CWE-427: Uncontrolled Search Path Element
The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.
Also known as DLL preloading, Binary planting, Insecure library loading.
A kind of CWE-668 Exposure of Resource to Wrong Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- avast antivirus, avg anti-virus +1 moreAn issue was discovered in Avast antivirus before 19.8 and AVG antivirus before 19.8. A DLL...7.8 High
- trend micro anti-threat toolkit (attk), trendmicro anti-threat toolkit +1 moreTrend Micro Anti-Threat Toolkit (ATTK) versions 1.62.0.1218 and below have a vulnerability that...7.8 High
- nsa ghidraNSA Ghidra before 9.0.2 is vulnerable to DLL hijacking because it loads jansi.dll from the...7.8 High
- hp touchpoint analyticsA potential security vulnerability has been identified with certain versions of HP Touchpoint...6.7 Medium
- dell encryption enterprise, endpoint security suite enterprise, encryption +2 moreThe vulnerability is limited to the installers of Dell Encryption Enterprise versions prior to 10...6.7 Medium
- jetbrains resharperJetBrains ReSharper installers for versions before 2019.2 had a DLL Hijacking vulnerability.7.3 High
- dell client platforms: dell update packages (dup) framework file, update package framework, dell emc servers: all other drivers, bios and firmware: dell update package (dup) framework file +1 more +3 moreAn Uncontrolled Search Path Vulnerability is applicable to the following: Dell Update Package ...6.7 Medium
- adobe application managerAdobe application manager installer version 10.0 have an Insecure Library Loading (DLL hijacking)...7.8 High
- eclipse omr, the eclipse foundation eclipse omr +1 morePrior to 0.1, AIX builds of Eclipse OMR contain unused RPATHs which may facilitate code injection...7.8 High
- ibm db2 high performance unload load for luw, db2 high performance unload load +1 moreIBM DB2 High Performance Unload load for LUW 6.1, 6.1.0.1, 6.1.0.1 IF1, 6.1.0.2, 6.1.0.2 IF1, and...8.4 High
- autodesk autocad, autocad architecture, autocad electrical +8 more +10 moreDLL preloading vulnerability in versions 2017, 2018, 2019, and 2020 of Autodesk Advanced Steel,...7.8 High
- autodesk design reviewDLL preloading vulnerability in Autodesk Design Review versions 2011, 2012, 2013, and 2018. An...7.8 High
- trendmicro ransom buster, trend micro ransom buster, trend micro security (consumer), trendmicro antivirus \+ security 2019 +3 more +5 moreA DLL hijacking vulnerability exists in the Trend Micro Security's 2019 consumer family of...7.8 High
- trend micro password manager, trend micro, inc. micro password manager +1 moreA DLL hijacking vulnerability exists in Trend Micro Password Manager 5.0 in which, if exploited,...7.8 High
- trend micro password manager, trend micro, inc. micro password manager +1 moreA DLL hijacking vulnerability exists in Trend Micro Password Manager 5.0 in which, if exploited,...7.8 High
- rapid7 insightappsecRapid7 InsightAppSec Local Privilege Escalation7.8 High
- adobe premiere pro ccAdobe Premiere Pro CC versions 13.1.2 and earlier have an insecure library loading (dll hijacking...7.8 High
- adobe prelude ccAdobe Prelude CC versions 8.1 and earlier have an insecure library loading (dll hijacking)...7.8 High
- adobe character animatorAdobe Character Animator versions 2.1 and earlier have an insecure library loading (dll hijacking...7.8 High
- adobe after effectsAdobe After Effects versions 16 and earlier have an insecure library loading (dll hijacking)...7.8 High
- ibm javaMultiple binaries in IBM SDK, Java Technology Edition 7, 7R, and 8 on the AIX platform use...8.4 High
- bitdefender antivirus plus, endpoint security tool, internet security +1 more +3 moreAn issue was discovered in Bitdefender products for Windows (Bitdefender Endpoint Security Tool...6.7 Medium
- akeo rufusAkeo Consulting Rufus 3.0 and earlier is affected by: DLL search order hijacking. The impact is:...7.8 High
- adobe dreamweaverAdobe Dreamweaver direct download installer versions 19.0 and below, 18.0 and below have an...7.8 High
