cve.bz

CWE-426: Untrusted Search Path, page 9

Filter

The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.

What the weakness is: CWE-426 at MITRE. OWASP Top 10: A08:2025 Software or Data Integrity Failures

Related attack patterns (CAPEC): 1
  • CAPEC-38 Leveraging/Manipulating Configuration File Search Paths Likelihood: High · Severity: Very High

The attack patterns MITRE's CAPEC relates to CWE-426, as MITRE names them. Credits.

Ask an AI about CWE-426

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-426: Untrusted Search Path and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/426.html and https://cve.bz/cve/cwe/426?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 6.5CVE-2019-4732EPSS 0.5%

    IBM SDK, Java Technology Edition Version 7.0.0.0 through 7.0.10.55, 7.1.0.0 through 7.1.4.55, and 8.0.0.0 through 8.0.6.0 could allow a local authenticated attacker to execute arbitrary code on the system, caused by DLL search order hijack…

  2. 7.8CVE-2019-20358EPSS 4.6%

    Trend Micro Anti-Threat Toolkit (ATTK) versions 1.62.0.1218 and below have a vulnerability that may allow an attacker to place malicious files in the same directory, potentially leading to arbitrary remote code execution (RCE) when execute…

  3. 7.8CVE-2019-17099EPSS 0.7%

    An Untrusted Search Path vulnerability in EPSecurityService.exe as used in Bitdefender Endpoint Security Tools versions prior to 6.6.11.163 allows an attacker to load an arbitrary DLL file from the search path. This issue affects: Bitdefen…

  4. 6.5CVE-2019-17100EPSS 0.3%

    An Untrusted Search Path vulnerability in bdserviceshost.exe as used in Bitdefender Total Security 2020 allows an attacker to execute arbitrary code. This issue does not affect: Bitdefender Total Security versions prior to 24.0.12.69.

  5. 7.8CVE-2013-2773EPSS 0.4%

    Nitro PDF 8.5.0.26: A specially crafted DLL file can facilitate Arbitrary Code Execution

  6. 7.8CVE-2016-6593EPSS 0.8%

    A code-execution vulnerability exists during startup in jhi.dll and otpiha.dll in Symantec VIP Access Desktop before 2.2.2, which could let local malicious users execute arbitrary code.

  7. 7.8CVE-2019-6019EPSS 0.8%

    Untrusted search path vulnerability in STAMP Workbench installer all versions allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.

  8. 7.8CVE-2019-19929EPSS 0.9%

    An Untrusted Search Path vulnerability in Malwarebytes AdwCleaner before 8.0.1 could cause arbitrary code execution with SYSTEM privileges when a malicious DLL library is loaded by the product.

  9. 7.8CVE-2019-18996EPSS 0.4%

    Path settings in HMIStudio component of ABB PB610 Panel Builder 600 versions 2.8.0.424 and earlier accept DLLs outside of the program directory, potentially allowing an attacker with access to the local file system the execution of code in…

  10. 7.8CVE-2019-8801EPSS 0.4%

    A dynamic library loading issue existed in iTunes setup. This was addressed with improved path searching. This issue is fixed in macOS Catalina 10.15.1, iTunes for Windows 12.10.2. Running the iTunes installer in an untrusted directory may…

  11. 7.8CVE-2019-14599EPSS 0.3%

    Unquoted service path in Control Center-I version 2.1.0.0 and earlier may allow an authenticated user to potentially enable escalation of privilege via local access.

  12. 7.8CVE-2019-4606EPSS 0.4%

    IBM DB2 High Performance Unload load for LUW 6.1 and 6.5 could allow a local attacker to execute arbitrary code on the system, caused by an untrusted search path vulnerability. By using a executable file, an attacker could exploit this vul…

  13. 7.8CVE-2019-15628EPSS 0.5%

    Trend Micro Security (Consumer) 2020 (v16.0.1221 and below) is affected by a DLL hijacking vulnerability that could allow an attacker to use a specific service as an execution and/or persistence mechanism which could execute a malicious pr…

  14. 7.8CVE-2019-17446EPSS 0.3%

    An issue was discovered in Eracent EPA Agent through 10.2.26. The agent executable, when installed for non-root operations (scanning), can be used to start external programs with elevated permissions because of an Untrusted Search Path.

  15. 7.8CVE-2019-6189EPSS 0.3%

    A potential vulnerability was reported in Lenovo System Interface Foundation versions before v1.1.18.3 that could allow an administrative user to load an unsigned DLL.

