CWE-427 · Uncontrolled Search Path Element (page 9)
Page 9 of 13 — CVEs classified under CWE-427, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-24077 | High | 7.8 | 2022-06-13 | Naver Cloud Explorer Beta allows the attacker to execute arbitrary code as System privilege via malicious DLL injection. |
CVE-2022-29092 | High | 7.8 | 2022-06-10 | Dell SupportAssist Client Consumer versions (3.11.0 and versions prior) and Dell SupportAssist Client Commercial versions (3.2.0 and versions prior) contain a… |
CVE-2017-20018 | Medium | 6.3 | 2022-06-09 | A vulnerability was found in XAMPP 7.1.1-0-VC14. It has been classified as problematic. Affected is an unknown function of the component Installer. The manipul… |
CVE-2022-30744 | Medium | 6.2 | 2022-06-07 | DLL hijacking vulnerability in KiesWrapper in Samsung Kies prior to version 2.6.4.22043_1 allows attacker to execute arbitrary code. |
CVE-2022-30701 | High | 7.8 | 2022-05-27 | An uncontrolled search path element vulnerability in Trend Micro Apex One and Apex One as a Service could allow a local attacker to craft a special configurati… |
CVE-2022-28394 | High | 7.8 | 2022-05-27 | EOL Product CVE - Installer of Trend Micro Password Manager (Consumer) versions 3.7.0.1223 and below provided by Trend Micro Incorporated contains an issue wit… |
CVE-2022-23050 | High | 7.2 | 2022-05-24 | ManageEngine AppManager15 (Build No:15510) allows an authenticated admin user to upload a DLL file to perform a DLL hijack attack inside the 'working' folder t… |
CVE-2022-31467 | High | 7.9 | 2022-05-23 | A DLL hijacking vulnerability in the installed for Quick Heal Total Security prior to 12.1.1.27 allows a local attacker to achieve privilege escalation, leadin… |
CVE-2022-28965 | Medium | 6.5 | 2022-05-20 | Multiple DLL hijacking vulnerabilities via the components instup.exe and wsc_proxy.exe in Avast Premium Security before v21.11.2500 allows attackers to execute… |
CVE-2022-30697 | High | 7.8 | 2022-05-16 | Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis Snap Deploy (Windows) before build 3640 |
CVE-2022-30696 | High | 7.8 | 2022-05-16 | Local privilege escalation due to a DLL hijacking vulnerability. The following products are affected: Acronis Snap Deploy (Windows) before build 3640 |
CVE-2022-22139 | High | 7.3 | 2022-05-12 | Uncontrolled search path in the Intel(R) XTU software before version 7.3.0.33 may allow an authenticated user to potentially enable escalation of privilege via… |
CVE-2022-28247 | Medium | 6.7 | 2022-05-11 | Acrobat Reader DC version 22.001.2011x (and earlier), 20.005.3033x (and earlier) and 17.012.3022x (and earlier) are affected by an uncontrolled search path vul… |
CVE-2022-0025 | Medium | 6.7 | 2022-05-11 | A local privilege escalation (PE) vulnerability exists in Palo Alto Networks Cortex XDR agent software on Windows that enables an authenticated local user with… |
CVE-2021-34606 | High | 7.3 | 2022-05-11 | A vulnerability exists in XINJE XD/E Series PLC Program Tool in versions up to v3.5.1 that can allow an authenticated, local attacker to load a malicious DLL… |
CVE-2021-42743 | High | 8.8 | 2022-05-06 | A misconfiguration in the node default path allows for local privilege escalation from a lower privileged user to the Splunk user in Splunk Enterprise versions… |
CVE-2022-28714 | High | 7.3 | 2022-05-05 | On F5 BIG-IP APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13.1.x versions prior to 13.1.5, and… |
CVE-2021-20051 | High | 7.8 | 2022-05-04 | SonicWall Global VPN Client 4.10.7.1117 installer (32-bit and 64-bit) and earlier versions have a DLL Search Order Hijacking vulnerability in one of the instal… |
CVE-2022-28792 | Medium | 6.2 | 2022-05-03 | DLL hijacking vulnerability in Gear IconX PC Manager prior to version 2.1.220405.51 allows attacker to execute arbitrary code. The patch adds proper absolute p… |
CVE-2022-0192 | High | 7.3 | 2022-04-22 | A DLL search path vulnerability was reported in Lenovo PCManager prior to version 4.0.40.2175 that could allow privilege escalation. |
