAPI DPC++/C++ Compiler Runtime before version 2022.0 may allow an authenticated user to potentially enable… |
CVE-2022-26345 | Medium | 6.7 | 2023-02-16 | Uncontrolled search path element in the Intel(R) oneAPI Toolkit OpenMP before version 2022.1 may allow an authenticated user to potentially enable escalation o… |
CVE-2022-26076 | Medium | 6.7 | 2023-02-16 | Uncontrolled search path element in the Intel(R) oneAPI Deep Neural Network (oneDNN) before version 2022.1 may allow an authenticated user to potentially enabl… |
CVE-2022-26062 | Medium | 6.7 | 2023-02-16 | Uncontrolled search path element in the Intel(R) Trace Analyzer and Collector before version 2021.6 for Intel(R) oneAPI HPC Toolkit may allow an authenticated… |
CVE-2022-26052 | Medium | 6.7 | 2023-02-16 | Uncontrolled search path element in the Intel(R) MPI Library before version 2021.6 for Intel(R) oneAPI HPC Toolkit may allow an authenticated user to potential… |
CVE-2022-26032 | Medium | 6.7 | 2023-02-16 | Uncontrolled search path element in the Intel(R) Distribution for Python programming language before version 2022.1 for Intel(R) oneAPI Toolkits may allow an a… |
CVE-2022-25905 | Medium | 6.7 | 2023-02-16 | Uncontrolled search path element in the Intel(R) oneAPI Data Analytics Library (oneDAL) before version 2021.5 for Intel(R) oneAPI Base Toolkit may allow an aut… |