CWE-426: Untrusted Search Path
The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.
Also known as Untrusted Path.
A kind of CWE-642 External Control of Critical State Data.
From the CWE List. © The MITRE Corporation.
Newest
- wondershare democreatorAn issue found in Wondershare Technology Co., Ltd DemoCreator v.6.0.0 allows a remote attacker to...7.8 High
- wondershare uniconverterAn issue found in Wondershare Technology Co., Ltd UniConverter v.14.0.0 allows a remote attacker...7.8 High
- wondershare filmoraAn issue found in Wondershare Technology Co, Ltd Filmora v.12.0.9 allows a remote attacker to...7.8 High
- wondershare edrawmindAn issue found in Wondershare Technology Co, Ltd Edrawmind v.10.0.6 allows a remote attacker to...7.8 High
- adobe creative cloud, creative cloud (desktop component) +1 moreAdobe Creative Cloud AdobeExtensionService.exe local privilege escalation vulnerability8.6 High
- zoneminderZoneMinder contains Local File Inclusion vulnerability via `web/ajax/modal.php`5.4 Medium
- zoneminderZoneMinder contains Local File Inclusion vulnerability8.1 High
- nodejs node, node.js, debian linux +2 moreAn untrusted search path vulnerability exists in Node.js. <19.6.1, <18.14.1, <16.19.1, and <14.21...4.2 Medium
- elecom camera assistant, quickfiledealer, elecom co.,ltd. camera assistant and quickfiledealer +2 moreUntrusted search path vulnerability in ELECOM Camera Assistant 1.00 and QuickFileDealer Ver.1.2.1...7.8 High
- git-for-windows git, git for windows project for windows +1 moreGit for Windows' installer is susceptible to DLL side loading attacks7.3 High
- git-for-windows git, git for windows project for windows +1 moregitk can inadvertently call executables in the worktree8.6 High
- siemens tia multiuser server v14, tia multiuser server v15, tia project-server +3 more +5 moreA vulnerability has been identified in TIA Multiuser Server V14 (All versions), TIA Multiuser...6.7 Medium
- git-for-windows gitGit clone remote code execution vulnerability in git-for-windows8.6 High
- microsoft libxpmA flaw was found in libXpm. When processing files with .Z or .gz extensions, the library calls...8.8 High
- microsoft exchange server, exchange server 2016 cumulative update 23, exchange server 2019 cumulative update 11 +1 more +3 moreMicrosoft Exchange Server Elevation of Privilege Vulnerability7.8 High
- microsoft exchange server, exchange server 2016 cumulative update 23, exchange server 2019 cumulative update 11 +1 more +3 moreMicrosoft Exchange Server Elevation of Privilege Vulnerability7.8 High
- openstack kolla, openstack +1 moreOpenStack Kolla sudo privilege escalation vulnerability8.8 High
- audinate dante discovery, dante application library +1 moremDNSResponder.exe is vulnerable to DLL Sideloading attack. Executable improperly specifies how to...7.8 High
- opensuse factory, openldap2 +1 moreopenldap2: /usr/lib/openldap/start allows ldap user/group to recursively chown arbitrary directory trees to itself7.1 High
- redisRedis on Windows dbghelp.dll uncontrolled search path6.3 Medium
- litespeed technologies web server, openlitespeed web server, litespeedtech openlitespeed +2 morePrivilege Escalation in OpenLiteSpeed Web Server8.8 High
- sony content transfer, sony corporation content transfer (for windows) +1 moreUntrusted search path vulnerability in the installer of Content Transfer (for Windows) Ver.1.3...7.8 High
- feishuBeijing Feishu Technology Co., Ltd Feishu v3.40.3 was discovered to contain an untrusted search...7.8 High
- makedeb mistMist vulnerable to user providing a Sudo binary for authentication checks8.4 High
- ricoh device software manager, ricoh company, ltd. installer of device software manager +1 moreUntrusted search path vulnerability in the installer of Device Software Manager prior to Ver.2.20...7.8 High
- python-poetry poetryPoetry's Untrusted Search Path can lead to Local Code Execution on Windows7.3 High
- microsoft windows, windows 10 version 1507, windows 10 version 1607 +33 more +35 moreWindows Client Server Run-time Subsystem (CSRSS) Elevation of Privilege Vulnerability7.8 High
- git-for-windows gitGit for Windows' installer can be tricked into executing an untrusted binary8.2 High
- druva insync clientAn issue was discovered in Druva 6.9.0 for MacOS, allows attackers to gain escalated local...7.8 High
- sparklabs viscosityViscosity DLL untrusted search path8.8 High
- avast premium securityAn arbitrary file write vulnerability in Avast Premium Security before v21.11.2500 (build 21.11...7.1 High
- sinatrarb sinatra, debian linux +1 moresinatra does not validate expanded path matches7.5 High
- service project serviceDisputed: OS Command injection in github.com/kardianos/service7.8 High
- git-lfs, git large file storage project large file storage +1 moreGit LFS can execute a binary from the current directory on Windows9.8 Critical
- hibara attachecaseUntrusted search path vulnerability in AttacheCase ver.3.6.1.0 and earlier allows an attacker to...7.8 High
- hibara attachecaseUntrusted search path vulnerability in AttacheCase ver.4.0.2.7 and earlier allows an attacker to...7.8 High
- python-poetry poetryPoetry before v1.1.9 contains Untrusted Search Path9.8 Critical
- pnpmUntrusted Search Path in PNPM8.8 High
- anaconda anaconda3, conda miniconda3 +1 moreAnaconda Anaconda3 through 2021.11.0.0 and Miniconda3 through 11.0.0.0 can create a world...7.8 High
- python, netapp active iq unified manager, ontap select deploy administration utility +3 more +5 moreIn Python before 3.10.3 on Windows, local users can gain privileges because the search path is...7.0 High
- cryptomatorCryptomator through 1.6.5 allows DYLIB injection because, although it has the flag 0x1000 for...7.8 High
- nvidia omniverse launcherNVIDIA Omniverse Launcher contains a Cross-Origin Resource Sharing (CORS) vulnerability which can...9.3 Critical
- acer care centerIn ListCheck.exe in Acer Care Center 4.x before 4.00.3038, a vulnerability in the loading...7.8 High
- palo alto networks cortex xdr agentCortex XDR Agent: Unintended Program Execution When Using Live Terminal Session6.7 Medium
- intel realsense d400 series universal windows platform driverUncontrolled search path in the Intel(R) RealSense(TM) D400 Series UWP driver for Windows 10...7.8 High
- amd radeon softwareAn untrusted search path in AMD Radeon settings Installer may lead to a privilege escalation or...7.8 High
- calibre-ebook calibreA untrusted search path issue was found in Calibre at devices/linux_mount_helper.c leading to the...9.8 Critical
- octopus tentacleWhen Octopus Tentacle is installed using a custom folder location, folder ACLs are not set...7.8 High
- octopus server, deploy +1 moreWhen Octopus Server is installed using a custom folder location, folder ACLs are not set...7.8 High
- dell supportassist client consumer, supportassist for home pcs +1 moreSupportAssist Client version 3.8 and 3.9 contains an Untrusted search path vulnerability that...7.8 High
- Show moreLoading…