CVE-2022-24767 | High | 7.8 | 2022-04-12 | GitHub: Git for Windows' uninstaller vulnerable to DLL hijacking when run under the SYSTEM user account. |
CVE-2022-24765 | Medium | 6.0 | 2022-04-12 | Git for Windows is a fork of Git containing Windows-specific patches. This vulnerability affects users working on multi-user machines, where untrusted parties… |
CVE-2022-23449 | High | 7.3 | 2022-04-12 | A vulnerability has been identified in SIMATIC Energy Manager Basic (All versions < V7.3 Update 1), SIMATIC Energy Manager PRO (All versions < V7.3 Update 1)… |
CVE-2022-28779 | Medium | 5.3 | 2022-04-11 | Uncontrolled search path element vulnerability in Samsung Android USB Driver windows installer program prior to version 1.7.50 allows attacker to execute arbit… |
CVE-2022-28541 | Medium | 5.9 | 2022-04-11 | Uncontrolled search path element vulnerability in Samsung Update prior to version 3.0.77.0 allows attackers to execute arbitrary code as Samsung Update permiss… |
CVE-2022-27843 | Medium | 6.2 | 2022-04-11 | DLL hijacking vulnerability in Kies prior to version 2.6.4.22014_2 allows attacker to execute abitrary code. |
CVE-2022-27842 | Medium | 6.2 | 2022-04-11 | DLL hijacking vulnerability in Smart Switch PC prior to version 4.2.22022_4 allows attacker to execute abitrary code. |
CVE-2022-25154 | High | 7.3 | 2022-04-05 | A DLL hijacking vulnerability in Samsung portable SSD T5 PC software before 1.6.9 could allow a local attacker to escalate privileges. (An attacker must alread… |
CVE-2022-1098 | High | 7.8 | 2022-04-01 | Delta Electronics DIAEnergie (all versions prior to 1.8.02.004) are vulnerable to a DLL hijacking condition. When combined with the Incorrect Default Permissio… |
CVE-2022-24426 | High | 7.8 | 2022-04-01 | Dell Command | Update, Dell Update, and Alienware Update version 4.4.0 contains a Local Privilege Escalation Vulnerability in the Advanced Driver Restore compo… |
CVE-2022-28128 | High | 7.8 | 2022-03-31 | Untrusted search path vulnerability in AttacheCase ver.3.6.1.0 and earlier allows an attacker to gain privileges and execute arbitrary code via a Trojan horse… |
CVE-2022-25348 | High | 7.8 | 2022-03-31 | Untrusted search path vulnerability in AttacheCase ver.4.0.2.7 and earlier allows an attacker to gain privileges and execute arbitrary code via a Trojan horse… |
CVE-2022-22996 | High | 7.8 | 2022-03-30 | The G-RAID 4/8 Software Utility setups for Windows were affected by a DLL hijacking vulnerability. Successful exploitation could lead to arbitrary code executi… |
CVE-2021-44226 | High | 7.3 | 2022-03-23 | Razer Synapse before 3.7.0228.022817 allows privilege escalation because it relies on %PROGRAMDATA%\Razer\Synapse3\Service\bin even if %PROGRAMDATA%\Razer has… |
CVE-2020-25182 | Medium | 6.7 | 2022-03-18 | Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x searches for and loads DLLs as dynamic libraries. Uncontrolled loading of dynamic libraries could allo… |
CVE-2022-26511 | High | 7.8 | 2022-03-17 | WPS Presentation 11.8.0.5745 insecurely load d3dx9_41.dll when opening .pps files('current directory type' DLL loading). |
CVE-2022-26081 | High | 7.8 | 2022-03-17 | The installer of WPS Office Version 10.8.0.5745 insecurely load shcore.dll, allowing an attacker to execute arbitrary code with the privilege of the user invok… |
CVE-2022-25969 | High | 7.8 | 2022-03-17 | The installer of WPS Office Version 10.8.0.6186 insecurely load VERSION.DLL (or some other DLLs), allowing an attacker to execute arbitrary code with the privi… |
CVE-2022-20001 | High | 7.8 | 2022-03-14 | fish is a command line shell. fish version 3.1.0 through version 3.3.1 is vulnerable to arbitrary code execution. git repositories can contain per-repository c… |
CVE-2022-23401 | High | 7.8 | 2022-03-11 | The following Yokogawa Electric products contain insecure DLL loading issues. CENTUM CS 3000 versions from R3.08.10 to R3.09.00, CENTUM VP versions from R4.01… |
