cve.bz

CWE-427: Uncontrolled Search Path Element, page 11

Filter

The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.

What the weakness is: CWE-427 at MITRE

Related attack patterns (CAPEC): 2
  • CAPEC-38 Leveraging/Manipulating Configuration File Search Paths Likelihood: High · Severity: Very High
  • CAPEC-471 Search Order Hijacking Severity: Medium

The attack patterns MITRE's CAPEC relates to CWE-427, as MITRE names them. Credits.

Ask an AI about CWE-427

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-427: Uncontrolled Search Path Element and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/427.html and https://cve.bz/cve/cwe/427?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.8CVE-2024-5929EPSS 0.4%

    VIPRE Advanced Security PMAgent Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of VIPRE Advanced Security. An attacker m…

  2. 8.5CVE-2024-7886EPSS 0.2%

    A vulnerability has been found in Scooter Software Beyond Compare up to 3.3.5.15075 and classified as critical. Affected by this vulnerability is an unknown functionality in the library 7zxa.dll. The manipulation leads to uncontrolled sear…

  3. 5.4CVE-2024-29015EPSS 0.1%

    Uncontrolled search path in some Intel(R) VTune(TM) Profiler software before versions 2024.1 may allow an authenticated user to potentially enable escalation of privilege via local access.

  4. 5.4CVE-2024-28953EPSS 0.1%

    Uncontrolled search path in some EMON software before version 11.44 may allow an authenticated user to potentially enable escalation of privilege via local access.

  5. 5.4CVE-2024-28887EPSS 0.1%

    Uncontrolled search path in some Intel(R) IPP software before version 2021.11 may allow an authenticated user to potentially enable escalation of privilege via local access.

  6. 5.4CVE-2024-28876EPSS 0.1%

    Uncontrolled search path for some Intel(R) MPI Library software before version 2021.12 may allow an authenticated user to potentially enable escalation of privilege via local access.

  7. 5.4CVE-2024-28172EPSS 0.1%

    Uncontrolled search path for some Intel(R) Trace Analyzer and Collector software before version 2022.1 may allow an authenticated user to potentially enable escalation of privilege via local access.

  8. 5.4CVE-2024-28046EPSS 0.1%

    Uncontrolled search path in some Intel(R) GPA software before version 2024.1 may allow an authenticated user to potentially enable escalation of privilege via local access.

  9. 5.4CVE-2024-26027EPSS 0.1%

    Uncontrolled search path for some Intel(R) Simics Package Manager software before version 1.8.3 may allow an authenticated user to potentially enable escalation of privilege via local access.

  10. 5.4CVE-2024-24977EPSS 0.1%

    Uncontrolled search path for some Intel(R) License Manager for FLEXlm product software before version 11.19.5.0 may allow an authenticated user to potentially enable escalation of privilege via local access.

  11. 5.4CVE-2024-23909EPSS 0.1%

    Uncontrolled search path in some Intel(R) FPGA SDK for OpenCL(TM) software technology may allow an authenticated user to potentially enable escalation of privilege via local access.

  12. 5.4CVE-2024-23907EPSS 0.1%

    Uncontrolled search path in some Intel(R) High Level Synthesis Compiler software before version 23.4 may allow an authenticated user to potentially enable escalation of privilege via local access.

  13. 5.4CVE-2024-23491EPSS 0.2%

    Uncontrolled search path in some Intel(R) Distribution for GDB software before version 2024.0.1 may allow an authenticated user to potentially enable escalation of privilege via local access.

  14. 5.4CVE-2024-23489EPSS 0.2%

    Uncontrolled search path for some Intel(R) VROC software before version 8.6.0.1191 may allow an authenticated user to potentially enable escalation of privilege via local access.

  15. 5.4CVE-2024-22376EPSS 0.2%

    Uncontrolled search path element in some installation software for Intel(R) Ethernet Adapter Driver Pack before version 28.3 may allow an authenticated user to potentially enable escalation of privilege via local access.

  16. 5.4CVE-2024-22184EPSS 0.1%

    Uncontrolled search path for some Intel(R) Quartus(R) Prime Pro Edition Design Software before version 24.1 may allow an authenticated user to potentially enable escalation of privilege via local access.

  17. 5.4CVE-2024-21857EPSS 0.2%

    Uncontrolled search path for some Intel(R) oneAPI Compiler software before version 2024.1 may allow an authenticated user to potentially enable escalation of privilege via local access.

