CWE-427 · Uncontrolled Search Path Element (page 8)
Page 8 of 13 — CVEs classified under CWE-427, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-48077 | High | 7.8 | 2023-02-13 | Genymotion Desktop v3.3.2 was discovered to contain a DLL hijacking vulnerability that allows attackers to escalate privileges and execute arbitrary code via a… |
CVE-2022-43440 | High | 8.8 | 2023-02-09 | Uncontrolled Search Path Element in Checkmk Agent in Tribe29 Checkmk before 2.1.0p1, before 2.0.0p25 and before 1.6.0p29 on a Checkmk server allows the site us… |
CVE-2022-31611 | Medium | 6.8 | 2023-02-07 | NVIDIA GeForce Experience contains an uncontrolled search path vulnerability in all its client installers, where an attacker with user level privileges may ca… |
CVE-2022-38136 | Medium | 6.7 | 2023-02-06 | Uncontrolled search path in the Intel(R) oneAPI DPC++/C++ Compiler for Windows and Intel Fortran Compiler for Windows before version 2022.2.1 for some Intel(R)… |
CVE-2023-0400 | Medium | 5.9 | 2023-02-02 | The protection bypass vulnerability in DLP for Windows 11.9.x is addressed in version 11.10.0. This allowed a local user to bypass DLP controls when uploading… |
CVE-2023-22358 | High | 7.8 | 2023-02-01 | In versions beginning with 7.2.2 to before 7.2.3.1, a DLL hijacking vulnerability exists in the BIG-IP Edge Client Windows Installer. Note: Software versions… |
CVE-2023-22283 | Medium | 6.5 | 2023-02-01 | On versions beginning in 7.1.5 to before 7.2.3.1, a DLL hijacking vulnerability exists in the BIG-IP Edge Client for Windows. User interaction and administrati… |
CVE-2022-34396 | High | 7.0 | 2023-02-01 | Dell OpenManage Server Administrator (OMSA) version 10.3.0.0 and earlier contains a DLL Injection Vulnerability. A local low privileged authenticated attacker… |
CVE-2022-47632 | Medium | 6.8 | 2023-01-27 | Razer Synapse before 3.7.0830.081906 allows privilege escalation due to an unsafe installation path, improper privilege management, and improper certificate va… |
CVE-2022-41141 | High | 7.8 | 2023-01-26 | This vulnerability allows local attackers to escalate privileges on affected installations of Windscribe. An attacker must first obtain the ability to execute… |
CVE-2020-25502 | High | 7.8 | 2023-01-20 | Cybereason EDR version 19.1.282 and above, 19.2.182 and above, 20.1.343 and above, and 20.2.X and above has a DLL hijacking vulnerability, which could allow a… |
CVE-2023-0247 | High | 7.8 | 2023-01-12 | Uncontrolled Search Path Element in GitHub repository bits-and-blooms/bloom prior to 3.3.1. |
CVE-2023-22947 | High | 7.3 | 2023-01-11 | Insecure folder permissions in the Windows installation path of Shibboleth Service Provider (SP) before 3.4.1 allow an unprivileged local attacker to escalate… |
CVE-2022-36930 | High | 8.8 | 2023-01-09 | Zoom Rooms for Windows installers before version 5.13.0 contain a local privilege escalation vulnerability. A local low-privileged user could exploit this vuln… |
CVE-2022-44939 | High | 7.8 | 2023-01-06 | Efs Software Easy Chat Server Version 3.1 was discovered to contain a DLL hijacking vulnerability via the component TextShaping.dll. This vulnerability allows… |
CVE-2022-36314 | Medium | 5.5 | 2022-12-22 | When opening a Windows shortcut from the local filesystem, an attacker could supply a remote path that would lead to unexpected network requests from the opera… |
CVE-2022-22736 | High | 7.0 | 2022-12-22 | If Firefox was installed to a world-writable directory, a local privilege escalation could occur when Firefox searched the current directory for system librari… |
CVE-2021-36631 | Medium | 6.7 | 2022-12-22 | Untrusted search path vulnerability in Baidunetdisk Version 7.4.3 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified di… |
CVE-2022-46330 | High | 7.8 | 2022-12-21 | Squirrel.Windows is both a toolset and a library that provides installation and update functionality for Windows desktop applications. Installers generated by… |
