CWE-426: Untrusted Search Path
The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.
Also known as Untrusted Path.
A kind of CWE-642 External Control of Critical State Data.
From the CWE List. © The MITRE Corporation.
Newest
- canon it solutions inc. the installers of multiple canon it solutions inc. software programs, eset compusec, internet security +4 more +6 moreUntrusted search path vulnerability in the installers of multiple Canon IT Solutions Inc....7.8 High
- chatwork, chatwork co,. ltd. installer of chatwork desktop app for windows +1 moreUntrusted search path vulnerability in installer of ChatWork Desktop App for Windows 2.3.0 and...7.8 High
- yayoi co., ltd. multiple yayoi 17 series products, yayoi-kk aoiro shinkoku, hanbai +4 more +6 moreUntrusted search path vulnerability in Multiple Yayoi 17 Series products (Yayoi Kaikei 17 Series...7.8 High
- yayoi co., ltd. multiple yayoi 17 series products, yayoi-kk aoiro shinkoku, hanbai +4 more +6 moreUntrusted search path vulnerability in Multiple Yayoi 17 Series products (Yayoi Kaikei 17 Series...7.8 High
- gluster glusterfs, debian linux, opensuse leap +2 more +4 moreIt was found that glusterfs server does not properly sanitize file paths in the "trusted.io-stats...8.8 High
- sony digital paper app, sony corporation the installer of digital paper app +1 moreUntrusted search path vulnerability in The installer of Digital Paper App version 1.4.0.16050 and...7.8 High
- adobe creative cloudAdobe Creative Cloud Desktop Application before 4.5.5.342 (installer) has an insecure library...7.8 High
- logitech connection utility software, logicool co ltd. the installer of logicool connection utility software +1 moreUntrusted search path vulnerability in LOGICOOL CONNECTION UTILITY SOFTWARE versions before 2.30...7.8 High
- logitech game software, logicool co ltd. the installer of logicool game software +1 moreUntrusted search path vulnerability in LOGICOOL Game Software versions before 8.87.116 allows an...7.8 High
- glarysoft glary utilities, glarysoft ltd. installer of glary utilities +1 moreUntrusted search path vulnerability in the installer of Glarysoft Glary Utilities (Glary...7.8 High
- [unknown] ansible, canonical ubuntu linux, debian linux +8 more +10 moreAnsible Arbitrary Code Execution7.8 High
- ibm db2, db2 for linux, unix and windows +1 moreIBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5 and 11.1...8.4 High
- ibm db2, db2 for linux, unix and windows +1 moreIBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10,1, 10.5 and 11.1 could...7.4 High
- goldenfrog vyprvpnGolden Frog VyprVPN before 2018-06-21 has a vulnerability associated with the installation...7.8 High
- anydeskAnyDesk before "12.06.2018 - 4.1.3" on Windows 7 SP1 has a DLL preloading vulnerability.7.8 High
- [unknown] ansible, redhat ansible engine, openstack +2 more +4 moreAnsible Improper Input Validation vulnerability7.8 High
- polarisoffice polaris office 2017Polaris Office 2017 8.1 allows attackers to execute arbitrary code via a Trojan horse...7.8 High
- linecorp lineUntrusted search path vulnerability in LINE for Windows versions before 5.8.0 allows an attacker...7.8 High
- axpdfium project axpdfiumUntrusted search path vulnerability in axpdfium v0.01 allows an attacker to gain privileges via a...7.8 High
- sony playmemories home, sony corporation the installer of playmemories home for windows +1 moreUntrusted search path vulnerability in the installer of PlayMemories Home for Windows ver.5.5.01...7.8 High
- microsoft the installer of visual c++ redistributable, windows +1 moreUntrusted search path vulnerability in the installer of Visual C++ Redistributable allows an...7.8 High
- microsoft the installer of visual studio code, visual studio code +1 moreUntrusted search path vulnerability in the installer of Visual Studio Code allows an attacker to...7.8 High
- microsoft the installer of visual studio community, visual studio community +1 moreUntrusted search path vulnerability in the installer of Visual Studio Community allows an...7.8 High
- microsoft skype, the installer of skype for windows +1 moreUntrusted search path vulnerability in the installer of Skype for Windows allows an attacker to...7.8 High
