CWE-427 · Uncontrolled Search Path Element (page 9)
Page 9 of 13 — CVEs classified under CWE-427, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2022-23449 | High | 7.3 | 2022-04-12 | A vulnerability has been identified in SIMATIC Energy Manager Basic (All versions < V7.3 Update 1), SIMATIC Energy Manager PRO (All versions < V7.3 Update 1)… |
CVE-2022-28779 | Medium | 5.3 | 2022-04-11 | Uncontrolled search path element vulnerability in Samsung Android USB Driver windows installer program prior to version 1.7.50 allows attacker to execute arbit… |
CVE-2022-28541 | Medium | 5.9 | 2022-04-11 | Uncontrolled search path element vulnerability in Samsung Update prior to version 3.0.77.0 allows attackers to execute arbitrary code as Samsung Update permiss… |
CVE-2022-27843 | Medium | 6.2 | 2022-04-11 | DLL hijacking vulnerability in Kies prior to version 2.6.4.22014_2 allows attacker to execute abitrary code. |
CVE-2022-27842 | Medium | 6.2 | 2022-04-11 | DLL hijacking vulnerability in Smart Switch PC prior to version 4.2.22022_4 allows attacker to execute abitrary code. |
CVE-2022-25154 | High | 7.3 | 2022-04-05 | A DLL hijacking vulnerability in Samsung portable SSD T5 PC software before 1.6.9 could allow a local attacker to escalate privileges. (An attacker must alread… |
CVE-2022-1098 | High | 7.8 | 2022-04-01 | Delta Electronics DIAEnergie (all versions prior to 1.8.02.004) are vulnerable to a DLL hijacking condition. When combined with the Incorrect Default Permissio… |
CVE-2022-24426 | High | 7.8 | 2022-04-01 | Dell Command | Update, Dell Update, and Alienware Update version 4.4.0 contains a Local Privilege Escalation Vulnerability in the Advanced Driver Restore compo… |
CVE-2022-28128 | High | 7.8 | 2022-03-31 | Untrusted search path vulnerability in AttacheCase ver.3.6.1.0 and earlier allows an attacker to gain privileges and execute arbitrary code via a Trojan horse… |
CVE-2022-25348 | High | 7.8 | 2022-03-31 | Untrusted search path vulnerability in AttacheCase ver.4.0.2.7 and earlier allows an attacker to gain privileges and execute arbitrary code via a Trojan horse… |
CVE-2022-22996 | High | 7.8 | 2022-03-30 | The G-RAID 4/8 Software Utility setups for Windows were affected by a DLL hijacking vulnerability. Successful exploitation could lead to arbitrary code executi… |
CVE-2021-44226 | High | 7.3 | 2022-03-23 | Razer Synapse before 3.7.0228.022817 allows privilege escalation because it relies on %PROGRAMDATA%\Razer\Synapse3\Service\bin even if %PROGRAMDATA%\Razer has… |
CVE-2020-25182 | Medium | 6.7 | 2022-03-18 | Rockwell Automation ISaGRAF Runtime Versions 4.x and 5.x searches for and loads DLLs as dynamic libraries. Uncontrolled loading of dynamic libraries could allo… |
CVE-2022-26511 | High | 7.8 | 2022-03-17 | WPS Presentation 11.8.0.5745 insecurely load d3dx9_41.dll when opening .pps files('current directory type' DLL loading). |
CVE-2022-26081 | High | 7.8 | 2022-03-17 | The installer of WPS Office Version 10.8.0.5745 insecurely load shcore.dll, allowing an attacker to execute arbitrary code with the privilege of the user invok… |
CVE-2022-25969 | High | 7.8 | 2022-03-17 | The installer of WPS Office Version 10.8.0.6186 insecurely load VERSION.DLL (or some other DLLs), allowing an attacker to execute arbitrary code with the privi… |
CVE-2022-20001 | High | 7.8 | 2022-03-14 | fish is a command line shell. fish version 3.1.0 through version 3.3.1 is vulnerable to arbitrary code execution. git repositories can contain per-repository c… |
CVE-2022-23401 | High | 7.8 | 2022-03-11 | The following Yokogawa Electric products contain insecure DLL loading issues. CENTUM CS 3000 versions from R3.08.10 to R3.09.00, CENTUM VP versions from R4.01… |
CVE-2022-26337 | High | 7.8 | 2022-03-08 | Trend Micro Password Manager (Consumer) installer version 5.0.0.1262 and below is vulnerable to an Uncontrolled Search Path Element vulnerability that could al… |
