CWE-427: Uncontrolled Search Path Element
The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.
Also known as DLL preloading, Binary planting, Insecure library loading.
A kind of CWE-668 Exposure of Resource to Wrong Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- rockwellautomation drivetools sp, drivetools add-on profiles +1 moreRockwell Automation DriveTools SP v5.13 and below and Drives AOP v4.12 and below both contain a...7.8 High
- utimaco block-safe firmware, cryptoserver cp5 firmware, cryptoserver cp5 vs-nfd firmware +3 more +5 moreMultiple files and folders in Utimaco SecurityServer 4.20.0.4 and 4.31.1.0. are installed with...7.8 High
- dell supportassist client, supportassist client promanage, supportassist for business pcs +1 more +3 moreDell SupportAssist Client for Consumer PCs versions 3.7.x, 3.6.x, 3.4.x, 3.3.x, Dell...7.8 High
- ntt technocross corporation installer of magicconnect client program, ntt-tx magicconnect +1 moreUntrusted search path vulnerability in Installer of MagicConnect Client program distributed...7.8 High
- owncloud desktop clientownCloud owncloud/client before 2.7 allows DLL Injection. The desktop client loaded development...7.8 High
- cisco anyconnect secure mobility clientCisco AnyConnect Secure Mobility Client for Windows with VPN Posture (HostScan) Module DLL Hijacking Vulnerability7.8 High
- intel optane dc persistent memory module managementUncontrolled search path in the Intel(R) Optane(TM) DC Persistent Memory installer for Windows*...7.3 High
- intel trace analyzer and collectorUncontrolled search path in the Intel(R) Trace Analyzer and Collector before version 2020 update...7.8 High
- siemens pcs neo (administration console), tia portal, simatic process control system neo +1 more +3 moreA vulnerability has been identified in PCS neo (Administration Console) (V3.0), TIA Portal (V15,...7.8 High
- acronis true imageAcronis True Image for Windows prior to 2021 Update 3 allowed local privilege escalation due to a...7.8 High
- trend micro housecall for home networks, trend micro, inc. micro housecall for home networks +1 moreA DLL hijacking vulnerability Trend Micro HouseCall for Home Networks version 5.3.1063 and below...7.8 High
- golang go, fedoraproject fedora, netapp cloud insights telegraf agent +1 more +3 moreGo before 1.14.14 and 1.15.x before 1.15.7 on Windows is vulnerable to Command Injection and...7.5 High
- cisco advanced malware protection for endpoints, immunet, amp for endpoints +2 moreCisco Advanced Malware Protection for Endpoints and Immunet for Windows DLL Hijacking Vulnerability7.8 High
- adobe illustratorUncontrolled search path element vulnerability in Illustrator 25.0 could lead to arbitrary code execution7.0 High
- adobe animateUncontrolled Search Path Element vulnerability in Animate 21.07.0 High
- adobe incopyUncontrolled search path element in Adobe InCopy7.0 High
- adobe captivateUncontrolled Search Path Element in Adobe Captivate 20197.0 High
- cisco proximityCisco Proximity Desktop for Windows DLL Hijacking Vulnerability4.8 Medium
- cisco anyconnect secure mobility clientCisco AnyConnect Secure Mobility Client for Windows DLL Injection Vulnerability7.8 High
- sky co., ltd. skysea client viewUntrusted search path vulnerability in the installer of SKYSEA Client View Ver.1.020.05b to Ver...7.8 High
- safervpnSaferVPN for Windows Ver 5.0.3.3 through 5.0.4.15 could allow local privilege escalation from low...7.8 High
- anydeskAnyDesk before 6.1.0 on Windows, when run in portable mode on a system where the attacker has...7.8 High
