CWE-427 · Uncontrolled Search Path Element (page 8)
Page 8 of 13 — CVEs classified under CWE-427, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-28759 | High | 7.8 | 2023-03-23 | An issue was discovered in Veritas NetBackup before 10.0 on Windows. A vulnerability in the way the client validates the path to a DLL prior to loading may all… |
CVE-2022-48422 | High | 7.8 | 2023-03-19 | ONLYOFFICE Docs through 7.3 on certain Linux distributions allows local users to gain privileges via a Trojan horse libgcc_s.so.1 in the current working direct… |
CVE-2021-31637 | High | 7.8 | 2023-03-16 | An issue found in UwAmp v.1.1, 1.2, 1.3, 2.0, 2.1, 2.2, 2.2.1, 3.0.0, 3.0.1, 3.0.2 allows a remote attacker to execute arbitrary code via a crafted DLL. |
CVE-2022-4313 | High | 8.8 | 2023-03-15 | A vulnerability was reported where through modifying the scan variables, an authenticated user in Tenable products, that has Scan Policy Configuration roles, c… |
CVE-2023-24578 | Medium | 5.5 | 2023-03-13 | McAfee Total Protection prior to 16.0.49 allows attackers to elevate user privileges due to DLL sideloading. This could enable a user with lower privileges to… |
CVE-2023-25147 | Medium | 6.7 | 2023-03-10 | An issue in the Trend Micro Apex One agent could allow an attacker who has previously acquired administrative rights via other means to bypass the protection b… |
CVE-2023-25143 | Critical | 9.8 | 2023-03-10 | An uncontrolled search path element vulnerability in the Trend Micro Apex One Server installer could allow an attacker to achieve a remote code execution state… |
CVE-2023-23554 | High | 8.8 | 2023-03-07 | Uncontrolled search path element vulnerability exists in pg_ivm versions prior to 1.5.1. When refreshing an IMMV, pg_ivm executes functions without specifying… |
CVE-2023-26266 | High | 7.3 | 2023-02-21 | In AFL++ 4.05c, the CmpLog component uses the current working directory to resolve and execute unprefixed fuzzing targets, allowing code execution. |
CVE-2022-32972 | High | 7.8 | 2023-02-17 | Infoblox BloxOne Endpoint for Windows through 2.2.7 allows DLL injection that can result in local privilege escalation. |
CVE-2022-41314 | Medium | 6.7 | 2023-02-16 | Uncontrolled search path in some Intel(R) Network Adapter installer software may allow an authenticated user to potentially enable escalation of privilege via… |
CVE-2022-37340 | Medium | 6.7 | 2023-02-16 | Uncontrolled search path in some Intel(R) QAT drivers for Windows before version 1.6 may allow an authenticated user to potentially enable escalation of privil… |
CVE-2022-37329 | Medium | 6.7 | 2023-02-16 | Uncontrolled search path in some Intel(R) Quartus(R) Prime Pro and Standard Edition software may allow an authenticated user to potentially enable escalation o… |
CVE-2022-36398 | Medium | 6.7 | 2023-02-16 | Uncontrolled search path in the Intel(R) Battery Life Diagnostic Tool software before version 2.2.0 may allow an authenticated user to potentially enable escal… |
CVE-2022-26512 | Medium | 6.7 | 2023-02-16 | Uncontrolled search path element in the Intel(R) FPGA Add-on for Intel(R) oneAPI Base Toolkit before version 2022.2 may allow an authenticated user to potentia… |
CVE-2022-26425 | Medium | 6.7 | 2023-02-16 | Uncontrolled search path element in the Intel(R) oneAPI Collective Communications Library (oneCCL) before version 2021.6 for Intel(R) oneAPI Base Toolkit may a… |
CVE-2022-26421 | Medium | 6.7 | 2023-02-16 | Uncontrolled search path element in the Intel(R) oneAPI DPC++/C++ Compiler Runtime before version 2022.0 may allow an authenticated user to potentially enable… |
CVE-2022-26345 | Medium | 6.7 | 2023-02-16 | Uncontrolled search path element in the Intel(R) oneAPI Toolkit OpenMP before version 2022.1 may allow an authenticated user to potentially enable escalation o… |
CVE-2022-26076 | Medium | 6.7 | 2023-02-16 | Uncontrolled search path element in the Intel(R) oneAPI Deep Neural Network (oneDNN) before version 2022.1 may allow an authenticated user to potentially enabl… |