CVE-2022-26319 | Medium | 6.5 | 2022-03-08 | An installer search patch element vulnerability in Trend Micro Portable Security 3.0 Pro, 3.0 and 2.0 could allow a local attacker to place an arbitrarily gene… |
CVE-2022-22943 | Medium | 6.7 | 2022-03-03 | VMware Tools for Windows (11.x.y and 10.x.y prior to 12.0.0) contains an uncontrolled search path vulnerability. A malicious actor with local administrative pr… |
CVE-2022-23202 | High | 7.0 | 2022-02-16 | Adobe Creative Cloud Desktop version 2.7.0.13 (and earlier) is affected by an Uncontrolled Search Path Element vulnerability that could result in arbitrary cod… |
CVE-2021-43940 | High | 7.8 | 2022-02-15 | Affected versions of Atlassian Confluence Server and Data Center allow authenticated local attackers to achieve elevated privileges on the local system via a D… |
CVE-2022-23410 | High | 7.8 | 2022-02-14 | AXIS IP Utility before 4.18.0 allows for remote code execution and local privilege escalation by the means of DLL hijacking. IPUtility.exe would attempt to loa… |
CVE-2022-23853 | High | 7.8 | 2022-02-11 | The LSP (Language Server Protocol) plugin in KDE Kate before 21.12.2 and KTextEditor before 5.91.0 tries to execute the associated LSP server binary when openi… |
CVE-2022-0483 | High | 7.8 | 2022-02-11 | Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis VSS Doctor (Windows) before build 53 |
CVE-2022-24955 | Critical | 9.8 | 2022-02-11 | Foxit PDF Reader before 11.2.1 and Foxit PDF Editor before 11.2.1 have an Uncontrolled Search Path Element for DLL files. |
CVE-2022-22528 | High | 7.8 | 2022-02-09 | SAP Adaptive Server Enterprise (ASE) - version 16.0, installation makes an entry in the system PATH environment variable in Windows platform which, under certa… |
CVE-2021-33101 | High | 7.8 | 2022-02-09 | Uncontrolled search path in the Intel(R) GPA software before version 21.2 may allow an authenticated user to potentially enable escalation of privilege via loc… |
CVE-2021-0169 | Medium | 6.7 | 2022-02-09 | Uncontrolled Search Path Element in software for Intel(R) PROSet/Wireless Wi-Fi in Windows 10 and 11 may allow a privileged user to potentially enable escalati… |
CVE-2021-44206 | High | 7.3 | 2022-02-04 | Local privilege escalation due to DLL hijacking vulnerability in Acronis Media Builder service. The following products are affected: Acronis Cyber Protect Home… |
CVE-2021-44205 | High | 7.3 | 2022-02-04 | Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 39… |
CVE-2020-12891 | High | 7.8 | 2022-02-04 | AMD Radeon Software may be vulnerable to DLL Hijacking through path variable. An unprivileged user may be able to drop its malicious DLL file in any location w… |
CVE-2021-44463 | High | 8.1 | 2022-01-28 | Missing DLLs, if replaced by an insider, could allow an attacker to achieve local privilege escalation on the DeltaV Distributed Control System Controllers and… |
CVE-2022-0166 | High | 7.8 | 2022-01-19 | A privilege escalation vulnerability in the McAfee Agent prior to 5.7.5. McAfee Agent uses openssl.cnf during the build process to specify the OPENSSLDIR varia… |
CVE-2022-0015 | High | 7.8 | 2022-01-12 | A local privilege escalation (PE) vulnerability exists in the Palo Alto Networks Cortex XDR agent that enables an authenticated local user to execute programs… |
CVE-2022-0129 | High | 7.4 | 2022-01-11 | Uncontrolled search path element vulnerability in McAfee TechCheck prior to 4.0.0.2 allows a local administrator to load their own Dynamic Link Library (DLL) g… |
CVE-2022-21668 | High | 8.0 | 2022-01-10 | pipenv is a Python development workflow tool. Starting with version 2018.10.9 and prior to version 2022.1.8, a flaw in pipenv's parsing of requirements files a… |
CVE-2021-30360 | High | 7.8 | 2022-01-10 | Users have access to the directory where the installation repair occurs. Since the MS Installer allows regular users to run the repair, an attacker can initiat… |
CVE-2021-4007 | High | 7.8 | 2021-12-14 | Rapid7 Insight Agent, versions 3.0.1 to 3.1.2.34, suffer from a local privilege escalation due to an uncontrolled DLL search path. Specifically, when Insight A… |