CVE-2022-42945 | High | 7.8 | 2022-12-19 | DWG TrueViewTM 2023 version has a DLL Search Order Hijacking vulnerability. Successful exploitation by a malicious attacker could result in remote code executi… |
CVE-2022-43722 | High | 7.8 | 2022-12-13 | A vulnerability has been identified in SICAM PAS/PQS (All versions < V7.0). Affected software does not properly secure a folder containing library files. This… |
CVE-2022-29580 | High | 8.9 | 2022-12-13 | There exists a path traversal vulnerability in the Android Google Search app. This is caused by the incorrect usage of uri.getLastPathSegment. A symbolic encod… |
CVE-2022-38395 | High | 7.8 | 2022-12-12 | HP Support Assistant uses HP Performance Tune-up as a diagnostic tool. HP Support Assistant uses Fusion to launch HP Performance Tune-up. It is possible for an… |
CVE-2022-3859 | Medium | 6.7 | 2022-11-30 | An uncontrolled search path vulnerability exists in Trellix Agent (TA) for Windows in versions prior to 5.7.8. This allows an attacker with admin access, whic… |
CVE-2022-43751 | High | 7.8 | 2022-11-23 | McAfee Total Protection prior to version 16.0.49 contains an uncontrolled search path element vulnerability due to the use of a variable pointing to a subdirec… |
CVE-2022-40746 | High | 7.2 | 2022-11-21 | IBM i Access Family 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.0 could allow a local authenticated attacker to execute arbitrary code on the system, caused… |
CVE-2022-45422 | High | 7.8 | 2022-11-21 | When LG SmartShare is installed, local privilege escalation is possible through DLL Hijacking attack. The LG ID is LVE-HOT-220005. |
CVE-2022-31694 | High | 7.3 | 2022-11-18 | InstallBuilder Qt installers built with versions previous to 22.10 try to load DLLs from the installer binary parent directory when displaying popups. This may… |
CVE-2022-36924 | High | 8.8 | 2022-11-17 | The Zoom Rooms Installer for Windows prior to 5.12.6 contains a local privilege escalation vulnerability. A local low-privileged user could exploit this vulner… |
CVE-2022-28766 | Low | 3.3 | 2022-11-17 | Windows 32-bit versions of the Zoom Client for Meetings before 5.12.6 and Zoom Rooms for Conference Room before version 5.12.6 are susceptible to a DLL injecti… |
CVE-2022-36380 | Medium | 6.7 | 2022-11-11 | Uncontrolled search path in the installer software for some Intel(r) NUC Kit Wireless Adapter drivers for Windows 10 before version 22.40 may allow an authenti… |
CVE-2022-30548 | Medium | 6.7 | 2022-11-11 | Uncontrolled search path element in the Intel(R) Glorp software may allow an authenticated user to potentially enable escalation of privilege via local access. |
CVE-2022-27638 | Medium | 6.7 | 2022-11-11 | Uncontrolled search path element in the Intel(R) Advanced Link Analyzer Pro before version 22.2 and Standard edition software before version 22.1.1 STD may all… |
CVE-2022-27187 | Medium | 6.7 | 2022-11-11 | Uncontrolled search path element in the Intel(R) Quartus Prime Standard edition software before version 21.1 Patch 0.02std may allow an authenticated user to p… |
CVE-2022-26086 | Medium | 6.7 | 2022-11-11 | Uncontrolled search path element in the PresentMon software maintained by Intel(R) before version 1.7.1 may allow an authenticated user to potentially enable e… |
CVE-2022-26028 | Medium | 6.7 | 2022-11-11 | Uncontrolled search path in the Intel(R) VTune(TM) Profiler software before version 2022.2.0 may allow an authenticated user to potentially enable escalation o… |
CVE-2021-33064 | Medium | 6.7 | 2022-11-11 | Uncontrolled search path in the software installer for Intel(R) System Studio for all versions, may allow an authenticated user to potentially enable escalatio… |
CVE-2022-43310 | High | 7.8 | 2022-11-09 | An Uncontrolled Search Path Element in Foxit Software released Foxit Reader v11.2.118.51569 allows attackers to escalate privileges when searching for DLL libr… |
