CWE-428 · Unquoted Search Path or Element (page 4)
Page 4 of 5 — CVEs classified under CWE-428, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2023-2644 | Medium | 5.3 | 2023-05-11 | A vulnerability, which was classified as problematic, has been found in DigitalPersona FPSensor 1.0.0.1. This issue affects some unknown processing of the file… |
CVE-2023-27386 | Medium | 6.7 | 2023-05-10 | Uncontrolled search path in some Intel(R) Pathfinder for RISC-V software may allow an authenticated user to potentially enable escalation of privilege via loca… |
CVE-2023-27298 | High | 8.8 | 2023-05-10 | Uncontrolled search path in the WULT software maintained by Intel(R) before version 1.0.0 (commit id 592300b) may allow an unauthenticated user to potentially… |
CVE-2022-43474 | Medium | 6.7 | 2023-05-10 | Uncontrolled search path for the DSP Builder software installer before version 22.4 for Intel(R) FPGAs Pro Edition may allow an authenticated user to potential… |
CVE-2022-41693 | Medium | 6.7 | 2023-05-10 | Uncontrolled search path in the Intel(R) Quartus(R) Prime Pro edition software before version 22.3 may allow an authenticated user to potentially enable escala… |
CVE-2022-38101 | Medium | 6.7 | 2023-05-10 | Uncontrolled search path in some Intel(R) NUC Chaco Canyon BIOS update software before version iFlashV Windows 5.13.00.2105 may allow an authenticated user to… |
CVE-2022-34848 | Medium | 6.7 | 2023-05-10 | Uncontrolled search path for the Intel(R) NUC Pro Software Suite before version 2.0.0.3 may allow an authenticated user to potentially enable escalation of pri… |
CVE-2023-2417 | Medium | 5.3 | 2023-04-29 | A vulnerability was found in ks-soft Advanced Host Monitor up to 12.56 and classified as problematic. Affected by this issue is some unknown functionality of t… |
CVE-2023-2331 | High | 7.8 | 2023-04-27 | Unquoted service Path or Element vulnerability in 42Gears Surelock Windows SureLock Service (NixService.Exe) on Windows application will allows to insert arbit… |
CVE-2023-22282 | High | 7.3 | 2023-04-11 | WAB-MAT Ver.5.0.0.8 and earlier starts another program with an unquoted file path. Since a registered Windows service path contains spaces and are unquoted, if… |
CVE-2023-24671 | High | 7.8 | 2023-03-16 | VX Search v13.8 and v14.7 was discovered to contain an unquoted service path vulnerability which allows attackers to execute arbitrary commands at elevated pri… |
CVE-2023-24575 | High | 7.8 | 2023-02-21 | Dell Multifunction Printer E525w Driver and Software Suite, versions prior to 1.047.2022, A05, contain a local privilege escalation vulnerability that could b… |
CVE-2023-0887 | High | 7.0 | 2023-02-17 | A vulnerability was found in phjounin TFTPD64-SE 4.64 and classified as critical. This issue affects some unknown processing of the file tftpd64_svc.exe. The m… |
CVE-2022-44264 | High | 7.8 | 2023-01-26 | Dentsply Sirona Sidexis <= 4.3 is vulnerable to Unquoted Service Path. |
CVE-2022-4258 | High | 7.8 | 2023-01-16 | In multiple versions of HIMA PC based Software an unquoted Windows search path vulnerability might allow local users to gain privileges via a malicious .exe fi… |
CVE-2022-4429 | Medium | 5.3 | 2023-01-10 | Avira Security for Windows contains an unquoted service path which allows attackers with local administrative privileges to cause a Denial of Service. The issu… |
CVE-2019-19705 | High | 7.8 | 2022-12-26 | Realtek Audio Drivers for Windows, as used on the Lenovo ThinkPad X1 Carbon 20A7, 20A8, 20BS, and 20BT before 6.0.8882.1 and 20KH and 20KG before 6.0.8907.1 (a… |
CVE-2022-46662 | Medium | 6.7 | 2022-12-21 | Roxio Creator LJB starts another program with an unquoted file path. Since a registered Windows service path contains spaces and are unquoted, if a malicious e… |
CVE-2022-37197 | High | 7.8 | 2022-11-18 | IOBit IOTransfer V4 is vulnerable to Unquoted Service Path. |
CVE-2022-36384 | Medium | 6.7 | 2022-11-11 | Unquoted search path in the installer software for some Intel(r) NUC Kit Wireless Adapter drivers for Windows 10 before version 22.40 may allow an authenticate… |