CVE-2022-26337 | High | 7.8 | 2022-03-08 | Trend Micro Password Manager (Consumer) installer version 5.0.0.1262 and below is vulnerable to an Uncontrolled Search Path Element vulnerability that could al… |
CVE-2022-26319 | Medium | 6.5 | 2022-03-08 | An installer search patch element vulnerability in Trend Micro Portable Security 3.0 Pro, 3.0 and 2.0 could allow a local attacker to place an arbitrarily gene… |
CVE-2022-22943 | Medium | 6.7 | 2022-03-03 | VMware Tools for Windows (11.x.y and 10.x.y prior to 12.0.0) contains an uncontrolled search path vulnerability. A malicious actor with local administrative pr… |
CVE-2022-23202 | High | 7.0 | 2022-02-16 | Adobe Creative Cloud Desktop version 2.7.0.13 (and earlier) is affected by an Uncontrolled Search Path Element vulnerability that could result in arbitrary cod… |
CVE-2021-43940 | High | 7.8 | 2022-02-15 | Affected versions of Atlassian Confluence Server and Data Center allow authenticated local attackers to achieve elevated privileges on the local system via a D… |
CVE-2022-23410 | High | 7.8 | 2022-02-14 | AXIS IP Utility before 4.18.0 allows for remote code execution and local privilege escalation by the means of DLL hijacking. IPUtility.exe would attempt to loa… |
CVE-2022-23853 | High | 7.8 | 2022-02-11 | The LSP (Language Server Protocol) plugin in KDE Kate before 21.12.2 and KTextEditor before 5.91.0 tries to execute the associated LSP server binary when openi… |
CVE-2022-0483 | High | 7.8 | 2022-02-11 | Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis VSS Doctor (Windows) before build 53 |
CVE-2022-24955 | Critical | 9.8 | 2022-02-11 | Foxit PDF Reader before 11.2.1 and Foxit PDF Editor before 11.2.1 have an Uncontrolled Search Path Element for DLL files. |
CVE-2022-22528 | High | 7.8 | 2022-02-09 | SAP Adaptive Server Enterprise (ASE) - version 16.0, installation makes an entry in the system PATH environment variable in Windows platform which, under certa… |
CVE-2021-33101 | High | 7.8 | 2022-02-09 | Uncontrolled search path in the Intel(R) GPA software before version 21.2 may allow an authenticated user to potentially enable escalation of privilege via loc… |
CVE-2021-0169 | Medium | 6.7 | 2022-02-09 | Uncontrolled Search Path Element in software for Intel(R) PROSet/Wireless Wi-Fi in Windows 10 and 11 may allow a privileged user to potentially enable escalati… |
CVE-2021-44206 | High | 7.3 | 2022-02-04 | Local privilege escalation due to DLL hijacking vulnerability in Acronis Media Builder service. The following products are affected: Acronis Cyber Protect Home… |
CVE-2021-44205 | High | 7.3 | 2022-02-04 | Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 39… |
CVE-2020-12891 | High | 7.8 | 2022-02-04 | AMD Radeon Software may be vulnerable to DLL Hijacking through path variable. An unprivileged user may be able to drop its malicious DLL file in any location w… |
CVE-2021-44463 | High | 8.1 | 2022-01-28 | Missing DLLs, if replaced by an insider, could allow an attacker to achieve local privilege escalation on the DeltaV Distributed Control System Controllers and… |
CVE-2022-0166 | High | 7.8 | 2022-01-19 | A privilege escalation vulnerability in the McAfee Agent prior to 5.7.5. McAfee Agent uses openssl.cnf during the build process to specify the OPENSSLDIR varia… |
CVE-2022-0015 | High | 7.8 | 2022-01-12 | A local privilege escalation (PE) vulnerability exists in the Palo Alto Networks Cortex XDR agent that enables an authenticated local user to execute programs… |
CVE-2022-0129 | High | 7.4 | 2022-01-11 | Uncontrolled search path element vulnerability in McAfee TechCheck prior to 4.0.0.2 allows a local administrator to load their own Dynamic Link Library (DLL) g… |
CVE-2022-21668 | High | 8.0 | 2022-01-10 | pipenv is a Python development workflow tool. Starting with version 2018.10.9 and prior to version 2022.1.8, a flaw in pipenv's parsing of requirements files a… |
