CWE-426: Untrusted Search Path
The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.
Also known as Untrusted Path.
A kind of CWE-642 External Control of Critical State Data.
From the CWE List. © The MITRE Corporation.
Newest
- rdbrck shiftRedbrick Shift through 3.4.3 allows an attacker to extract emails of services (such as Gmail,...5.5 Medium
- londontrustmedia private internet access vpn clientA vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v1.0 for...7.8 High
- londontrustmedia private internet access vpn clientA vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v82 for macOS...7.8 High
- huawei hisuiteHiSuite 9.1.0.300 versions and earlier contains a DLL hijacking vulnerability. This vulnerability...5.3 Medium
- omron network configurator for devicenet safetyThe application (Network Configurator for DeviceNet Safety 3.41 and prior) searches for resources...7.8 High
- htc viveportPrivilege escalation due to insecure directory permissions affecting ViveportDesktopService in...7.8 High
- rakuten viberA vulnerability in Viber before 10.7.0 for Desktop (Windows) could allow an attacker to execute...7.8 High
- fortinet forticlient, forticlientwindows +1 moreAn Unsafe Search Path vulnerability in FortiClient Online Installer (Windows version before 6.0.6...8.6 High
- adobe creative cloud desktop application (installer), creative cloud +1 moreCreative Cloud Desktop Application (installer) versions 4.7.0.400 and earlier have an insecure...7.8 High
- fujitsu paperstream ip \(twain\)In PaperStream IP (TWAIN) 1.42.0.5685 (Service Update 7), the FJTWSVIC service running with...7.8 High
- ministry of internal affairs and communications electronic reception and examination of application for radio licenses offline, soumu electronic reception and examination of application for radio licenses +1 moreUntrusted search path vulnerability in Electronic reception and examination of application for...7.8 High
- ministry of internal affairs and communications installer of electronic reception and examination of application for radio licenses online, soumu electronic reception and examination of application for radio licenses +1 moreUntrusted search path vulnerability in Installer of Electronic reception and examination of...7.8 High
- nvidia gpu display driver, geforce experience +1 moreNVIDIA Windows GPU Display driver software for Windows (all versions) contains a vulnerability in...6.7 Medium
- filezilla, debian linux, fedoraproject fedora +1 more +3 moreUntrusted search path in FileZilla before 3.41.0-rc1 allows an attacker to gain privileges via a...7.8 High
- mozilla firefoxOn Android systems, Firefox can load a library from APITRACE_LIB, which is writable by all users...7.4 High
- symantec endpoint protection managerSymantec Endpoint Protection Manager (SEPM) prior to and including 12.1 RU6 MP9 and prior to 14.2...7.8 High
- symantec norton security, endpoint protection, endpoint protection cloud +2 more +4 moreNorton Security (Windows client) prior to 22.16.3 and SEP SBE (Windows client) prior to Cloud...7.8 High
- teamspeakTeamSpeak 3 Client before 3.2.5 allows remote code execution in the Qt framework.8.8 High
- beyondtrust avecto defendpointAvecto Defendpoint 4 prior to 4.4 SR6 and 5 prior to 5.1 SR1 has an Untrusted Search Path...7.5 High
- check point zonealarm point zonealarm, checkpoint zonealarm +1 moreSome of the DLLs loaded by Check Point ZoneAlarm up to 15.4.062 are taken from directories where...5.5 Medium
- lenovo bootable generator, bootable usb +1 moreA DLL search path vulnerability was reported in Lenovo Bootable Generator, prior to version Mar...5.3 Medium
- microsoft visual studio 2017A remote code execution vulnerability exists when the Visual Studio C++ Redistributable Installer...7.8 High
- opera browserOpera before 57.0.3098.106 is vulnerable to a DLL Search Order hijacking attack where an attacker...7.8 High
- barracuda vpn clientThe barracudavpn component of the Barracuda VPN Client prior to version 5.0.2.7 for Linux, macOS,...7.8 High