CVE-2022-33920 | High | 7.8 | 2022-10-12 | Dell GeoDrive, versions prior to 2.2, contains an Unquoted File Path vulnerability. A low privilege attacker could potentially exploit this vulnerability, lead… |
CVE-2022-39959 | High | 7.8 | 2022-10-07 | Panini Everest Engine 2.0.4 allows unprivileged users to create a file named Everest.exe in the %PROGRAMDATA%\Panini folder. This leads to privilege escalation… |
CVE-2022-35292 | High | 7.8 | 2022-09-13 | In SAP Business One application when a service is created, the executable path contains spaces and isn’t enclosed within quotes, leading to a vulnerability kno… |
CVE-2022-1697 | Low | 3.9 | 2022-09-06 | Okta Active Directory Agent versions 3.8.0 through 3.11.0 installed the Okta AD Agent Update Service using an unquoted path. Note: To remediate this vulnerabil… |
CVE-2022-36344 | Critical | 9.8 | 2022-08-16 | An unquoted search path vulnerability exists in 'JustSystems JUST Online Update for J-License' bundled with multiple products for corporate users as in Ichitar… |
CVE-2022-35899 | High | 7.8 | 2022-07-21 | There is an unquoted service path in ASUSTeK Aura Ready Game SDK service (GameSDK.exe) 1.0.0.4. This might allow a local user to escalate privileges by creatin… |
CVE-2016-15003 | Medium | 6.3 | 2022-07-18 | A vulnerability has been found in FileZilla Client 3.17.0.0 and classified as problematic. This vulnerability affects unknown code of the file C:\Program Files… |
CVE-2022-31591 | High | 7.8 | 2022-07-12 | SAP BusinessObjects BW Publisher Service - versions 420, 430, uses a search path that contains an unquoted element. A local attacker can gain elevated privileg… |
CVE-2022-2147 | Medium | 6.5 | 2022-06-23 | Cloudflare Warp for Windows from version 2022.2.95.0 contained an unquoted service path which enables arbitrary code execution leading to privilege escalation… |
CVE-2022-31590 | High | 7.8 | 2022-06-14 | SAP PowerDesigner Proxy - version 16.7, allows an attacker with low privileges and has local access, with the ability to work around system’s root disk access… |
CVE-2022-29320 | High | 7.8 | 2022-05-20 | MiniTool Partition Wizard v12.0 contains an unquoted service path which allows attackers to escalate privileges to the system level. |
CVE-2022-27095 | High | 7.8 | 2022-05-20 | BattlEye v0.9 contains an unquoted service path which allows attackers to escalate privileges to the system level. |
CVE-2022-27094 | Medium | 6.7 | 2022-05-20 | Sony PlayMemories Home v6.0 contains an unquoted service path which allows attackers to escalate privileges to the system level. |
CVE-2022-26634 | High | 7.8 | 2022-05-20 | HMA VPN v5.3.5913.0 contains an unquoted service path which allows attackers to escalate privileges to the system level. |
CVE-2022-0883 | High | 7.3 | 2022-05-18 | SLM has an issue with Windows Unquoted/Trusted Service Paths Security Issue. All installations version 9.x.x prior to 9.20.1 should be patched. |
CVE-2022-27905 | High | 7.2 | 2022-04-27 | In ControlUp Real-Time Agent before 8.6, an unquoted path can result in privilege escalation. An attacker would require write permissions to the root level of… |
CVE-2022-27089 | High | 7.8 | 2022-04-11 | In Fujitsu PlugFree Network <= 7.3.0.3, an Unquoted service path in PFNService.exe software allows a local attacker to potentially escalate privileges to syste… |
CVE-2022-27088 | High | 7.8 | 2022-04-11 | Ivanti DSM Remote <= 6.3.1.1862 is vulnerable to an unquoted service path allowing local users to launch processes with elevated privileges. |
CVE-2022-23909 | High | 7.8 | 2022-04-05 | There is an unquoted service path in Sherpa Connector Service (SherpaConnectorService.exe) 2020.2.20328.2050. This might allow a local user to escalate privile… |
CVE-2021-43463 | High | 7.8 | 2022-04-04 | An Unquoted Service Path vulnerability exists in Ext2Fsd v0.68 via a specially crafted file in the Ext2Srv Service executable service path. |