CVE-2021-30360 | High | 7.8 | 2022-01-10 | Users have access to the directory where the installation repair occurs. Since the MS Installer allows regular users to run the repair, an attacker can initiat… |
CVE-2021-4007 | High | 7.8 | 2021-12-14 | Rapid7 Insight Agent, versions 3.0.1 to 3.1.2.34, suffer from a local privilege escalation due to an uncontrolled DLL search path. Specifically, when Insight A… |
CVE-2021-20047 | High | 7.8 | 2021-12-08 | SonicWall Global VPN client version 4.10.6 (32-bit and 64-bit) and earlier have a DLL Search Order Hijacking vulnerability. Successful exploitation via a local… |
CVE-2021-43037 | High | 7.8 | 2021-12-06 | An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. The Unitrends Windows agent was vulnerable to DLL injection and binary planting due… |
CVE-2021-32592 | High | 7.8 | 2021-12-01 | An unsafe search path vulnerability in FortiClientWindows 7.0.0, 6.4.6 and below, 6.2.x, 6.0.x and FortiClientEMS 7.0.0, 6.4.6 and below, 6.2.x, 6.0.x may allo… |
CVE-2021-44199 | Medium | 5.5 | 2021-11-29 | DLL hijacking could lead to denial of service. The following products are affected: Acronis Cyber Protect 15 (Windows) before build 28035, Acronis Agent (Windo… |
CVE-2021-44198 | High | 7.8 | 2021-11-29 | DLL hijacking could lead to local privilege escalation. The following products are affected: Acronis Cyber Protect 15 (Windows) before build 28035 |
CVE-2021-0082 | High | 7.8 | 2021-11-17 | Uncontrolled search path in software installer for Intel(R) PROSet/Wireless WiFi in Windows 10 may allow an authenticated user to potentially enable escalation… |
CVE-2021-3840 | High | 8.8 | 2021-11-12 | A dependency confusion vulnerability was reported in the Antilles open-source software prior to version 1.0.1 that could allow for remote code execution during… |
CVE-2021-31853 | High | 7.8 | 2021-11-10 | DLL Search Order Hijacking Vulnerability in McAfee Drive Encryption (MDE) prior to 7.3.0 HF2 (7.3.0.183) allows local users to execute arbitrary code and escal… |
CVE-2021-38420 | High | 7.8 | 2021-11-03 | Delta Electronics DIALink versions 1.2.4.0 and prior default permissions give extensive permissions to low-privileged user accounts, which may allow an attacke… |
CVE-2021-38416 | High | 7.8 | 2021-11-03 | Delta Electronics DIALink versions 1.2.4.0 and prior insecurely loads libraries, which may allow an attacker to use DLL hijacking and takeover the system where… |
CVE-2021-22037 | High | 7.8 | 2021-10-29 | Under certain circumstances, when manipulating the Windows registry, InstallBuilder uses the reg.exe system command. The full path to the command is not enforc… |
CVE-2021-30359 | High | 7.8 | 2021-10-22 | The Harmony Browse and the SandBlast Agent for Browsers installers must have admin privileges to execute some steps during the installation. Because the MS Ins… |
CVE-2021-38469 | Critical | 9.1 | 2021-10-22 | Many of the services used by the affected product do not specify full paths for the DLLs they are loading. An attacker can exploit the uncontrolled search path… |
CVE-2021-42103 | High | 7.8 | 2021-10-21 | An uncontrolled search path element vulnerabilities in Trend Micro Apex One and Apex One as a Service could allow a local attacker to escalate privileges on af… |
CVE-2021-42102 | High | 7.8 | 2021-10-21 | An uncontrolled search path element vulnerabilities in Trend Micro Apex One and Apex One as a Service agents could allow a local attacker to escalate privilege… |
CVE-2021-42101 | High | 7.8 | 2021-10-21 | An uncontrolled search path element vulnerabilities in Trend Micro Apex One and Apex One as a Service could allow a local attacker to escalate privileges on af… |
CVE-2021-35982 | High | 7.3 | 2021-09-29 | Acrobat Reader DC versions 2021.005.20060 (and earlier), 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by an Uncontrolled Search P… |
CVE-2021-32466 | High | 7.0 | 2021-09-29 | An uncontrolled search path element privilege escalation vulnerability in Trend Micro HouseCall for Home Networks version 5.3.1225 and below could allow an att… |
