CWE-427: Uncontrolled Search Path Element
The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.
Also known as DLL preloading, Binary planting, Insecure library loading.
A kind of CWE-668 Exposure of Resource to Wrong Sphere.
From the CWE List. © The MITRE Corporation.
Newest
- palo alto networks cortex xdr agentCortex XDR Agent: An Uncontrolled Search Path Element Leads to Local Privilege Escalation (PE) Vulnerability6.7 Medium
- xinje xd/e series plc program tool, xd\/e series plc program tool +1 moreXINJE XD/E Series PLC Program Tool DLL Hijacking7.3 High
- splunk, splunk enterprise +1 moreLocal privilege escalation via a default path in Splunk Enterprise Windows8.8 High
- f5 big-ip apm, big-ip apm clients, big-ip access policy manager +1 more +3 moreOn F5 BIG-IP APM 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x...7.3 High
- sonicwall global vpn clientSonicWall Global VPN Client 4.10.7.1117 installer (32-bit and 64-bit) and earlier versions have a...7.8 High
- samsung gear iconx pc managerDLL hijacking vulnerability in Gear IconX PC Manager prior to version 2.1.220405.51 allows...6.2 Medium
- honor pcmanagerA DLL search path vulnerability was reported in Lenovo PCManager prior to version 4.0.40.2175...7.3 High
- git for windows project for windows, microsoft visual studio 2017 version 15.9 (includes 15.0 - 15.8), visual studio 2019 version 16.11 (includes 16.0 - 16.10) +7 more +9 moreGitHub: Git for Windows' uninstaller vulnerable to DLL hijacking when run under the SYSTEM user account.7.8 High
- siemens simatic energy manager basic, simatic energy manager pro +1 moreA vulnerability has been identified in SIMATIC Energy Manager Basic (All versions < V7.3 Update 1...7.3 High
- git-for-windows git, apple xcode, debian linux +1 more +3 moreUncontrolled search for the Git directory in Git for Windows6.0 Medium
- samsung android usb driver windows installerUncontrolled search path element vulnerability in Samsung Android USB Driver windows installer...5.3 Medium
- samsung updateUncontrolled search path element vulnerability in Samsung Update prior to version 3.0.77.0 allows...5.9 Medium
- samsung kiesDLL hijacking vulnerability in Kies prior to version 2.6.4.22014_2 allows attacker to execute...6.2 Medium
- samsung smart switch pcDLL hijacking vulnerability in Smart Switch PC prior to version 4.2.22022_4 allows attacker to...6.2 Medium
- samsung t5 firmwareA DLL hijacking vulnerability in Samsung portable SSD T5 PC software before 1.6.9 could allow a...7.3 High
- delta electronics diaenergieDelta Electronics DIAEnergie Uncontrolledly Search Path Element7.8 High
- dell alienware update, update, command update +1 more +3 moreDell Command | Update, Dell Update, and Alienware Update versions prior to 4.5 contain a Local...7.8 High
- hibara attachecaseUntrusted search path vulnerability in AttacheCase ver.3.6.1.0 and earlier allows an attacker to...7.8 High
- hibara attachecaseUntrusted search path vulnerability in AttacheCase ver.4.0.2.7 and earlier allows an attacker to...7.8 High
- sandisk professional g-raid 4/8 software utility, westerndigital sandisk professional g-raid 4\/8 software utility, sandisk professional g-raid 4\/8 software utility driver +2 moreSanDisk Professional G-RAID 4/8 Software Utility, Privilege Escalation7.8 High
- razer synapseRazer Synapse before 3.7.0228.022817 allows privilege escalation because it relies on ...7.3 High
- rockwell automation isagraf runtime, rockwellautomation aadvance controller, isagraf free runtime +14 more +16 moreRockwell Automation ISaGRAF5 Runtime Uncontrolled Search Path Element6.7 Medium
- kingsoft wps presentationWPS Presentation 11.8.0.5745 insecurely load d3dx9_41.dll when opening .pps files('current...7.8 High
- kingsoft wps office, kingsoft japan, inc. the installer of wps office +1 moreThe installer of WPS Office Version 10.8.0.5745 insecurely load shcore.dll, allowing an attacker...7.8 High
