CWE-427: Uncontrolled Search Path Element
The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.
Also known as DLL preloading, Binary planting, Insecure library loading.
A kind of CWE-668 Exposure of Resource to Wrong Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- nahimic apo software componentAn escalation of privilege vulnerability in Nahimic APO Software Component Driver 1.4.2, 1.5.0, 1...7.8 High
- faulknermedia wildlife issues in the new millenniumFaulkner Wildlife Issues in the New Millennium 18.0.160 on Windows allows local, low-privileged...7.8 High
- cisco webex teamsCisco Webex Teams Client for Windows DLL Hijacking Vulnerability7.8 High
- cloudflare cloudflaredLocal Privilege Escalation in cloudflared6.4 Medium
- foxitsoftware foxit reader, phantompdf +1 moreAn issue was discovered in Foxit Reader and PhantomPDF before 10.1. It allows attackers to...7.8 High
- eaton 9000x programming and configuration softwareDLL Hijacking7.8 High
- installbuilderInstallBuilder for Qt Windows (versions prior to 20.7.0) installers look for plugins at a...7.8 High
- rapid7 appspiderCode Injection in Rapid7 AppSpider Pro Installer5.8 Medium
- mcafee agent, mcafee llc ma for windows +1 moreDLL Search Order Hijacking in MA for Windows7.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreIf Firefox is installed to a user-writable directory, the Mozilla Maintenance Service would...8.8 High
- tencentThe Shenzhen Tencent app 5.8.2.5300 for PC platforms (from Tencent App Center) has a DLL...7.8 High
- 163 netease mail masterGuangzhou NetEase Mail Master 4.14.1.1004 on Windows has a DLL hijacking vulnerability. Attackers...7.8 High
- tencent timShenzhen Tencent TIM Windows client 3.0.0.21315 has a DLL hijacking vulnerability, which can be...7.8 High
- 163 netease youdao dictionaryNetEase Youdao Dictionary has a DLL hijacking vulnerability, which can be exploited by attackers...7.8 High
- 360 speed browser360 Speed Browser 12.0.1247.0 has a DLL hijacking vulnerability, which can be exploited by...7.8 High
- kaspersky security center, security center web console +1 moreInstallers of Kaspersky Security Center and Kaspersky Security Center Web Console prior to 12 &...7.8 High
- johnkerl millerArbitrary code execution via configuration file in Miller8.2 High
- pivotal software rabbitmq, broadcom rabbitmq server +1 moreRabbitMQ arbitrary code execution using local binary planting6.7 Medium
- adobe lightroomAdobe Lightroom versions 9.2.0.10 and earlier have an insecure library loading vulnerability....7.8 High
- cisco anyconnect secure, anyconnect secure mobility client +1 moreCisco AnyConnect Secure Mobility Client for Windows DLL Hijacking Vulnerability7.8 High
- postgresql, opensuse leap +1 moreIt was found that PostgreSQL versions before 12.4, before 11.9 and before 10.14 did not properly...7.1 High
- zoom sharing serviceA vulnerability related to Dynamic-link Library (“DLL”) loading in the Zoom Sharing Service would...7.8 High
- philips smartcontrolPhilips SmartControl DLL Hijacking7.4 High
- intel rste software raidUncontrolled search path in the installer for Intel(R) RSTe Software RAID Driver for the Intel(R)...7.8 High
- hp elite x2 1012 g1 firmware, elite x2 1012 g2 firmware, elitebook 1030 g1 firmware +11 more +13 moreThe ALPS ALPINE touchpad driver before 8.2206.1717.634, as used on various Dell, HP, and Lenovo...6.7 Medium
- teradici graphics agent, pcoip standard agent +1 moreThe support bundler in Teradici PCoIP Standard Agent for Windows and Graphics Agent for Windows...7.8 High
- mozilla firefox, firefox esr, thunderbird +2 moreFirefox could be made to load attacker-supplied DLL files from the installation directory. This...7.8 High
- seafile seafile-clientThe seafile-client client 7.0.8 for Seafile is vulnerable to DLL hijacking because it loads...7.8 High
- osisoft pi api, pi buffer subsystem, pi connector +6 more +8 moreIn OSIsoft PI System multiple products and versions, a local attacker can modify a search path...7.8 High
- 360totalsecurity 360 total securityIn the version 12.1.0.1005 and below of 360 Total Security, when the Gamefolde calls GameChrome...7.8 High
- 360totalsecurity 360 total securityIn version 12.1.0.1004 and below of 360 Total Security,when TPI calls the browser process, there...7.8 High
- 360totalsecurity 360 total securityIn the version 12.1.0.1004 and below of 360 Total Security, when the main process of 360 Total...7.8 High
- mozilla firefoxWhen the Windows DLL "webauthn.dll" was missing from the Operating System, and a malicious one...7.8 High
- huawei hisuiteEarlier than HiSuite 10.1.0.500 have a DLL hijacking vulnerability. This vulnerability exists due...7.8 High
- python, netapp snapcenter, siemens simatic s7-1500 cpu 1518-4 pn/dp mfp +2 more +4 moreIn Python 3.6 through 3.6.10, 3.7 through 3.7.8, 3.8 through 3.8.4rc1, and 3.9 through 3.9.0b4 on...7.8 High
- atlassian jira server, jira data center +1 moreAffected versions of Atlassian Jira Server and Data Center allow remote attackers to execute...7.8 High
- gitlab gitlab-vscode-extensionClient side code execution in gitlab-vscode-extension v2.2.0 allows attacker to execute code on...8.6 High
- mattermost desktopAn issue was discovered in Mattermost Desktop App before 4.3.0 on macOS. It allows dylib injection.9.8 Critical
- mids\' reborn hero designer project reborn hero designerMids' Reborn Hero Designer 2.6.0.7 has an elevation of privilege vulnerability due to default and...7.8 High
- siemens simatic pcs 7 v8.2 and earlier, simatic pcs 7 v9.0, simatic pdm +6 more +8 moreA vulnerability has been identified in SIMATIC PCS 7 (All versions), SIMATIC PDM (All versions),...7.8 High
- mcafee agent, mcafee, llc mcafee agent (ma) +1 moreDLL search order hijacking in MA5.9 Medium
- bundlerInsecure path handling in Bundler7.8 High
- apple windows migration assistantA dynamic library loading issue was addressed with improved path searching. This issue is fixed...7.8 High
- dell cpg bios, dock wd15 firmware, dock wd19 firmware +2 more +4 moreDell Dock Firmware Update Utilities for Dell Client Consumer and Commercial docking stations...7.1 High
- splashtop software updater, streamer +1 moreA Windows privilege change issue was discovered in Splashtop Software Updater before 1.5.6.16....6.6 Medium
- kerberos project kerberosDLL Injection in kerberos7.8 High
- opto22 softpac projectOpto 22 SoftPAC Project Version 9.6 and prior. SoftPAC does not specify the path of multiple...8.8 High
- fazecast jserialcomm, schneider-electric ecostruxure it gateway +1 moreIn Fazecast jSerialComm, Version 2.2.2 and prior, an uncontrolled search path element...7.8 High
- sap business clientSAP Business Client, version 7.0, allows an attacker after a successful social engineering attack...7.0 High
- lg bridgeAn issue was discovered in LG Bridge before April 2019 on Windows. DLL Hijacking can occur.7.8 High
- Show moreLoading…