CVE-2022-34825 | Critical | 9.8 | 2022-11-08 | Uncontrolled Search Path Element in CLUSTERPRO X 5.0 for Windows and earlier, EXPRESSCLUSTER X 5.0 for Windows and earlier, CLUSTERPRO X 5.0 SingleServerSafe f… |
CVE-2022-44744 | High | 7.3 | 2022-11-07 | Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40… |
CVE-2022-39286 | High | 8.8 | 2022-10-26 | Jupyter Core is a package for the core common functionality of Jupyter projects. Jupyter Core prior to version 4.11.2 contains an arbitrary code execution vuln… |
CVE-2022-41796 | High | 7.8 | 2022-10-24 | Untrusted search path vulnerability in the installer of Content Transfer (for Windows) Ver.1.3 and prior allows an attacker to gain privileges via a Trojan hor… |
CVE-2022-33921 | High | 7.0 | 2022-10-12 | Dell GeoDrive, versions prior to 2.2, contains Multiple DLL Hijacking Vulnerabilities. A low privilege attacker could potentially exploit this vulnerability, l… |
CVE-2022-32168 | High | 7.8 | 2022-09-28 | Notepad++ versions 8.4.1 and before are vulnerable to DLL hijacking where an attacker can replace the vulnerable dll (UxTheme.dll) with his own dll and run arb… |
CVE-2022-40978 | High | 7.5 | 2022-09-19 | The installer of JetBrains IntelliJ IDEA before 2022.2.2 was vulnerable to EXE search order hijacking |
CVE-2022-2333 | High | 8.8 | 2022-09-16 | If an attacker manages to trick a valid user into loading a malicious DLL, the attacker may be able to achieve code execution in Honeywell SoftMaster version 4… |
CVE-2022-38633 | High | 7.8 | 2022-09-13 | Genymotion Desktop v3.2.1 was discovered to contain a DLL hijacking vulnerability which allows attackers to escalate privileges and execute arbitrary code via… |
CVE-2022-34101 | High | 7.8 | 2022-09-13 | A vulnerability was discovered in the Crestron AirMedia Windows Application, version 4.3.1.39, in which a user can place a malicious DLL in a certain path to e… |
CVE-2022-39846 | Medium | 6.2 | 2022-09-09 | DLL hijacking vulnerability in Smart Switch PC prior to version 4.3.22083_3 allows attacker to execute arbitrary code. |
CVE-2022-36271 | High | 7.8 | 2022-09-07 | Outbyte PC Repair Installation File 1.7.112.7856 is vulnerable to Dll Hijacking. iertutil.dll is missing so an attacker can use a malicious dll with same name… |
CVE-2022-2006 | High | 7.8 | 2022-08-31 | AutomationDirect DirectLOGIC has a DLL vulnerability in the install directory that may allow an attacker to execute code during the installation process. This… |
CVE-2022-28696 | High | 7.8 | 2022-08-18 | Uncontrolled search path in the Intel(R) Distribution for Python before version 2022.0.3 may allow an authenticated user to potentially enable escalation of pr… |
CVE-2022-26374 | High | 7.8 | 2022-08-18 | Uncontrolled search path in the installation binaries for Intel(R) SEAPI all versions may allow an authenticated user to potentially enable escalation of privi… |
CVE-2022-25999 | High | 7.8 | 2022-08-18 | Uncontrolled search path element in the Intel(R) Enpirion(R) Digital Power Configurator GUI software, all versions may allow an authenticated user to potential… |
CVE-2022-25841 | High | 7.8 | 2022-08-18 | Uncontrolled search path elements in the Intel(R) Datacenter Group Event Android application, all versions, may allow an authenticated user to potentially enab… |
CVE-2022-21807 | High | 7.8 | 2022-08-18 | Uncontrolled search path elements in the Intel(R) VTune(TM) Profiler software before version 2022.2.0 may allow an authenticated user to potentially enable esc… |
CVE-2022-2334 | High | 7.2 | 2022-08-17 | The application searches for a library dll that is not found. If an attacker can place a dll with this name, then the attacker can leverage it to execute arbit… |
CVE-2022-34235 | High | 7.8 | 2022-08-11 | Adobe Premiere Elements version 2020v20 (and earlier) is affected by an Uncontrolled Search Path Element which could lead to Privilege Escalation. An attacker… |
CVE-2022-36840 | Medium | 4.5 | 2022-08-05 | DLL hijacking vulnerability in Samsung Update Setup prior to version 2.2.9.50 allows attackers to execute arbitrary code. |