  16. 7.3CVE-2019-16861EPSS 0.4%

    Code42 server through 7.0.2 for Windows has an Untrusted Search Path. In certain situations, a non-administrative attacker on the local server could create or modify a dynamic-link library (DLL). The Code42 service could then load it at ru…

  17. 7.3CVE-2019-16860EPSS 0.4%

    Code42 app through version 7.0.2 for Windows has an Untrusted Search Path. In certain situations, a non-administrative attacker on the local machine could create or modify a dynamic-link library (DLL). The Code42 service could then load it…

  18. 6.7CVE-2019-3648EPSS 0.7%

    A Privilege Escalation vulnerability in the Microsoft Windows client in McAfee Total Protection 16.0.R22 and earlier allows administrators to execute arbitrary code via carefully placing malicious files in specific locations protected by a…

  19. 6.7CVE-2019-18196EPSS 0.6%

    A DLL side loading vulnerability in the Windows Service in TeamViewer versions up to 11.0.133222 (fixed in 11.0.214397), 12.0.181268 (fixed in 12.0.214399), 13.2.36215 (fixed in 13.2.36216), and 14.6.4835 (fixed in 14.7.1965) on Windows co…

  20. 7.8CVE-2019-17664EPSS 0.4%

    NSA Ghidra through 9.0.4 uses a potentially untrusted search path. When executing Ghidra from a given path, the Java process working directory is set to this path. Then, when launching the Python interpreter via the "Ghidra Codebrowser > W…

  21. 6.7CVE-2019-17449EPSS 0.4%

    Avira Software Updater before 2.0.6.21094 allows a DLL side-loading attack. NOTE: The vendor thinks that this vulnerability is invalid because exploiting it would require at least administrator privileges and would gain only SYSTEM privile…

  22. 7.3CVE-2019-3745EPSS 0.3%

    The vulnerability is limited to the installers of Dell Encryption Enterprise versions prior to 10.4.0 and Dell Endpoint Security Suite Enterprise versions prior to 2.4.0. This issue is exploitable only during the installation of the produc…

  23. 7.8CVE-2019-14960EPSS 0.3%

    JetBrains Rider before 2019.1.2 was using an unsigned JetBrains.Rider.Unity.Editor.Plugin.Repacked.dll file.

  24. 7.8CVE-2019-13357EPSS 0.6%

    In Total Defense Anti-virus 9.0.0.773, resource acquisition from the untrusted search path C:\ used by caschelp.exe allows local attackers to hijack ccGUIFrm.dll, which leads to code execution. SYSTEM-level code execution can be achieved w…

  25. 7.8CVE-2019-6826EPSS 1.2%

    A CWE-426: Untrusted Search Path vulnerability exists in SoMachine HVAC v2.4.1 and earlier versions, which could cause arbitrary code execution on the system running SoMachine HVAC when a malicious DLL library is loaded by the product.

  26. 7.8CVE-2019-11660ExploitEPSS 7.8%

    Privileges manipulation in Micro Focus Data Protector, versions 10.00, 10.01, 10.02, 10.03, 10.04, 10.10, 10.20, 10.30, 10.40. This vulnerability could be exploited by a low-privileged user to execute a custom binary with higher privileges.

  27. 6.5CVE-2019-3646EPSS 1.5%

    DLL Search Order Hijacking vulnerability in Microsoft Windows client in McAfee Total Protection (MTP) Free Antivirus Trial 16.0.R18 and earlier allows local users to execute arbitrary code via execution from a compromised folder placed by …

  28. 7.8CVE-2019-8461EPSS 1.1%

    Check Point Endpoint Security Initial Client for Windows before version E81.30 tries to load a DLL placed in any PATH location on a clean image without Endpoint Client installed. An attacker can leverage this to gain LPE using a specially …

  29. 7.8CVE-2019-15295EPSS 1.4%

    An Untrusted Search Path vulnerability in the ServiceInstance.dll library versions 1.0.15.119 and lower, as used in Bitdefender Antivirus Free 2020 versions prior to 1.0.15.138, allows an attacker to load an arbitrary DLL file from the sea…

  30. 7.8CVE-2019-6165EPSS 0.4%

    A DLL search path vulnerability was reported in PaperDisplay Hotkey Service version 1.2.0.8 that could allow privilege escalation. Lenovo has ended support for PaperDisplay Hotkey software as the Night light feature introduced in Windows 1…

  31. 7.8CVE-2019-5631EPSS 1.1%

    The Rapid7 InsightAppSec broker suffers from a DLL injection vulnerability in the 'prunsrv.exe' component of the product. If exploited, a local user of the system (who must already be authenticated to the operating system) can elevate thei…

  32. 7.5CVE-2016-10837EPSS 1.5%

    cPanel before 11.54.0.4 allows arbitrary code execution because of an unsafe @INC path (SEC-46).

