CWE-426: Untrusted Search Path
The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.
Also known as Untrusted Path.
A kind of CWE-642 External Control of Critical State Data.
From the CWE List. © The MITRE Corporation.
Newest
- python, netapp max data, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp +2 more +4 moreIn Python 3.8.4, sys.path restrictions specified in a python38._pth file are ignored, allowing...9.8 Critical
- adobe coldfusion 2016, coldfusion 2018, coldfusion +2 moreAdobe ColdFusion 2016 update 15 and earlier versions, and ColdFusion 2018 update 9 and earlier...7.8 High
- adobe coldfusion 2016, coldfusion 2018, coldfusion +2 moreAdobe ColdFusion 2016 update 15 and earlier versions, and ColdFusion 2018 update 9 and earlier...7.8 High
- trend micro security (consumer), trend micro, inc. micro security (consumer), trendmicro antivirus\+ 2020 +3 more +5 moreAn untrusted search path remote code execution (RCE) vulnerability in the Trend Micro Secuity...7.8 High
- microsoft 365 apps, 365 apps for enterprise for 32-bit systems, 365 apps for enterprise for 64-bit systems +2 moreA remote code execution vulnerability exists when Microsoft Office improperly validates input...7.8 High
- linuxfoundation osqueryosquery susceptible to DLL search order hijacking of zlib1.dll5.3 Medium
- huawei hisuiteEarlier than HiSuite 10.1.0.500 have a DLL hijacking vulnerability. This vulnerability exists due...7.8 High
- atlassian jira server, jira data center +1 moreAffected versions of Atlassian Jira Server and Data Center allow remote attackers to execute...7.8 High
- cymiinstaller322 activex project activex, tobesoft.co.ltd miplatform +1 moreTo be able to change Dll Files to preload with missing support for integrity check vulnerability MIPLATFORM ActiveX of TOBESOFT.CO.LTD,7.2 High
- adobe coldfusionColdFusion versions ColdFusion 2016, and ColdFusion 2018 have a dll search-order hijacking...7.8 High
- mcafee host intrusion prevention, mcafee, llc mcafee host intrusion prevention system (host ips) for windows +1 moreDLL search order hijacking in Host IPS4.6 Medium
- lenovo installation packages, installation package +1 moreA symbolic link vulnerability in some Lenovo installation packages, prior to version 1.2.9.3,...6.7 Medium
- lenovo installation packages, installation package +1 moreA DLL search path vulnerability could allow privilege escalation in some Lenovo installation...6.7 Medium
- foxitsoftware phantompdfAn issue was discovered in Foxit PhantomPDF before 8.3.6. It has an untrusted search path that...7.8 High
- foxitsoftware foxit studio photoAn issue was discovered in Foxit Studio Photo before 3.6.6.922. It allows local users to gain...7.8 High
- foxitsoftware foxit studio photoAn issue was discovered in Foxit Studio Photo before 3.6.6.922. It allows local users to gain...7.8 High
- atlassian companion, companion app +1 moreThe file editing functionality in the Atlassian Companion App before version 1.0.0 allows local...7.8 High
- schneider-electric vijeo designerA CWE-426: Untrusted Search Path vulnerability exists in Vijeo Designer Basic (V1.1 HotFix 15 and...7.8 High
- google earth, earth pro +1 moreDLL Hijacking in Google Earth Pro Windows installer7.8 High
- autodesk dynamo bimAn improper signature validation vulnerability in Autodesk Dynamo BIM versions 2.5.1 and 2.5.0...7.8 High
- lg pc suiteAn issue was discovered in LG PC Suite for LG G3 and earlier (aka LG PC Suite v5.3.27 and earlier...7.8 High
- intel binary configuration toolUncontrolled search path in the installer for the Intel(R) Binary Configuration Tool for Windows,...7.8 High
- bitdefender high-level antimalware sdk for windows, antimalware software development kit +1 moreUntrusted Search Path Vulnerability in High-Level Antimalware SDK6.3 Medium
- malwarebytes adwcleanerAn Untrusted Search Path vulnerability in Malwarebytes AdwCleaner 8.0.3 could cause arbitrary...7.8 High