CVE-2021-20047 | High | 7.8 | 2021-12-08 | SonicWall Global VPN client version 4.10.6 (32-bit and 64-bit) and earlier have a DLL Search Order Hijacking vulnerability. Successful exploitation via a local… |
CVE-2021-43037 | High | 7.8 | 2021-12-06 | An issue was discovered in Kaseya Unitrends Backup Appliance before 10.5.5. The Unitrends Windows agent was vulnerable to DLL injection and binary planting due… |
CVE-2021-32592 | High | 7.8 | 2021-12-01 | An unsafe search path vulnerability in FortiClientWindows 7.0.0, 6.4.6 and below, 6.2.x, 6.0.x and FortiClientEMS 7.0.0, 6.4.6 and below, 6.2.x, 6.0.x may allo… |
CVE-2021-44199 | Medium | 5.5 | 2021-11-29 | DLL hijacking could lead to denial of service. The following products are affected: Acronis Cyber Protect 15 (Windows) before build 28035, Acronis Agent (Windo… |
CVE-2021-44198 | High | 7.8 | 2021-11-29 | DLL hijacking could lead to local privilege escalation. The following products are affected: Acronis Cyber Protect 15 (Windows) before build 28035 |
CVE-2021-0082 | High | 7.8 | 2021-11-17 | Uncontrolled search path in software installer for Intel(R) PROSet/Wireless WiFi in Windows 10 may allow an authenticated user to potentially enable escalation… |
CVE-2021-3840 | High | 8.8 | 2021-11-12 | A dependency confusion vulnerability was reported in the Antilles open-source software prior to version 1.0.1 that could allow for remote code execution during… |
CVE-2021-31853 | High | 7.8 | 2021-11-10 | DLL Search Order Hijacking Vulnerability in McAfee Drive Encryption (MDE) prior to 7.3.0 HF2 (7.3.0.183) allows local users to execute arbitrary code and escal… |
CVE-2021-38420 | High | 7.8 | 2021-11-03 | Delta Electronics DIALink versions 1.2.4.0 and prior default permissions give extensive permissions to low-privileged user accounts, which may allow an attacke… |
CVE-2021-38416 | High | 7.8 | 2021-11-03 | Delta Electronics DIALink versions 1.2.4.0 and prior insecurely loads libraries, which may allow an attacker to use DLL hijacking and takeover the system where… |
CVE-2021-22037 | High | 7.8 | 2021-10-29 | Under certain circumstances, when manipulating the Windows registry, InstallBuilder uses the reg.exe system command. The full path to the command is not enforc… |
CVE-2021-30359 | High | 7.8 | 2021-10-22 | The Harmony Browse and the SandBlast Agent for Browsers installers must have admin privileges to execute some steps during the installation. Because the MS Ins… |
CVE-2021-38469 | Critical | 9.1 | 2021-10-22 | Many of the services used by the affected product do not specify full paths for the DLLs they are loading. An attacker can exploit the uncontrolled search path… |
CVE-2021-42103 | High | 7.8 | 2021-10-21 | An uncontrolled search path element vulnerabilities in Trend Micro Apex One and Apex One as a Service could allow a local attacker to escalate privileges on af… |
CVE-2021-42102 | High | 7.8 | 2021-10-21 | An uncontrolled search path element vulnerabilities in Trend Micro Apex One and Apex One as a Service agents could allow a local attacker to escalate privilege… |
CVE-2021-42101 | High | 7.8 | 2021-10-21 | An uncontrolled search path element vulnerabilities in Trend Micro Apex One and Apex One as a Service could allow a local attacker to escalate privileges on af… |
CVE-2021-35982 | High | 7.3 | 2021-09-29 | Acrobat Reader DC versions 2021.005.20060 (and earlier), 2020.004.30006 (and earlier) and 2017.011.30199 (and earlier) are affected by an Uncontrolled Search P… |
CVE-2021-32466 | High | 7.0 | 2021-09-29 | An uncontrolled search path element privilege escalation vulnerability in Trend Micro HouseCall for Home Networks version 5.3.1225 and below could allow an att… |
CVE-2021-40981 | High | 7.3 | 2021-09-27 | ASUS ROG Armoury Crate Lite before 4.2.10 allows local users to gain privileges by placing a Trojan horse file in the publicly writable %PROGRAMDATA%\ASUS\Gami… |