CVE-2021-43460 | High | 7.8 | 2022-04-04 | An Unquoted Service Path vulnerability exists in System Explorer 7.0.0 via via a specially crafted file in the SystemExplorerHelpService service executable pat… |
CVE-2021-43458 | High | 7.8 | 2022-04-04 | An Unquoted Service Path vulnerability exits in Vembu BDR 4.2.0.1 via a specially crafted file in the (1) hsflowd, (2) VembuBDR360Agent, or (3) VembuOffice365A… |
CVE-2021-43457 | High | 7.8 | 2022-04-04 | An Unquoted Service Path vulnerability exists in bVPN 2.5.1 via a specially crafted file in the waselvpnserv service path. |
CVE-2021-43456 | High | 7.8 | 2022-04-04 | An Unquoted Service Path vulnerablility exists in Rumble Mail Server 0.51.3135 via via a specially crafted file in the RumbleService executable service path. |
CVE-2021-43455 | High | 7.8 | 2022-04-04 | An Unquoted Service Path vulnerability exists in FreeLAN 2.2 via a specially crafted file in the FreeLAN Service path. |
CVE-2021-43454 | High | 7.8 | 2022-04-04 | An Unquoted Service Path vulnerability exists in AnyTXT Searcher 1.2.394 via a specially crafted file in the ATService path. . |
CVE-2022-27966 | Medium | 6.5 | 2022-03-31 | Xshell v7.0.0099 and below contains a binary hijack vulnerability which allows attackers to execute arbitrary code via a crafted .exe file. |
CVE-2022-27965 | Medium | 6.5 | 2022-03-31 | Xlpd v7.0.0094 and below contains a binary hijack vulnerability which allows attackers to execute arbitrary code via a crafted .exe file. |
CVE-2022-27964 | Medium | 6.5 | 2022-03-31 | Xmanager v7.0.0096 and below contains a binary hijack vulnerability which allows attackers to execute arbitrary code via a crafted .exe file. |
CVE-2022-27963 | Medium | 6.5 | 2022-03-31 | Xftp 7.0.0088p and below contains a binary hijack vulnerability which allows attackers to execute arbitrary code via a crafted .exe file. |
CVE-2022-27052 | High | 7.8 | 2022-03-31 | FreeFtpd version 1.0.13 and below contains an unquoted service path vulnerability which allows local users to launch processes with elevated privileges. |
CVE-2022-27050 | High | 7.8 | 2022-03-31 | BitComet Service for Windows before version 1.8.6 contains an unquoted service path vulnerability which allows attackers to escalate privileges to the system l… |
CVE-2022-0237 | Medium | 4.0 | 2022-03-17 | Rapid7 Insight Agent versions 3.1.2.38 and earlier suffer from a privilege escalation vulnerability, whereby an attacker can hijack the flow of execution due t… |
CVE-2022-25031 | High | 7.8 | 2022-03-03 | Remote Desktop Commander Suite Agent before v4.8 contains an unquoted service path which allows attackers to escalate privileges to the system level. |
CVE-2021-45819 | Medium | 6.4 | 2022-03-03 | Wordline HIDCCEMonitorSVC before v5.2.4.3 contains an unquoted service path which allows attackers to escalate privileges to the system level. |
CVE-2021-46368 | High | 7.8 | 2022-02-17 | TRIGONE Remote System Monitor 3.61 is vulnerable to an unquoted path service allowing local users to launch processes with elevated privileges. |
CVE-2020-14521 | High | 8.3 | 2022-02-11 | Multiple Mitsubishi Electric Factory Automation engineering software products have a malicious code execution vulnerability. A malicious attacker could use thi… |
CVE-2021-29218 | Medium | 6.7 | 2022-02-04 | A local unquoted search path security vulnerability has been identified in HPE Agentless Management Service for Windows version(s): Prior to 1.44.0.0, 10.96.0… |
CVE-2021-45460 | High | 8.1 | 2022-01-11 | A vulnerability has been identified in SICAM PQ Analyzer (All versions < V3.18). A service is started by an unquoted registry entry. As there are spaces in thi… |
CVE-2021-25269 | Medium | 4.4 | 2021-11-26 | A local administrator could prevent the HMPA service from starting despite tamper protection using an unquoted service path vulnerability in the HMPA component… |
CVE-2021-23197 | Medium | 5.2 | 2021-11-18 | Unquoted service path vulnerability in the Gallagher Controller Service allows an unprivileged user to execute arbitrary code as the account that runs the Cont… |