CVE-2021-38410 | High | 7.3 | 2022-07-27 | AVEVA Software Platform Common Services (PCS) Portal versions 4.5.2, 4.5.1, 4.5.0, and 4.4.6 are vulnerable to DLL hijacking through an uncontrolled search pat… |
CVE-2022-2313 | High | 8.2 | 2022-07-27 | A DLL hijacking vulnerability in the MA Smart Installer for Windows prior to 5.7.7, which allows local users to execute arbitrary code and obtain higher privil… |
CVE-2022-36415 | High | 7.8 | 2022-07-23 | A DLL hijacking vulnerability exists in the uninstaller in Scooter Beyond Compare 1.8a through 4.4.2 before 4.4.3 when installed via the EXE installer. The uni… |
CVE-2022-32498 | Medium | 5.5 | 2022-07-21 | Dell EMC PowerStore, Versions prior to v3.0.0.0 contain a DLL Hijacking vulnerability in PSTCLI. A local attacker can potentially exploit this vulnerability to… |
CVE-2022-34902 | High | 7.8 | 2022-07-18 | This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Access 6.5.4 (39316) Agent. An attacker must first obta… |
CVE-2022-34901 | High | 7.8 | 2022-07-18 | This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Access 6.5.4 (39316) Agent. An attacker must first obta… |
CVE-2022-34900 | High | 7.8 | 2022-07-18 | This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Access 6.5.3 (39313) Agent. An attacker must first obta… |
CVE-2021-42923 | High | 7.3 | 2022-07-18 | ShowMyPC 3606 on Windows suffers from a DLL hijack vulnerability. If an attacker overwrites the file %temp%\ShowMyPC\-ShowMyPC3606\wodVPN.dll, it will run any… |
CVE-2022-32223 | High | 7.3 | 2022-07-14 | Node.js is vulnerable to Hijack Execution Flow: DLL Hijacking under certain conditions on Windows platforms.This vulnerability can be exploited if the victim h… |
CVE-2022-32222 | Medium | 5.3 | 2022-07-14 | A cryptographic vulnerability exists on Node.js on linux in versions of 18.x prior to 18.40.0 which allowed a default path for openssl.cnf that might be access… |
CVE-2022-29187 | High | 7.8 | 2022-07-12 | Git is a distributed revision control system. Git prior to versions 2.37.1, 2.36.2, 2.35.4, 2.34.4, 2.33.4, 2.32.3, 2.31.4, and 2.30.5, is vulnerable to privil… |
CVE-2017-20123 | High | 8.8 | 2022-06-30 | A vulnerability was found in Viscosity 1.6.7. It has been classified as critical. This affects an unknown part of the component DLL Handler. The manipulation l… |
CVE-2022-33037 | High | 7.8 | 2022-06-29 | A binary hijack in Orwell-Dev-Cpp v5.11 allows attackers to execute arbitrary code via a crafted .exe file. |
CVE-2022-33036 | High | 7.8 | 2022-06-29 | A binary hijack in Embarcadero Dev-CPP v6.3 allows attackers to execute arbitrary code via a crafted .exe file. |
CVE-2022-33035 | High | 7.8 | 2022-06-29 | XLPD v7.0.0094 and below contains an unquoted service path vulnerability which allows local users to launch processes with elevated privileges. |
CVE-2022-1824 | High | 7.9 | 2022-06-20 | An uncontrolled search path vulnerability in McAfee Consumer Product Removal Tool prior to version 10.4.128 could allow a local attacker to perform a sideloadi… |
CVE-2017-20052 | Medium | 5.0 | 2022-06-16 | A vulnerability classified as problematic was found in Python 2.7.13. This vulnerability affects unknown code of the component pgAdmin4. The manipulation leads… |
CVE-2017-20051 | Medium | 6.3 | 2022-06-16 | A vulnerability was found in InnoSetup Installer. It has been declared as problematic. Affected by this vulnerability is an unknown functionality. The manipula… |
CVE-2022-22788 | High | 7.1 | 2022-06-15 | The Zoom Opener installer is downloaded by a user from the Launch meeting page, when attempting to join a meeting without having the Zoom Meeting Client instal… |
CVE-2022-24077 | High | 7.8 | 2022-06-13 | Naver Cloud Explorer Beta allows the attacker to execute arbitrary code as System privilege via malicious DLL injection. |