- proclima all versions prior to version 8.0.0, schneider-electric proclima +1 moreA CWE-427: Uncontrolled Search Path Element vulnerability exists in ProClima (all versions prior...7.8 High
- rapid7 insight agentRapid7 Insight Agent, version 2.6.3 and prior, suffers from a local privilege escalation due to...7.8 High
- londontrustmedia private internet access vpn clientA vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v82 for Linux...7.8 High
- cisco jabber for windows, jabber +1 moreCisco Jabber for Windows DLL Preloading Vulnerability7.3 High
- pc-doctor toolbox, dell supportassist for business pcs, supportassist for home pcs +2 morePC-Doctor Toolbox before 7.3 has an Uncontrolled Search Path Element.7.8 High
- curl, netapp oncommand insight, oncommand unified manager +9 more +11 moreA non-privileged user or program can put code and a config file in a known non-privileged path ...7.8 High
- londontrustmedia private internet accessA vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client 1.0.2 (build...7.8 High
- zohocorp manageengine analytics plus, manageengine browser security plus, manageengine desktop central +15 more +17 moreMultiple Zoho ManageEngine products suffer from local privilege escalation due to improper...7.8 High
- huawei hisuiteHiSuite 9.1.0.300 versions and earlier contains a DLL hijacking vulnerability. This vulnerability...5.3 Medium
- htc viveportPrivilege escalation due to insecure directory permissions affecting ViveportDesktopService in...7.8 High
- adobe creative cloud desktop application (installer), creative cloud +1 moreCreative Cloud Desktop Application (installer) versions 4.7.0.400 and earlier have an insecure...7.8 High
- pelco videoxpert opscenter, videoxpert opscenter versions prior to 3.1 +1 moreA Uncontrolled Search Path Element (CWE-427) vulnerability exists in VideoXpert OpsCenter...7.8 High
- f-secure client security, computer protection, internet security +2 more +4 moreIn the F-Secure installer in F-Secure SAFE for Windows before 17.6, F-Secure Internet Security...7.8 High
- vmware workstationVMware Workstation (15.x before 15.1.0) contains a DLL hijacking issue because some DLL files are...7.8 High
- nvidia gpu display driver, geforce experience +1 moreNVIDIA Windows GPU Display driver software for Windows (all versions) contains a vulnerability in...6.7 Medium
- ge communicatorGE Communicator, all versions prior to 4.0.517, allows an attacker to place malicious files...7.8 High
- ge communicatorGE Communicator, all versions prior to 4.0.517, allows a non-administrative user to place...7.8 High
- cisco directory connector, meeting server +1 moreCisco Directory Connector Search Order Hijacking Vulnerability5.1 Medium
- gemalto sentinel ultrapro, sentinel ultrapro client library +1 moreThe uncontrolled search path element vulnerability in Gemalto Sentinel UltraPro Client Library...7.8 High
- schneider electric ofs v3.5, schneider-electric opc factory server +1 moreA successful exploit of these vulnerabilities requires the local user to load a crafted DLL file...7.3 High
- putty, opensuse backports sle, leap +2 moreIn PuTTY versions before 0.71 on Windows, local attackers could hijack the application by putting...7.8 High
- ibm db2, db2 for linux, unix and windows +1 moreIBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1...8.4 High
- ibm sdk, runtimes for java technology, websphere application server +1 more +3 moreIBM SDK, Java Technology Edition Version 8 on the AIX platform uses absolute RPATHs which may...5.6 Medium
- golang goGo through 1.12 on Windows misuses certain LoadLibrary functionality, leading to DLL injection.7.8 High
- solarwinds orion platformSolarWinds Orion Platform before 2018.4 Hotfix 2 allows privilege escalation through the RabbitMQ...9.8 Critical
- sublimetext sublime text 3** DISPUTED ** DLL hijacking is possible in Sublime Text 3 version 3.1.1 build 3176 on 32-bit...7.8 High
- Show moreLoading…