CVE-2022-26062 | Medium | 6.7 | 2023-02-16 | Uncontrolled search path element in the Intel(R) Trace Analyzer and Collector before version 2021.6 for Intel(R) oneAPI HPC Toolkit may allow an authenticated… |
CVE-2022-26052 | Medium | 6.7 | 2023-02-16 | Uncontrolled search path element in the Intel(R) MPI Library before version 2021.6 for Intel(R) oneAPI HPC Toolkit may allow an authenticated user to potential… |
CVE-2022-26032 | Medium | 6.7 | 2023-02-16 | Uncontrolled search path element in the Intel(R) Distribution for Python programming language before version 2022.1 for Intel(R) oneAPI Toolkits may allow an a… |
CVE-2022-25905 | Medium | 6.7 | 2023-02-16 | Uncontrolled search path element in the Intel(R) oneAPI Data Analytics Library (oneDAL) before version 2021.5 for Intel(R) oneAPI Base Toolkit may allow an aut… |
CVE-2022-48077 | High | 7.8 | 2023-02-13 | Genymotion Desktop v3.3.2 was discovered to contain a DLL hijacking vulnerability that allows attackers to escalate privileges and execute arbitrary code via a… |
CVE-2022-43440 | High | 8.8 | 2023-02-09 | Uncontrolled Search Path Element in Checkmk Agent in Tribe29 Checkmk before 2.1.0p1, before 2.0.0p25 and before 1.6.0p29 on a Checkmk server allows the site us… |
CVE-2022-31611 | Medium | 6.8 | 2023-02-07 | NVIDIA GeForce Experience contains an uncontrolled search path vulnerability in all its client installers, where an attacker with user level privileges may ca… |
CVE-2022-38136 | Medium | 6.7 | 2023-02-06 | Uncontrolled search path in the Intel(R) oneAPI DPC++/C++ Compiler for Windows and Intel Fortran Compiler for Windows before version 2022.2.1 for some Intel(R)… |
CVE-2023-0400 | Medium | 5.9 | 2023-02-02 | The protection bypass vulnerability in DLP for Windows 11.9.x is addressed in version 11.10.0. This allowed a local user to bypass DLP controls when uploading… |
CVE-2023-22358 | High | 7.8 | 2023-02-01 | In versions beginning with 7.2.2 to before 7.2.3.1, a DLL hijacking vulnerability exists in the BIG-IP Edge Client Windows Installer. Note: Software versions… |
CVE-2023-22283 | Medium | 6.5 | 2023-02-01 | On versions beginning in 7.1.5 to before 7.2.3.1, a DLL hijacking vulnerability exists in the BIG-IP Edge Client for Windows. User interaction and administrati… |
CVE-2022-34396 | High | 7.0 | 2023-02-01 | Dell OpenManage Server Administrator (OMSA) version 10.3.0.0 and earlier contains a DLL Injection Vulnerability. A local low privileged authenticated attacker… |
CVE-2022-47632 | Medium | 6.8 | 2023-01-27 | Razer Synapse before 3.7.0830.081906 allows privilege escalation due to an unsafe installation path, improper privilege management, and improper certificate va… |
CVE-2022-41141 | High | 7.8 | 2023-01-26 | This vulnerability allows local attackers to escalate privileges on affected installations of Windscribe. An attacker must first obtain the ability to execute… |
CVE-2020-25502 | High | 7.8 | 2023-01-20 | Cybereason EDR version 19.1.282 and above, 19.2.182 and above, 20.1.343 and above, and 20.2.X and above has a DLL hijacking vulnerability, which could allow a… |
CVE-2023-0247 | High | 7.8 | 2023-01-12 | Uncontrolled Search Path Element in GitHub repository bits-and-blooms/bloom prior to 3.3.1. |
CVE-2023-22947 | High | 7.3 | 2023-01-11 | Insecure folder permissions in the Windows installation path of Shibboleth Service Provider (SP) before 3.4.1 allow an unprivileged local attacker to escalate… |
CVE-2022-36930 | High | 8.8 | 2023-01-09 | Zoom Rooms for Windows installers before version 5.13.0 contain a local privilege escalation vulnerability. A local low-privileged user could exploit this vuln… |
CVE-2022-44939 | High | 7.8 | 2023-01-06 | Efs Software Easy Chat Server Version 3.1 was discovered to contain a DLL hijacking vulnerability via the component TextShaping.dll. This vulnerability allows… |
CVE-2022-36314 | Medium | 5.5 | 2022-12-22 | When opening a Windows shortcut from the local filesystem, an attacker could supply a remote path that would lead to unexpected network requests from the opera… |