CVE-2021-28130 | High | 7.8 | 2021-09-24 | Dr.Web Firewall 12.5.2.4160 on Windows incorrectly restricts applications signed by Dr.Web. A DLL for a custom payload within a legitimate binary (e.g., frwl_s… |
CVE-2021-26750 | High | 7.8 | 2021-09-23 | DLL hijacking in Panda Agent <=1.16.11 in Panda Security, S.L.U. Panda Adaptive Defense 360 <= 8.0.17 allows attacker to escalate privileges via maliciously cr… |
CVE-2021-31847 | High | 8.2 | 2021-09-22 | Improper access control vulnerability in the repair process for McAfee Agent for Windows prior to 5.7.4 could allow a local attacker to perform a DLL preloadin… |
CVE-2021-36216 | High | 7.8 | 2021-09-08 | LINE for Windows 6.2.1.2289 and before allows arbitrary code execution via malicious DLL injection. |
CVE-2021-28581 | High | 7.3 | 2021-09-08 | Adobe Creative Cloud Desktop 3.5 (and earlier) is affected by an uncontrolled search path vulnerability that could result in elevation of privileges. Exploitat… |
CVE-2021-22775 | High | 7.8 | 2021-09-02 | A CWE-427: Uncontrolled Search Path Element vulnerability exists in GP-Pro EX,V4.09.250 and prior, that could cause local code execution with elevated privileg… |
CVE-2021-20793 | High | 7.8 | 2021-08-26 | Untrusted search path vulnerability in the installer of Sony Audio USB Driver V1.10 and prior and the installer of HAP Music Transfer Ver.1.3.0 and prior allow… |
CVE-2021-28594 | High | 7.8 | 2021-08-24 | Adobe Creative Cloud Desktop Application (installer) version 2.4 (and earlier) is affected by an Uncontrolled Search Path Element vulnerability. An unauthentic… |
CVE-2021-28636 | High | 7.3 | 2021-08-20 | Acrobat Reader DC versions 2021.005.20054 (and earlier), 2020.004.30005 (and earlier) and 2017.011.30197 (and earlier) are affected by an Uncontrolled Search P… |
CVE-2021-28595 | High | 7.8 | 2021-08-20 | Adobe Dimension version 3.4 (and earlier) is affected by an Uncontrolled Search Path Element element. An unauthenticated attacker could leverage this vulnerabi… |
CVE-2021-37617 | High | 7.3 | 2021-08-18 | The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with a computer. The Nextcloud Desktop Client invokes its uninstaller script… |
CVE-2021-3633 | High | 7.3 | 2021-08-17 | A DLL preloading vulnerability was reported in Lenovo Driver Management prior to version 2.9.0719.1104 that could allow privilege escalation. |
CVE-2021-38086 | High | 7.8 | 2021-08-12 | Acronis Cyber Protect 15 for Windows prior to build 27009 and Acronis Agent for Windows prior to build 26226 allowed local privilege escalation via DLL hijacki… |
CVE-2021-36770 | High | 7.8 | 2021-08-11 | Encode.pm, as distributed in Perl through 5.34.0, allows local users to gain privileges via a Trojan horse Encode::ConfigLocal library (in the current working… |
CVE-2021-38571 | High | 7.8 | 2021-08-11 | An issue was discovered in Foxit Reader and PhantomPDF before 10.1.4. It allows DLL hijacking, aka CNVD-C-2021-68000 and CNVD-C-2021-68502. |
CVE-2021-0160 | High | 7.8 | 2021-08-11 | Uncontrolled search path in some Intel(R) NUC Pro Chassis Element AverMedia Capture Card drivers before version 3.0.64.143 may allow an authenticated user to p… |
CVE-2021-32580 | High | 7.8 | 2021-08-05 | Acronis True Image prior to 2021 Update 4 for Windows allowed local privilege escalation due to DLL hijacking. |
CVE-2021-1593 | High | 7.3 | 2021-08-04 | A vulnerability in Cisco Packet Tracer for Windows could allow an authenticated, local attacker to perform a DLL injection attack on an affected device. To exp… |
CVE-2020-18173 | High | 7.8 | 2021-07-26 | A DLL injection vulnerability in 1password.dll of 1Password 7.3.712 allows attackers to execute arbitrary code. |
CVE-2020-4623 | Medium | 6.5 | 2021-07-26 | IBM i2 iBase 8.9.13 could allow a local authenticated attacker to execute arbitrary code on the system, caused by a DLL search order hijacking flaw. By using a… |