- mcafee application and change control, mcafee, llc mcafee application and change control (macc) +1 moreMACC installer DLL side loading7.3 High
- adobe acrobat and reader, acrobat dc, acrobat reader dc +2 moreAdobe Acrobat and Reader versions 2020.006.20034 and earlier, 2017.011.30158 and earlier, 2017...7.8 High
- schneider-electric ulti zigbee installation toolkitA CWE-426: Untrusted Search Path vulnerability exists in ZigBee Installation Kit (Versions prior...7.8 High
- fortinet forticlient emergency management server, forticlientems +1 moreAn Unsafe Search Path vulnerability in FortiClient EMS online installer 6.2.1 and below may allow...7.5 High
- fortinet forticlient, forticlient virtual private network, forticlientwindows +2 moreAn Unsafe Search Path vulnerability in FortiClient for Windows online installer 6.2.3 and below...7.1 High
- nvidia gpu display driver, geforce experience, quadro firmware +1 more +3 moreNVIDIA Windows GPU Display Driver, all versions, contains a vulnerability in the NVIDIA Control...7.8 High
- redsoftware pdfescapeAn untrusted search path vulnerability in the installer of PDFescape Desktop version 4.0.22 and...7.8 High
- ultraeditAn issue was discovered in IDM UltraEdit through 24.10.0.32. To exploit the vulnerability, on...7.8 High
- opensmtpd, canonical ubuntu linux, fedoraproject fedora +2 moreOpenSMTPD before 6.6.4 allows local users to read arbitrary files (e.g., on some Linux...4.7 Medium
- goverlan client agent, reach console, reach server +2 moreGoverlan Reach Console before 9.50, Goverlan Reach Server before 3.50, and Goverlan Client Agent...7.8 High
- xilisoft video converterXilisoft Video Converter Ultimate 7.8.1 build-20140505 has a DLL Hijacking vulnerability7.8 High
- umplayerA Code Execution Vulnerability exists in UMPlayer 0.98 in wintab32.dll due to insufficient path...7.8 High
- daum potplayerPotplayer prior to 1.5.39659: DLL Loading Arbitrary Code Execution Vulnerability7.8 High
- qt, redhat enterprise linux +1 moreUncontrolled search path in the QT Library before 5.14.0, 5.12.7 and 5.9.10 may allow an...7.3 High
- atlassian confluence, confluence data center, confluence server +2 moreThe usage of Tomcat in Confluence on the Microsoft Windows operating system before version 7.0.5,...7.8 High
- atlassian jira serverThe usage of Tomcat in Jira before version 8.5.2 allows local attackers with permission to write...7.8 High
- ibm java, sdk, websphere application server +2 moreIBM SDK, Java Technology Edition Version 7.0.0.0 through 7.0.10.55, 7.1.0.0 through 7.1.4.55, and...7.2 High
- trend micro anti-threat toolkit (attk), trendmicro anti-threat toolkit +1 moreTrend Micro Anti-Threat Toolkit (ATTK) versions 1.62.0.1218 and below have a vulnerability that...7.8 High
- bitdefender endpoint security tools, epsecurityservice.exe +1 moreUntrusted Search Path vulnerability in EPSecurityService.exe (VA-3500)5.3 Medium
- bitdefender bdserviceshost.exe, total security 2020 +1 moreUntrusted Search Path vulnerability in Bitdefender Total Security 2020 (VA-5895)5.2 Medium
- gonitro nitropdfNitro PDF 8.5.0.26: A specially crafted DLL file can facilitate Arbitrary Code Execution7.8 High
- symantec vip access desktopA code-execution vulnerability exists during startup in jhi.dll and otpiha.dll in Symantec VIP...7.8 High
- information-technology promotion agency, japan (ipa) stamp workbench installer, ipa stamp workbench +1 moreUntrusted search path vulnerability in STAMP Workbench installer all versions allows an attacker...7.8 High
- vmware horizon view agent, workstation +1 moreVMware Workstation (15.x prior to 15.5.1) and Horizon View Agent (7.10.x prior to 7.10.1 and 7.5...7.8 High
- malwarebytes adwcleanerAn Untrusted Search Path vulnerability in Malwarebytes AdwCleaner before 8.0.1 could cause...7.8 High
- abb pb610 panel builder 600ABB PB610 HMIStudio accepts malicious DLL file in an application7.1 High
- Show moreLoading…