CVE-2022-22736 | High | 7.0 | 2022-12-22 | If Firefox was installed to a world-writable directory, a local privilege escalation could occur when Firefox searched the current directory for system librari… |
CVE-2021-36631 | Medium | 6.7 | 2022-12-22 | Untrusted search path vulnerability in Baidunetdisk Version 7.4.3 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified di… |
CVE-2022-46330 | High | 7.8 | 2022-12-21 | Squirrel.Windows is both a toolset and a library that provides installation and update functionality for Windows desktop applications. Installers generated by… |
CVE-2022-42945 | High | 7.8 | 2022-12-19 | DWG TrueViewTM 2023 version has a DLL Search Order Hijacking vulnerability. Successful exploitation by a malicious attacker could result in remote code executi… |
CVE-2022-43722 | High | 7.8 | 2022-12-13 | A vulnerability has been identified in SICAM PAS/PQS (All versions < V7.0). Affected software does not properly secure a folder containing library files. This… |
CVE-2022-29580 | High | 8.9 | 2022-12-13 | There exists a path traversal vulnerability in the Android Google Search app. This is caused by the incorrect usage of uri.getLastPathSegment. A symbolic encod… |
CVE-2022-38395 | High | 7.8 | 2022-12-12 | HP Support Assistant uses HP Performance Tune-up as a diagnostic tool. HP Support Assistant uses Fusion to launch HP Performance Tune-up. It is possible for an… |
CVE-2022-3859 | Medium | 6.7 | 2022-11-30 | An uncontrolled search path vulnerability exists in Trellix Agent (TA) for Windows in versions prior to 5.7.8. This allows an attacker with admin access, whic… |
CVE-2022-43751 | High | 7.8 | 2022-11-23 | McAfee Total Protection prior to version 16.0.49 contains an uncontrolled search path element vulnerability due to the use of a variable pointing to a subdirec… |
CVE-2022-40746 | High | 7.2 | 2022-11-21 | IBM i Access Family 1.1.2 through 1.1.4 and 1.1.4.3 through 1.1.9.0 could allow a local authenticated attacker to execute arbitrary code on the system, caused… |
CVE-2022-45422 | High | 7.8 | 2022-11-21 | When LG SmartShare is installed, local privilege escalation is possible through DLL Hijacking attack. The LG ID is LVE-HOT-220005. |
CVE-2022-31694 | High | 7.3 | 2022-11-18 | InstallBuilder Qt installers built with versions previous to 22.10 try to load DLLs from the installer binary parent directory when displaying popups. This may… |
CVE-2022-36924 | High | 8.8 | 2022-11-17 | The Zoom Rooms Installer for Windows prior to 5.12.6 contains a local privilege escalation vulnerability. A local low-privileged user could exploit this vulner… |
CVE-2022-28766 | Low | 3.3 | 2022-11-17 | Windows 32-bit versions of the Zoom Client for Meetings before 5.12.6 and Zoom Rooms for Conference Room before version 5.12.6 are susceptible to a DLL injecti… |
CVE-2022-36380 | Medium | 6.7 | 2022-11-11 | Uncontrolled search path in the installer software for some Intel(r) NUC Kit Wireless Adapter drivers for Windows 10 before version 22.40 may allow an authenti… |
CVE-2022-30548 | Medium | 6.7 | 2022-11-11 | Uncontrolled search path element in the Intel(R) Glorp software may allow an authenticated user to potentially enable escalation of privilege via local access. |
CVE-2022-27638 | Medium | 6.7 | 2022-11-11 | Uncontrolled search path element in the Intel(R) Advanced Link Analyzer Pro before version 22.2 and Standard edition software before version 22.1.1 STD may all… |
CVE-2022-27187 | Medium | 6.7 | 2022-11-11 | Uncontrolled search path element in the Intel(R) Quartus Prime Standard edition software before version 21.1 Patch 0.02std may allow an authenticated user to p… |
CVE-2022-26086 | Medium | 6.7 | 2022-11-11 | Uncontrolled search path element in the PresentMon software maintained by Intel(R) before version 1.7.1 may allow an authenticated user to potentially enable e… |
CVE-2022-26028 | Medium | 6.7 | 2022-11-11 | Uncontrolled search path in the Intel(R) VTune(TM) Profiler software before version 2022.2.0 may allow an authenticated user to potentially enable escalation o… |