- epson epsonnet setupmanager, offirio synergyware printdirector, seiko epson corporation epsonnet setupmanager and offirio synergyware printdirector +2 moreUntrusted search path vulnerability in self-extracting files created by EpsonNet SetupManager...7.8 High
- dlink dsl2888a firmwareAn issue was discovered on D-Link DSL-2888A devices with firmware prior to AU_2.31_V1.1.47ae55....6.5 Medium
- westerndigital dashboardWestern Digital Dashboard before 3.2.2.9 allows DLL Hijacking that leads to compromise of the...7.8 High
- adobe preludeUncontrolled Search Path Element in Adobe Prelude for Windows7.0 High
- adobe lightroomUncontrolled Search Path Element vulnerability in Lightroom Classic 10.07.0 High
- palo alto networks cortex xdr agentCortex XDR Agent: Improper control of loaded DLL leads to local privilege escalation7.8 High
- kaspersky anti-ransomware toolThe installer of Kaspersky Anti-Ransomware Tool (KART) prior to KART 4.0 Patch C was vulnerable...7.8 High
- canonical snapcraft, ubuntu linux +1 moresnapcraft may build snaps with incorrect LD_LIBRARY_PATH6.8 Medium
- check point endpoint security client for windows, checkpoint endpoint security +1 moreCheck Point Endpoint Security Client for Windows before version E84.20 allows write access to the...7.8 High
- cyberark endpoint privilege managerCyberArk Endpoint Privilege Manager (EPM) 11.1.0.173 allows attackers to bypass a Credential...5.5 Medium
- seiko epson corporation the installers of multiple seiko epson products, epson album print, color calibration utility +31 more +33 moreUntrusted search path vulnerability in the installers of multiple SEIKO EPSON products allows an...7.8 High
- intel vtune profilerUncontrolled search path in the Intel(R) VTune(TM) Profiler before version 2020 Update 1 may...7.8 High
- intel scs add-on for microsoft sccmUncontrolled search path in Intel(R) SCS Add-on for Microsoft* SCCM before version 2.1.10 may...7.8 High
- ivanti endpoint managerVarious components in Ivanti Endpoint Manager through 2020.1.1 rely on Windows search order when...7.8 High
- nvidia geforce now, geforce now application +1 moreNVIDIA GeForce NOW application software on Windows, all versions prior to 2.0.25.119, contains a...7.8 High
- b. braun melsungen ag onlinesuite, bbraun onlinesuite application package +1 moreB. Braun OnlineSuite7.8 High
- git large file storage project large file storageGit LFS can execute a Git binary from the current directory9.8 Critical
- ea originA vulnerability exists in the Origin Client that could allow a non-Administrative user to elevate...7.8 High
- sonicwall global vpn clientSonicWall Global VPN client version 4.10.4.0314 and earlier have an insecure library loading (DLL...8.6 High
- nvidia geforce experience, geforce experience software +1 moreNVIDIA GeForce Experience, all versions prior to 3.20.5.70, contains a vulnerability in NVIDIA...7.8 High
- adobe media encoderUncontrolled Search Path in Adobe Media Encoder for Windows7.0 High
- adobe premiere, premiere pro +1 moreUncontrolled Search Path in Adobe Premiere Pro for Windows7.0 High
- adobe photoshopUncontrolled Search Path Element in Adobe Photoshop for Windows7.0 High
- adobe after effectsUncontrolled Search Path Element in Adobe After Effects for Windows7.0 High
- adobe dreamweaverPrivilege escalation vulnerability in Dreamweaver version 20.27.5 High
- adobe creative cloud, creative cloud (desktop component) +1 moreUncontrolled Search Path in Creative Cloud Desktop Application7.0 High
- lenovo hardware scan, vantage hardwarescan plugin +1 moreA DLL search path vulnerability was reported in the Lenovo HardwareScan Plugin for the Lenovo...7.3 High
- getmonero moneromonero-wallet-gui in Monero GUI 0.17.0.1 includes the . directory in an embedded RPATH (with a...7.8 High
- Show moreLoading…