CVE-2022-29092 | High | 7.8 | 2022-06-10 | Dell SupportAssist Client Consumer versions (3.11.0 and versions prior) and Dell SupportAssist Client Commercial versions (3.2.0 and versions prior) contain a… |
CVE-2017-20018 | Medium | 6.3 | 2022-06-09 | A vulnerability was found in XAMPP 7.1.1-0-VC14. It has been classified as problematic. Affected is an unknown function of the component Installer. The manipul… |
CVE-2022-30744 | Medium | 6.2 | 2022-06-07 | DLL hijacking vulnerability in KiesWrapper in Samsung Kies prior to version 2.6.4.22043_1 allows attacker to execute arbitrary code. |
CVE-2022-30701 | High | 7.8 | 2022-05-27 | An uncontrolled search path element vulnerability in Trend Micro Apex One and Apex One as a Service could allow a local attacker to craft a special configurati… |
CVE-2022-28394 | High | 7.8 | 2022-05-27 | EOL Product CVE - Installer of Trend Micro Password Manager (Consumer) versions 3.7.0.1223 and below provided by Trend Micro Incorporated contains an issue wit… |
CVE-2022-23050 | High | 7.2 | 2022-05-24 | ManageEngine AppManager15 (Build No:15510) allows an authenticated admin user to upload a DLL file to perform a DLL hijack attack inside the 'working' folder t… |
CVE-2022-31467 | High | 7.9 | 2022-05-23 | A DLL hijacking vulnerability in the installed for Quick Heal Total Security prior to 12.1.1.27 allows a local attacker to achieve privilege escalation, leadin… |
CVE-2022-28965 | Medium | 6.5 | 2022-05-20 | Multiple DLL hijacking vulnerabilities via the components instup.exe and wsc_proxy.exe in Avast Premium Security before v21.11.2500 allows attackers to execute… |
CVE-2022-30697 | High | 7.8 | 2022-05-16 | Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Snap Deploy (Windows) before build 3640 |
CVE-2022-30696 | High | 7.8 | 2022-05-16 | Local privilege escalation due to a DLL hijacking vulnerability. The following products are affected: Acronis Snap Deploy (Windows) before build 3640 |
CVE-2022-22139 | High | 7.3 | 2022-05-12 | Uncontrolled search path in the Intel(R) XTU software before version 7.3.0.33 may allow an authenticated user to potentially enable escalation of privilege via… |
CVE-2022-28247 | Medium | 6.7 | 2022-05-11 | Acrobat Reader DC version 22.001.2011x (and earlier), 20.005.3033x (and earlier) and 17.012.3022x (and earlier) are affected by an uncontrolled search path vul… |
CVE-2022-0025 | Medium | 6.7 | 2022-05-11 | A local privilege escalation (PE) vulnerability exists in Palo Alto Networks Cortex XDR agent software on Windows that enables an authenticated local user with… |
CVE-2021-34606 | High | 7.3 | 2022-05-11 | A vulnerability exists in XINJE XD/E Series PLC Program Tool in versions up to v3.5.1 that can allow an authenticated, local attacker to load a malicious DLL… |
CVE-2021-42743 | High | 8.8 | 2022-05-06 | A misconfiguration in the node default path allows for local privilege escalation from a lower privileged user to the Splunk user in Splunk Enterprise versions… |
CVE-2022-28714 | High | 7.3 | 2022-05-05 | On F5 BIG-IP APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and… |
CVE-2021-20051 | High | 7.8 | 2022-05-04 | SonicWall Global VPN Client 4.10.7.1117 installer (32-bit and 64-bit) and earlier versions have a DLL Search Order Hijacking vulnerability in one of the instal… |
CVE-2022-28792 | Medium | 6.2 | 2022-05-03 | DLL hijacking vulnerability in Gear IconX PC Manager prior to version 2.1.220405.51 allows attacker to execute arbitrary code. The patch adds proper absolute p… |
CVE-2022-0192 | High | 7.3 | 2022-04-22 | A DLL search path vulnerability was reported in Lenovo PCManager prior to version 4.0.40.2175 that could allow privilege escalation. |
CVE-2022-24767 | High | 7.8 | 2022-04-12 | GitHub: Git for Windows' uninstaller vulnerable to DLL hijacking when run under the SYSTEM user account. |
CVE-2022-24765 | Medium | 6.0 | 2022-04-12 | Git for Windows is a fork of Git containing Windows-specific patches. This vulnerability affects users working on multi-user machines, where untrusted parties… |