CVE-2021-33064 | Medium | 6.7 | 2022-11-11 | Uncontrolled search path in the software installer for Intel(R) System Studio for all versions, may allow an authenticated user to potentially enable escalatio… |
CVE-2022-43310 | High | 7.8 | 2022-11-09 | An Uncontrolled Search Path Element in Foxit Software released Foxit Reader v11.2.118.51569 allows attackers to escalate privileges when searching for DLL libr… |
CVE-2022-34825 | Critical | 9.8 | 2022-11-08 | Uncontrolled Search Path Element in CLUSTERPRO X 5.0 for Windows and earlier, EXPRESSCLUSTER X 5.0 for Windows and earlier, CLUSTERPRO X 5.0 SingleServerSafe f… |
CVE-2022-44744 | High | 7.3 | 2022-11-07 | Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40… |
CVE-2022-39286 | High | 8.8 | 2022-10-26 | Jupyter Core is a package for the core common functionality of Jupyter projects. Jupyter Core prior to version 4.11.2 contains an arbitrary code execution vuln… |
CVE-2022-41796 | High | 7.8 | 2022-10-24 | Untrusted search path vulnerability in the installer of Content Transfer (for Windows) Ver.1.3 and prior allows an attacker to gain privileges via a Trojan hor… |
CVE-2022-33921 | High | 7.0 | 2022-10-12 | Dell GeoDrive, versions prior to 2.2, contains Multiple DLL Hijacking Vulnerabilities. A low privilege attacker could potentially exploit this vulnerability, l… |
CVE-2022-32168 | High | 7.8 | 2022-09-28 | Notepad++ versions 8.4.1 and before are vulnerable to DLL hijacking where an attacker can replace the vulnerable dll (UxTheme.dll) with his own dll and run arb… |
CVE-2022-40978 | High | 7.5 | 2022-09-19 | The installer of JetBrains IntelliJ IDEA before 2022.2.2 was vulnerable to EXE search order hijacking |
CVE-2022-2333 | High | 8.8 | 2022-09-16 | If an attacker manages to trick a valid user into loading a malicious DLL, the attacker may be able to achieve code execution in Honeywell SoftMaster version 4… |
CVE-2022-38633 | High | 7.8 | 2022-09-13 | Genymotion Desktop v3.2.1 was discovered to contain a DLL hijacking vulnerability which allows attackers to escalate privileges and execute arbitrary code via… |
CVE-2022-34101 | High | 7.8 | 2022-09-13 | A vulnerability was discovered in the Crestron AirMedia Windows Application, version 4.3.1.39, in which a user can place a malicious DLL in a certain path to e… |
CVE-2022-39846 | Medium | 6.2 | 2022-09-09 | DLL hijacking vulnerability in Smart Switch PC prior to version 4.3.22083_3 allows attacker to execute arbitrary code. |
CVE-2022-36271 | High | 7.8 | 2022-09-07 | Outbyte PC Repair Installation File 1.7.112.7856 is vulnerable to Dll Hijacking. iertutil.dll is missing so an attacker can use a malicious dll with same name… |
CVE-2022-2006 | High | 7.8 | 2022-08-31 | AutomationDirect DirectLOGIC has a DLL vulnerability in the install directory that may allow an attacker to execute code during the installation process. This… |
CVE-2022-28696 | High | 7.8 | 2022-08-18 | Uncontrolled search path in the Intel(R) Distribution for Python before version 2022.0.3 may allow an authenticated user to potentially enable escalation of pr… |
CVE-2022-26374 | High | 7.8 | 2022-08-18 | Uncontrolled search path in the installation binaries for Intel(R) SEAPI all versions may allow an authenticated user to potentially enable escalation of privi… |
CVE-2022-25999 | High | 7.8 | 2022-08-18 | Uncontrolled search path element in the Intel(R) Enpirion(R) Digital Power Configurator GUI software, all versions may allow an authenticated user to potential… |
CVE-2022-25841 | High | 7.8 | 2022-08-18 | Uncontrolled search path elements in the Intel(R) Datacenter Group Event Android application, all versions, may allow an authenticated user to potentially enab… |
CVE-2022-21807 | High | 7.8 | 2022-08-18 | Uncontrolled search path elements in the Intel(R) VTune(TM) Profiler software before version 2022.2.0 may allow an authenticated user to potentially enable esc… |