CVE-2021-40981 | High | 7.3 | 2021-09-27 | ASUS ROG Armoury Crate Lite before 4.2.10 allows local users to gain privileges by placing a Trojan horse file in the publicly writable %PROGRAMDATA%\ASUS\Gami… |
CVE-2021-28130 | High | 7.8 | 2021-09-24 | Dr.Web Firewall 12.5.2.4160 on Windows incorrectly restricts applications signed by Dr.Web. A DLL for a custom payload within a legitimate binary (e.g., frwl_s… |
CVE-2021-26750 | High | 7.8 | 2021-09-23 | DLL hijacking in Panda Agent <=1.16.11 in Panda Security, S.L.U. Panda Adaptive Defense 360 <= 8.0.17 allows attacker to escalate privileges via maliciously cr… |
CVE-2021-31847 | High | 8.2 | 2021-09-22 | Improper access control vulnerability in the repair process for McAfee Agent for Windows prior to 5.7.4 could allow a local attacker to perform a DLL preloadin… |
CVE-2021-36216 | High | 7.8 | 2021-09-08 | LINE for Windows 6.2.1.2289 and before allows arbitrary code execution via malicious DLL injection. |
CVE-2021-28581 | High | 7.3 | 2021-09-08 | Adobe Creative Cloud Desktop 3.5 (and earlier) is affected by an uncontrolled search path vulnerability that could result in elevation of privileges. Exploitat… |
CVE-2021-22775 | High | 7.8 | 2021-09-02 | A CWE-427: Uncontrolled Search Path Element vulnerability exists in GP-Pro EX,V4.09.250 and prior, that could cause local code execution with elevated privileg… |
CVE-2021-20793 | High | 7.8 | 2021-08-26 | Untrusted search path vulnerability in the installer of Sony Audio USB Driver V1.10 and prior and the installer of HAP Music Transfer Ver.1.3.0 and prior allow… |
CVE-2021-28594 | High | 7.8 | 2021-08-24 | Adobe Creative Cloud Desktop Application (installer) version 2.4 (and earlier) is affected by an Uncontrolled Search Path Element vulnerability. An unauthentic… |
CVE-2021-28636 | High | 7.3 | 2021-08-20 | Acrobat Reader DC versions 2021.005.20054 (and earlier), 2020.004.30005 (and earlier) and 2017.011.30197 (and earlier) are affected by an Uncontrolled Search P… |
CVE-2021-28595 | High | 7.8 | 2021-08-20 | Adobe Dimension version 3.4 (and earlier) is affected by an Uncontrolled Search Path Element element. An unauthenticated attacker could leverage this vulnerabi… |
CVE-2021-37617 | High | 7.3 | 2021-08-18 | The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with a computer. The Nextcloud Desktop Client invokes its uninstaller script… |
CVE-2021-3633 | High | 7.3 | 2021-08-17 | A DLL preloading vulnerability was reported in Lenovo Driver Management prior to version 2.9.0719.1104 that could allow privilege escalation. |
CVE-2021-38086 | High | 7.8 | 2021-08-12 | Acronis Cyber Protect 15 for Windows prior to build 27009 and Acronis Agent for Windows prior to build 26226 allowed local privilege escalation via DLL hijacki… |
CVE-2021-36770 | High | 7.8 | 2021-08-11 | Encode.pm, as distributed in Perl through 5.34.0, allows local users to gain privileges via a Trojan horse Encode::ConfigLocal library (in the current working… |
CVE-2021-38571 | High | 7.8 | 2021-08-11 | An issue was discovered in Foxit Reader and PhantomPDF before 10.1.4. It allows DLL hijacking, aka CNVD-C-2021-68000 and CNVD-C-2021-68502. |
CVE-2021-0160 | High | 7.8 | 2021-08-11 | Uncontrolled search path in some Intel(R) NUC Pro Chassis Element AverMedia Capture Card drivers before version 3.0.64.143 may allow an authenticated user to p… |
CVE-2021-32580 | High | 7.8 | 2021-08-05 | Acronis True Image prior to 2021 Update 4 for Windows allowed local privilege escalation due to DLL hijacking. |
CVE-2021-1593 | High | 7.3 | 2021-08-04 | A vulnerability in Cisco Packet Tracer for Windows could allow an authenticated, local attacker to perform a DLL injection attack on an affected device. To exp… |
CVE-2020-18173 | High | 7.8 | 2021-07-26 | A DLL injection vulnerability in 1password.dll of 1Password 7.3.712 allows attackers to execute arbitrary code. |