CVE-2021-33095 | High | 7.8 | 2021-11-17 | Unquoted search path in the installer for the Intel(R) NUC M15 Laptop Kit Keyboard LED Service driver pack before version 1.0.0.4 may allow an authenticated us… |
CVE-2021-42563 | High | 7.8 | 2021-11-12 | There is an Unquoted Service Path in NI Service Locator (nisvcloc.exe) in versions prior to 18.0 on Windows. This may allow an authorized local user to insert… |
CVE-2021-35231 | Medium | 6.7 | 2021-10-25 | As a result of an unquoted service path vulnerability present in the Kiwi Syslog Server Installation Wizard, a local attacker could gain escalated privileges b… |
CVE-2021-40683 | High | 7.8 | 2021-10-04 | In Akamai EAA (Enterprise Application Access) Client before 2.3.1, 2.4.x before 2.4.1, and 2.5.x before 2.5.3, an unquoted path may allow an attacker to hijack… |
CVE-2020-11632 | High | 7.8 | 2021-07-15 | The Zscaler Client Connector prior to 2.1.2.150 did not quote the search path for services, which allows a local adversary to execute code with system privileg… |
CVE-2021-35056 | Medium | 6.7 | 2021-07-15 | Unisys Stealth 5.1 before 5.1.025.0 and 6.0 before 6.0.055.0 has an unquoted Windows search path for a scheduled task. An unintended executable might run. |
CVE-2021-35469 | High | 7.8 | 2021-07-14 | The Lexmark Printer Software G2, G3 and G4 Installation Packages have a local escalation of privilege vulnerability due to a registry entry that has an unquote… |
CVE-2021-0112 | High | 7.3 | 2021-06-09 | Unquoted service path in the Intel Unite(R) Client for Windows before version 4.2.25031 may allow an authenticated user to potentially enable an escalation of… |
CVE-2020-22809 | High | 7.8 | 2021-05-10 | In Windscribe v1.83 Build 20, 'WindscribeService' has an Unquoted Service Path that facilitates privilege escalation. |
CVE-2021-31776 | High | 7.8 | 2021-04-29 | Aviatrix VPN Client before 2.14.14 on Windows has an unquoted search path that enables local privilege escalation to the SYSTEM user, if the machine is misconf… |
CVE-2021-31553 | Medium | 6.5 | 2021-04-22 | An issue was discovered in the CheckUser extension for MediaWiki through 1.35.2. MediaWiki usernames with trailing whitespace could be stored in the cu_log dat… |
CVE-2021-27608 | High | 7.5 | 2021-04-14 | An unquoted service path in SAPSetup, version - 9.0, could lead to privilege escalation during the installation process that is performed when an executable fi… |
CVE-2021-23879 | Medium | 6.7 | 2021-03-15 | Unquoted service path vulnerability in McAfee Endpoint Product Removal (EPR) Tool prior to 21.2 allows local administrators to execute arbitrary code, with hig… |
CVE-2020-35152 | Medium | 4.5 | 2021-02-03 | Cloudflare WARP for Windows allows privilege escalation due to an unquoted service path. A malicious user or process running with non-administrative privileges… |
CVE-2021-21292 | Medium | 5.5 | 2021-02-02 | Traccar is an open source GPS tracking system. In Traccar before version 4.12 there is an unquoted Windows binary path vulnerability. Only Windows versions are… |
CVE-2020-5147 | Medium | 5.3 | 2021-01-09 | SonicWall NetExtender Windows client vulnerable to unquoted service path vulnerability, this allows a local attacker to gain elevated privileges in the host op… |
CVE-2020-27645 | High | 8.8 | 2020-12-29 | The Inventory module of the 1E Client 5.0.0.745 doesn't handle an unquoted path when executing %PROGRAMFILES%\1E\Client\Tachyon.Performance.Metrics.exe. This m… |
CVE-2020-27644 | High | 8.8 | 2020-12-29 | The Inventory module of the 1E Client 5.0.0.745 doesn't handle an unquoted path when executing %PROGRAMFILES%\1E\Client\Tachyon.Performance.Metrics.exe. This m… |
CVE-2020-28209 | High | 7.0 | 2020-11-19 | A CWE-428 Windows Unquoted Search Path vulnerability exists in EcoStruxure Building Operation Enterprise Server installer V1.9 - V3.1 and Enterprise Central in… |
CVE-2020-7331 | High | 7.8 | 2020-11-12 | Unquoted service executable path in McAfee Endpoint Security (ENS) prior to 10.7.0 November 2020 Update allows local users to cause a denial of service and mal… |