  33. 7.8CVE-2019-9492EPSS 0.6%

    A DLL side-loading vulnerability in Trend Micro OfficeScan 11.0 SP1 and XG could allow an authenticated attacker to gain code execution and terminate the product's process - disabling endpoint protection. The attacker must have already gai…

  34. 7.8CVE-2019-1010100EPSS 1.3%

    Akeo Consulting Rufus 3.0 and earlier is affected by: DLL search order hijacking. The impact is: Arbitrary code execution WITH escalation of privilege. The component is: Executable installers, portable executables (ALL executables on the w…

  35. 8.8CVE-2019-13637EPSS 2.6%

    In LogMeIn join.me before 3.16.0.5505, an attacker could execute arbitrary commands on a targeted system. This vulnerability is due to unsafe search paths used by the application URI that is defined in Windows. An attacker could exploit th…

  36. 5.5CVE-2019-12912EPSS 0.4%

    Redbrick Shift through 3.4.3 allows an attacker to extract emails of services (such as Gmail, Outlook, etc.) used in the application.

  37. 7.8CVE-2019-12576EPSS 0.9%

    A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v82 for macOS could allow an authenticated, local attacker to run arbitrary code with elevated privileges. The openvpn_launcher binary is setuid root. This …

  38. 7.8CVE-2019-12574EPSS 2.1%

    A vulnerability in the London Trust Media Private Internet Access (PIA) VPN Client v1.0 for Windows could allow an authenticated, local attacker to run arbitrary code with elevated privileges. The PIA client is vulnerable to a DLL injectio…

  39. 7.8CVE-2019-10971EPSS 1.1%

    The application (Network Configurator for DeviceNet Safety 3.41 and prior) searches for resources by means of an untrusted search path that could execute a malicious .dll file not under the application's direct control and outside the inte…

  40. 7.8CVE-2019-12569EPSS 15%

    A vulnerability in Viber before 10.7.0 for Desktop (Windows) could allow an attacker to execute arbitrary commands on a targeted system. This vulnerability is due to unsafe search paths used by the application URI. An attacker could exploi…

  41. 8.8CVE-2019-5589EPSS 1.0%

    A untrusted search path vulnerability in Fortinet may allow attacker to execute unauthorized code or commands via network exploitable

  42. 7.8CVE-2018-16156ExploitEPSS 2.6%

    In PaperStream IP (TWAIN) 1.42.0.5685 (Service Update 7), the FJTWSVIC service running with SYSTEM privilege processes unauthenticated messages received over the FjtwMkic_Fjicube_32 named pipe. One of these message processing functions att…

  43. 7.8CVE-2019-5958EPSS 0.9%

    Untrusted search path vulnerability in Electronic reception and examination of application for radio licenses Offline 1.0.9.0 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.

  44. 7.8CVE-2019-5957EPSS 0.9%

    Untrusted search path vulnerability in Installer of Electronic reception and examination of application for radio licenses Online 1.0.9.0 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.

  45. 7.8CVE-2019-5429EPSS 2.8%

    Untrusted search path in FileZilla before 3.41.0-rc1 allows an attacker to gain privileges via a malicious 'fzsftp' binary in the user's home directory.

  46. 7.4CVE-2019-9798EPSS 0.9%

    On Android systems, Firefox can load a library from APITRACE_LIB, which is writable by all users and applications. This could allow malicious third party applications to execute a man-in-the-middle attack if a malicious code was written to…

  47. 7.8CVE-2018-18367EPSS 1.7%

    Symantec Endpoint Protection Manager (SEPM) prior to and including 12.1 RU6 MP9 and prior to 14.2 RU1 may be susceptible to a DLL Preloading vulnerability, which is a type of issue that can occur when an application looks to call a DLL for…

  48. 7.8CVE-2018-18369EPSS 2.4%

    Norton Security (Windows client) prior to 22.16.3 and SEP SBE (Windows client) prior to Cloud Agent 3.00.31.2817, NIS-22.15.2.22 & SEP-12.1.7484.7002, may be susceptible to a DLL Preloading vulnerability, which is a type of issue that can …

  49. 8.8CVE-2019-11351EPSS 3.9%

    TeamSpeak 3 Client before 3.2.5 allows remote code execution in the Qt framework.

  50. 5.5CVE-2019-8453EPSS 0.3%

    Some of the DLLs loaded by Check Point ZoneAlarm up to 15.4.062 are taken from directories where all users have write permissions. This can allow a local attacker to replace a DLL file with a malicious one and cause Denial of Service to th…