- kingsoft wps office, kingsoft japan, inc. the installer of wps office +1 moreThe installer of WPS Office Version 10.8.0.6186 insecurely load VERSION.DLL (or some other DLLs),...7.8 High
- fishshell fish, debian linux, fedoraproject fedora +1 more +3 moreInjection in fish7.8 High
- yokogawa centum cs 3000, exaopc, yokogawa electric corporation centum vp +4 more +6 moreThe following Yokogawa Electric products contain insecure DLL loading issues. CENTUM CS 3000...7.8 High
- trend micro password manager, trend micro, inc. micro password manager +1 moreTrend Micro Password Manager (Consumer) installer version 5.0.0.1262 and below is vulnerable to...7.8 High
- trend micro portable securityAn installer search patch element vulnerability in Trend Micro Portable Security 3.0 Pro, 3.0 and...6.5 Medium
- vmware tools, tools for windows +1 moreVMware Tools for Windows (11.x.y and 10.x.y prior to 12.0.0) contains an uncontrolled search path...6.7 Medium
- adobe creative cloud (desktop component), creative cloud desktop application +1 moreAdobe Creative Cloud Desktop Uncontrolled Search Path Element Arbitrary code execution7.0 High
- atlassian confluence server, confluence data center +1 moreAffected versions of Atlassian Confluence Server and Data Center allow authenticated local...7.8 High
- axis ip utilityAXIS IP Utility prior to 4.17.0 allows for remote code execution and local privilege escalation...7.8 High
- acronis vss doctorLocal privilege escalation due to insecure folder permissions7.8 High
- foxit pdf editor, pdf reader +1 moreFoxit PDF Reader before 11.2.1 and Foxit PDF Editor before 11.2.1 have an Uncontrolled Search...9.8 Critical
- kde kate, ktexteditor +1 moreThe LSP (Language Server Protocol) plugin in KDE Kate before 21.12.2 and KTextEditor before 5.91...7.8 High
- sap adaptive server enterpriseSAP Adaptive Server Enterprise (ASE) - version 16.0, installation makes an entry in the system...7.8 High
- intel graphics performance analyzersUncontrolled search path in the Intel(R) GPA software before version 21.2 may allow an...7.8 High
- intel amt ac 8260 firmware, amt ac 8265 firmware, amt ac 9260 firmware +19 more +21 moreUncontrolled Search Path Element in software for Intel(R) PROSet/Wireless Wi-Fi in Windows 10 and...6.7 Medium
- acronis cyber protect home office, true image 2021, true image +2 moreLocal privilege escalation due to DLL hijacking vulnerability in Acronis Media Builder service7.3 High
- acronis cyber protect home office, true image 2021, true image +2 moreLocal privilege escalation due to DLL hijacking vulnerability7.3 High
- amd radeon software, radeon pro software for enterprise, radeon pro software +2 moreAMD Radeon Software may be vulnerable to DLL Hijacking through path variable. An unprivileged...7.8 High
- emerson deltavEmerson DeltaV Uncontrolled Search Path Element8.1 High
- mcafee agent, mcafee,llc mcafee agent for windows +1 morePrivilege escalation vulnerability in McAfee Agent7.8 High
- palo alto networks cortex xdr agentCortex XDR Agent: An Uncontrolled Search Path Element Leads to Local Privilege Escalation (PE) Vulnerability7.8 High
- mcafee techcheck, mcafee,llc mcafee techcheck +1 moreDLL Highjack vulnerability in McAfee TechCheck utility7.4 High
- pypa pipenv, fedoraproject fedora +1 morePipenv's requirements.txt parsing allows malicious index url in comments8.0 High
- checkpoint endpoint securityUsers have access to the directory where the installation repair occurs. Since the MS Installer...7.8 High
- autodesk advance steel, autocad, autocad architecture +10 more +12 moreA Memory Corruption vulnerability may lead to code execution through maliciously crafted DLL...7.8 High
- rapid7 insight agentRapid7 Insight Agent Privilege Escalation7.8 High
- Show moreLoading…