CVE-2020-15261 | High | 8.0 | 2020-10-19 | On Windows the Veyon Service before version 4.4.2 contains an unquoted service path vulnerability, allowing locally authenticated users with administrative pri… |
CVE-2020-7316 | Medium | 6.6 | 2020-10-07 | Unquoted service path vulnerability in McAfee File and Removable Media Protection (FRP) prior to 5.3.0 allows local users to execute arbitrary code, with highe… |
CVE-2020-10051 | High | 7.8 | 2020-09-09 | A vulnerability has been identified in SIMATIC RTLS Locating Manager (All versions < V2.10.2). Multiple services of the affected application are executed with… |
CVE-2020-7382 | Medium | 6.8 | 2020-09-03 | Rapid7 Nexpose installer version prior to 6.6.40 contains an Unquoted Search Path which may allow an attacker on the local machine to insert an arbitrary file… |
CVE-2020-8326 | High | 7.3 | 2020-07-24 | An unquoted service path vulnerability was reported in Lenovo Drivers Management prior to version 2.7.1128.1046 that could allow an authenticated user to execu… |
CVE-2020-7581 | Medium | 6.7 | 2020-07-14 | A vulnerability has been identified in Opcenter Execution Discrete (All versions < V3.2), Opcenter Execution Foundation (All versions < V3.2), Opcenter Executi… |
CVE-2020-7580 | Medium | 6.7 | 2020-06-10 | A vulnerability has been identified in SIMATIC Automation Tool (All versions < V4 SP2), SIMATIC NET PC Software V14 (All versions < V14 SP1 Update 14), SIMATIC… |
CVE-2020-8337 | Medium | 6.7 | 2020-06-09 | An unquoted search path vulnerability was reported in versions prior to 1.0.83.0 of the Synaptics Smart Audio UWP app associated with the DCHU audio drivers on… |
CVE-2020-9292 | Critical | 9.8 | 2020-06-04 | An unquoted service path vulnerability in the FortiSIEM Windows Agent component may allow an attacker to gain elevated privileges via the AoWinAgt executable s… |
CVE-2020-5569 | High | 8.4 | 2020-04-20 | An unquoted search path vulnerability exists in HDD Password tool (for Windows) version 1.20.6620 and earlier which is stored in CANVIO PREMIUM 3TB(HD-MB30TY… |
CVE-2020-7275 | Medium | 4.8 | 2020-04-15 | Accessing, modifying or executing executable files vulnerability in the uninstaller in McAfee Endpoint Security (ENS) for Windows Prior to 10.7.0 April 2020 Up… |
CVE-2020-8327 | High | 7.3 | 2020-04-14 | A privilege escalation vulnerability was reported in LenovoBatteryGaugePackage for Lenovo System Interface Foundation bundled in Lenovo Vantage prior to versio… |
CVE-2020-1988 | Medium | 4.2 | 2020-04-08 | An unquoted search path vulnerability in the Windows release of Global Protect Agent allows an authenticated local user with file creation privileges on the ro… |
CVE-2019-17658 | Critical | 9.8 | 2020-03-12 | An unquoted service path vulnerability in the FortiClient FortiTray component of FortiClientWindows v6.2.2 and prior allow an attacker to gain elevated privile… |
CVE-2020-0546 | High | 7.8 | 2020-03-12 | Unquoted service path in Intel(R) Optane(TM) DC Persistent Memory Module Management Software before version 1.0.0.3461 may allow an authenticated user to poten… |
CVE-2020-0507 | Medium | 4.4 | 2020-03-12 | Unquoted service path in Intel(R) Graphics Drivers before versions 15.33.49.5100, 15.36.38.5117, 15.40.44.5107, 15.45.30.5103, and 26.20.100.7212 may allow an… |
CVE-2020-7252 | Medium | 4.2 | 2020-02-17 | Unquoted service executable path in DXL Broker in McAfee Data eXchange Layer (DXL) Framework 6.0.0 and earlier allows local users to cause a denial of service… |
CVE-2019-18915 | High | 7.8 | 2020-02-13 | A potential security vulnerability has been identified with certain versions of HP System Event Utility prior to version 1.4.33. This vulnerability may allow a… |
CVE-2019-20357 | High | 7.8 | 2020-01-18 | A Persistent Arbitrary Code Execution vulnerability exists in the Trend Micro Security 2020 (v160 and 2019 (v15) consumer familiy of products which could poten… |