- microsoft teams, the installer of microsoft teams +1 moreUntrusted search path vulnerability in The installer of Microsoft Teams allows an attacker to...7.8 High
- microsoft windows 7Untrusted search path vulnerability in Windows 7 allows an attacker to gain privileges via a...7.8 High
- micco lhmelting, the installer of lhmelting +1 moreUntrusted search path vulnerability in the installer of LHMelting (LHMelting for Win32 Ver 1.65.3...7.8 High
- micco the installer of unarj32.dll, unarj32.dll +1 moreUntrusted search path vulnerability in the installer of UNARJ32.DLL (UNARJ32.DLL for Win32 Ver 1...7.8 High
- micco the installer of unlha32.dll, unlha32.dll +1 moreUntrusted search path vulnerability in the installer of UNLHA32.DLL (UNLHA32.DLL for Win32 Ver 2...7.8 High
- micco lhmelting, lmlzh32.dll, unarj32.dll +2 more +4 moreUntrusted search path vulnerability in UNARJ32.DLL for Win32, LHMelting for Win32, and LMLzh32...7.8 High
- micco self-extracting archives created by unlha32.dll, unlha32.dll +1 moreUntrusted search path vulnerability in Self-Extracting Archives created by UNLHA32.DLL prior to...7.8 High
- symantec ghost solution suite, symantec corporation ghost solution suite (gss) +1 moreSymantec Ghost Solution Suite (GSS) versions prior to 3.3 RU1 may be susceptible to a DLL...7.3 High
- trend micro security (consumer), trend micro, inc. micro security (consumer), trendmicro antivirus \+ security +3 more +5 moreA DLL hijacking vulnerability in Trend Micro Security 2019 (Consumer) versions below 15.0.0.1163...7.8 High
- mcafee total protection (mtp), total protection +1 moreDLL Search Order Hijacking vulnerability7.2 High
- rakuten securities, inc. the installer of market speed, rakuten-sec market speed +1 moreUntrusted search path vulnerability in the installer of MARKET SPEED Ver.16.4 and earlier allows...7.8 High
- jaea mapping tool, japan atomic energy agency installer of mapping tool +1 moreUntrusted search path vulnerability in Installer of Mapping Tool 2.0.1.6 and 2.0.1.7 allows...7.8 High
- micronet corporation installer of inplc sdk express 3.08 and earlier and installer of inplc sdk pro+ 3.08 and earlier, mnc inplc-rt sdk express, inplc sdk pro\+ +2 moreUntrusted search path vulnerability in Installer of INplc SDK Express 3.08 and earlier and...7.8 High
- ibm i access for windows, i access +1 moreAn untrusted search path vulnerability in IBM i Access for Windows versions 7.1 and earlier on...5.3 Medium
- keybaseAn issue was discovered in the Keybase command-line client before 2.8.0-20181023124437 for Linux....7.8 High
- zte usmartview, zxcloud irai +1 moreAll versions up to ZXCLOUD iRAI V5.01.05 of the ZTE uSmartView product are impacted by untrusted...5.1 Medium
- adobe flash playerFlash Player versions 31.0.0.153 and earlier, and 31.0.0.108 and earlier have an insecure library...7.8 High
- symantec endpoint protection, symantec corporation endpoint protection (sep) +1 moreSymantec Endpoint Protection prior to 14.2 MP1 may be susceptible to a DLL Preloading...7.8 High
- git-scm git, canonical ubuntu linux +1 moreGit before 2.19.2 on Linux and UNIX executes commands from the current working directory (as if '...9.8 Critical
- bestxsoftware best free keyloggerBestXsoftware Best Free Keylogger before 6.0.0 allows local users to gain privileges via a Trojan...7.8 High
- baidu, inc. baidu browser, baidu spark browser +1 moreUntrusted search path vulnerability in Baidu Browser Version 43.23.1000.500 and earlier allows an...7.8 High
- ibm db2, db2 for linux, unix and windows +1 moreIBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1...8.4 High
- adobe framemakerAdobe Framemaker versions 1.0.5.1 and below have an insecure library loading (dll hijacking)...7.8 High
- nomachineNoMachine before 5.3.27 and 6.x before 6.3.6 allows attackers to gain privileges via a Trojan...7.8 High
- naver corporation whale browser installer, navercorp whale +1 moreThe Whale browser installer 0.4.3.0 and earlier versions allows DLL hijacking.7.8 High
- mcafee true key (tk), true key +1 moreTrue Key (TK) - DLL Search Order Hijacking vulnerability7.5 High
- Show moreLoading…