CVE-2022-2334 | High | 7.2 | 2022-08-17 | The application searches for a library dll that is not found. If an attacker can place a dll with this name, then the attacker can leverage it to execute arbit… |
CVE-2022-34235 | High | 7.8 | 2022-08-11 | Adobe Premiere Elements version 2020v20 (and earlier) is affected by an Uncontrolled Search Path Element which could lead to Privilege Escalation. An attacker… |
CVE-2022-36840 | Medium | 4.5 | 2022-08-05 | DLL hijacking vulnerability in Samsung Update Setup prior to version 2.2.9.50 allows attackers to execute arbitrary code. |
CVE-2021-38410 | High | 7.3 | 2022-07-27 | AVEVA Software Platform Common Services (PCS) Portal versions 4.5.2, 4.5.1, 4.5.0, and 4.4.6 are vulnerable to DLL hijacking through an uncontrolled search pat… |
CVE-2022-2313 | High | 8.2 | 2022-07-27 | A DLL hijacking vulnerability in the MA Smart Installer for Windows prior to 5.7.7, which allows local users to execute arbitrary code and obtain higher privil… |
CVE-2022-36415 | High | 7.8 | 2022-07-23 | A DLL hijacking vulnerability exists in the uninstaller in Scooter Beyond Compare 1.8a through 4.4.2 before 4.4.3 when installed via the EXE installer. The uni… |
CVE-2022-32498 | Medium | 5.5 | 2022-07-21 | Dell EMC PowerStore, Versions prior to v3.0.0.0 contain a DLL Hijacking vulnerability in PSTCLI. A local attacker can potentially exploit this vulnerability to… |
CVE-2022-34902 | High | 7.8 | 2022-07-18 | This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Access 6.5.4 (39316) Agent. An attacker must first obta… |
CVE-2022-34901 | High | 7.8 | 2022-07-18 | This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Access 6.5.4 (39316) Agent. An attacker must first obta… |
CVE-2022-34900 | High | 7.8 | 2022-07-18 | This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Access 6.5.3 (39313) Agent. An attacker must first obta… |
CVE-2021-42923 | High | 7.3 | 2022-07-18 | ShowMyPC 3606 on Windows suffers from a DLL hijack vulnerability. If an attacker overwrites the file %temp%\ShowMyPC\-ShowMyPC3606\wodVPN.dll, it will run any… |
CVE-2022-32223 | High | 7.3 | 2022-07-14 | Node.js is vulnerable to Hijack Execution Flow: DLL Hijacking under certain conditions on Windows platforms.This vulnerability can be exploited if the victim h… |
CVE-2022-32222 | Medium | 5.3 | 2022-07-14 | A cryptographic vulnerability exists on Node.js on linux in versions of 18.x prior to 18.40.0 which allowed a default path for openssl.cnf that might be access… |
CVE-2022-29187 | High | 7.8 | 2022-07-12 | Git is a distributed revision control system. Git prior to versions 2.37.1, 2.36.2, 2.35.4, 2.34.4, 2.33.4, 2.32.3, 2.31.4, and 2.30.5, is vulnerable to privil… |
CVE-2017-20123 | High | 8.8 | 2022-06-30 | A vulnerability was found in Viscosity 1.6.7. It has been classified as critical. This affects an unknown part of the component DLL Handler. The manipulation l… |
CVE-2022-33037 | High | 7.8 | 2022-06-29 | A binary hijack in Orwell-Dev-Cpp v5.11 allows attackers to execute arbitrary code via a crafted .exe file. |
CVE-2022-33036 | High | 7.8 | 2022-06-29 | A binary hijack in Embarcadero Dev-CPP v6.3 allows attackers to execute arbitrary code via a crafted .exe file. |
CVE-2022-33035 | High | 7.8 | 2022-06-29 | XLPD v7.0.0094 and below contains an unquoted service path vulnerability which allows local users to launch processes with elevated privileges. |
CVE-2022-1824 | High | 7.9 | 2022-06-20 | An uncontrolled search path vulnerability in McAfee Consumer Product Removal Tool prior to version 10.4.128 could allow a local attacker to perform a sideloadi… |
CVE-2017-20052 | Medium | 5.0 | 2022-06-16 | A vulnerability classified as problematic was found in Python 2.7.13. This vulnerability affects unknown code of the component pgAdmin4. The manipulation leads… |
CVE-2022-22788 | High | 7.1 | 2022-06-15 | The Zoom Opener installer is downloaded by a user from the Launch meeting page, when attempting to join a meeting without having the Zoom Meeting Client instal… |