CVE-2020-5316 | High | 7.8 | 2021-07-22 | Dell SupportAssist for Business PCs versions 2.0, 2.0.1, 2.0.2, 2.1, 2.1.1, 2.1.2, 2.1.3 and Dell SupportAssist for Home PCs version 2.0, 2.0.1, 2.0.2, 2.1, 2… |
CVE-2021-1089 | High | 7.8 | 2021-07-22 | NVIDIA GPU Display Driver for Windows contains a vulnerability in nvidia-smi where an uncontrolled DLL loading path may lead to arbitrary code execution, denia… |
CVE-2021-3550 | High | 7.8 | 2021-07-16 | A DLL search path vulnerability was reported in Lenovo PCManager, prior to version 3.0.500.5102, that could allow privilege escalation. |
CVE-2021-36753 | High | 7.8 | 2021-07-15 | sharkdp BAT before 0.18.2 executes less.exe from the current working directory. |
CVE-2020-11634 | High | 7.8 | 2021-07-15 | The Zscaler Client Connector for Windows prior to 2.1.2.105 had a DLL hijacking vulnerability caused due to the configuration of OpenSSL. A local adversary may… |
CVE-2021-3042 | High | 7.8 | 2021-07-15 | A local privilege escalation (PE) vulnerability exists in the Palo Alto Networks Cortex XDR agent on Windows platforms that enables an authenticated local Wind… |
CVE-2020-29157 | High | 7.8 | 2021-07-14 | An issue in RAONWIZ K Editor v2018.0.0.10 allows attackers to perform a DLL hijacking attack when the service or system is restarted. |
CVE-2021-22000 | High | 7.8 | 2021-07-13 | VMware Thinapp version 5.x prior to 5.2.10 contain a DLL hijacking vulnerability due to insecure loading of DLLs. A malicious actor with non-administrative pri… |
CVE-2021-35957 | Medium | 6.7 | 2021-07-13 | Stormshield Endpoint Security Evolution 2.0.0 through 2.0.2 does not accomplish the intended defense against local administrators who can replace the Visual C+… |
CVE-2021-36376 | High | 7.8 | 2021-07-13 | dandavison delta before 0.8.3 on Windows resolves an executable's pathname as a relative path from the current directory. |
CVE-2021-3613 | High | 7.8 | 2021-07-02 | OpenVPN Connect 3.2.0 through 3.3.0 allows local users to load arbitrary dynamic loadable libraries via an OpenSSL configuration file if present, which allows… |
CVE-2021-3606 | High | 7.8 | 2021-07-02 | OpenVPN before version 2.5.3 on Windows allows local users to load arbitrary dynamic loadable libraries via an OpenSSL configuration file if present, which all… |
CVE-2021-28570 | High | 8.3 | 2021-06-28 | Adobe After Effects version 18.1 (and earlier) is affected by an Uncontrolled Search Path element vulnerability. An unauthenticated attacker could exploit this… |
CVE-2021-29949 | High | 7.8 | 2021-06-24 | When loading the shared library that provides the OTR protocol implementation, Thunderbird will initially attempt to open it using a filename that isn't distri… |
CVE-2021-21999 | High | 7.8 | 2021-06-23 | VMware Tools for Windows (11.x.y prior to 11.2.6), VMware Remote Console for Windows (12.x prior to 12.0.1) , VMware App Volumes (2.x prior to 2.18.10 and 4 pr… |
CVE-2021-1567 | High | 7.0 | 2021-06-16 | A vulnerability in the DLL loading mechanism of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to perform a D… |
CVE-2021-34803 | High | 7.8 | 2021-06-16 | TeamViewer before 14.7.48644 on Windows loads untrusted DLLs in certain situations. |
CVE-2021-31840 | High | 7.3 | 2021-06-10 | A vulnerability in the preloading mechanism of specific dynamic link libraries in McAfee Agent for Windows prior to 5.7.3 could allow an authenticated, local a… |
CVE-2021-23023 | High | 7.8 | 2021-06-10 | On version 7.2.1.x before 7.2.1.3 and 7.1.x before 7.1.9.9 Update 1, a DLL hijacking issue exists in cachecleaner.dll included in the BIG-IP Edge Client Window… |
CVE-2021-3041 | High | 7.8 | 2021-06-10 | A local privilege escalation vulnerability exists in the Palo Alto Networks Cortex XDR agent on Windows platforms that enables an authenticated local Windows u… |
CVE-2021-0108 | High | 7.3 | 2021-06-09 | Uncontrolled search path in the Intel Unite(R) Client for Windows before version 4.2.25031 may allow an authenticated user to potentially enable an escalation… |