- microsoft skype, skype for windows +1 moreUntrusted search path vulnerability in Skype for Windows allows an attacker to gain privileges...7.8 High
- microsoft onedrive, the installer of microsoft onedrive +1 moreUntrusted search path vulnerability in the installer of Microsoft OneDrive allows an attacker to...7.8 High
- microsoft onedriveUntrusted search path vulnerability in Microsoft OneDrive allows an attacker to gain privileges...7.8 High
- nippon telegraph and telephone east corporation the installer of flet's virus clear easy setup & application tool ver.13.0 and earlier versions and flet's virus clear v6 easy setup & application tool ver.13.0 and earlier versions, ntt-east flet\'s virus clear easy setup \& application tool, flet\'s virus clear v6 easy setup \& application tool +2 moreUntrusted search path vulnerability in the installer of FLET'S VIRUS CLEAR Easy Setup &...7.8 High
- microsoft self-extracting archive files created by iexpress bundled with microsoft windows, windows +1 moreUntrusted search path vulnerability in Self-extracting archive files created by IExpress bundled...7.8 High
- ruby-ffi project ruby-ffiRuby-ffi has a DLL loading issue7.8 High
- puppet, puppet agent, puppetpu puppet agent +2 moreIn Puppet Agent 1.10.x prior to 1.10.13, Puppet Agent 5.3.x prior to 5.3.7, Puppet Agent 5.5.x...7.8 High
- puppet, puppet enterprise, enterprise and puppet agent +2 morePuppet Enterprise 2016.4.x prior to 2016.4.12, Puppet Enterprise 2017.3.x prior to 2017.3.7,...8.8 High
- displaylink core software cleanerAn issue was discovered in DisplayLink Core Software Cleaner Application 8.2.1956. When the...7.8 High
- nch axon pbxAXON PBX 2.02 contains a DLL hijacking vulnerability that could allow an unauthenticated, remote...7.8 High
- citrix xenmobile serverThere is an Insufficient Path Validation Vulnerability in Citrix XenMobile Server 10.8 before RP2...7.8 High
- adobe indesignAdobe InDesign versions 13.0 and below have an exploitable Untrusted Search Path vulnerability....7.8 High
- estsoft alzipESTsoft ALZip before 10.76 allows local users to execute arbitrary code via creating a malicious ...7.8 High
- celsys clip studio action, clip studio modeler, clip studio paint +1 more +3 moreUntrusted search path vulnerability in CELSYS, Inc CLIP STUDIO series (CLIP STUDIO PAINT (for...7.8 High
- dell, dell precision optimizer +1 moreAn exploitable dll hijacking vulnerability exists in the poaService.exe service component of the...7.8 High
- kaspersky password managerUnauthorized code execution from specific DLL and is known as DLL Hijacking attack in Kaspersky...7.8 High
- coderium installer of soundengine free, soundengine +1 moreUntrusted search path vulnerability in Installer of SoundEngine Free ver.5.21 and earlier allows...7.8 High
- securebrain phishwall, securebrain corporation the installer of phishwall client internet explorer edition +1 moreUntrusted search path vulnerability in The installer of PhishWall Client Internet Explorer...7.8 High
- mcafee true keyTS102801 True Key DLL Side-Loading vulnerability7.5 High
- philips intellispace portalPhilips IntelliSpace Portal all versions of 8.0.x, and 7.0.x have an unquoted search path or...7.8 High
- securebrain phishwall client, securebrain corporation the installer of phishwall client firefox and chrome edition for windows +1 moreUntrusted search path vulnerability in The installer of PhishWall Client Firefox and Chrome...7.8 High
- k okada vixUntrusted search path vulnerability in ViX version 2.21.148.0 allows an attacker to gain...7.8 High
- hcl software notesIBM Notes 8.5 and 9.0 could allow an attacker to execute arbitrary code on the system, caused by...7.8 High
- hcl software notesIBM Notes 8.5 and 9.0 is vulnerable to a DLL hijacking attack. A remote attacker could trick a...7.8 High
- schneider electric somove, schneider-electric atv12 dtm, atv212 dtm +10 more +12 moreA DLL hijacking vulnerability exists in Schneider Electric's SoMove Software and associated DTM...7.8 High
- woodybells winshotUntrusted search path vulnerability in WinShot 1.53a and earlier (Installer) allows an attacker...7.8 High
- Show moreLoading…