  18. 5.4CVE-2024-21784EPSS 0.1%

    Uncontrolled search path for some Intel(R) IPP Cryptography software before version 2021.11 may allow an authenticated user to potentially enable escalation of privilege via local access.

  19. 5.4CVE-2024-21769EPSS 0.2%

    Uncontrolled search path in some Intel(R) Ethernet Connection I219-LM install software may allow an authenticated user to potentially enable escalation of privilege via local access.

  20. 5.4CVE-2024-21766EPSS 0.2%

    Uncontrolled search path for some Intel(R) oneAPI Math Kernel Library software before version 2024.1 may allow an authenticated user to potentially enable escalation of privilege via local access.

  21. 7.8CVE-2023-31348EPSS 0.2%

    A DLL hijacking vulnerability in AMD μProf could allow an attacker to achieve privilege escalation, potentially resulting in arbitrary code execution.

  22. 7.8CVE-2024-7061EPSS 0.2%

    Okta Verify for Windows is vulnerable to privilege escalation through DLL hijacking. The vulnerability is fixed in Okta Verify for Windows version 5.0.2. To remediate this vulnerability, upgrade to 5.0.2 or greater.

  23. 7.8CVE-2024-5290EPSS 0.7%

    An issue was discovered in Ubuntu wpa_supplicant that resulted in loading of arbitrary shared objects, which allows a local unprivileged attacker to escalate privileges to the user that wpa_supplicant runs as (usually root). Membership…

  24. 8.5CVE-2024-7326EPSS 0.3%

    A vulnerability classified as critical has been found in IObit DualSafe Password Manager 1.4.0.3. This affects an unknown part in the library RTL120.BPL of the component BPL Handler. The manipulation leads to uncontrolled search path. It i…

  25. 8.5CVE-2024-7325EPSS 0.2%

    A vulnerability was found in IObit Driver Booster 11.0.0.0. It has been rated as critical. Affected by this issue is some unknown functionality in the library VCL120.BPL of the component BPL Handler. The manipulation leads to uncontrolled …

  26. 8.5CVE-2024-7324EPSS 0.2%

    A vulnerability was found in IObit iTop Data Recovery Pro 4.4.0.687. It has been declared as critical. Affected by this vulnerability is an unknown functionality in the library madbasic_.bpl of the component BPL Handler. The manipulation l…

  27. 7.8CVE-2024-37142EPSS 0.2%

    Dell Peripheral Manager, versions prior to 1.7.6, contain an uncontrolled search path element vulnerability. An attacker could potentially exploit this vulnerability through preloading malicious DLL or symbolic link exploitation, leading t…

  28. 7.8CVE-2024-37127EPSS 0.2%

    Dell Peripheral Manager, versions prior to 1.7.6, contain an uncontrolled search path element vulnerability. An attacker could potentially exploit this vulnerability through preloading malicious DLL or symbolic link exploitation, leading t…

  29. 7.8CVE-2024-32857EPSS 0.2%

    Dell Peripheral Manager, versions prior to 1.7.6, contain an uncontrolled search path element vulnerability. An attacker could potentially exploit this vulnerability through preloading malicious DLL or symbolic link exploitation, leading …

  30. 7.8CVE-2024-41817EPSS 0.9%

    ImageMagick is a free and open-source software suite, used for editing and manipulating digital images. The `AppImage` version `ImageMagick` might use an empty path when setting `MAGICK_CONFIGURE_PATH` and `LD_LIBRARY_PATH` environment var…

  31. 4.8CVE-2024-7193EPSS 0.4%

    A vulnerability has been found in Mp3tag up to 3.26d and classified as problematic. This vulnerability affects unknown code in the library tak_deco_lib.dll of the component DLL Handler. The manipulation leads to uncontrolled search path. I…

  32. 5.0CVE-2024-39820EPSS 0.2%

    Uncontrolled search path element in the installer for Zoom Workplace Desktop App for macOS before version 6.0.10 may allow an authenticated user to conduct a denial of service via local access.

  33. 7.8CVE-2024-38330EPSS 0.3%

    IBM System Management for i 7.2, 7.3, and 7.4 could allow a local user to gain elevated privileges due to an unqualified library program call. A malicious actor could cause user-controlled code to run with administrator privilege. IBM X-…

  34. 7.0CVE-2024-1182EPSS 0.3%

    Uncontrolled Search Path Element vulnerability in Mitsubishi Electric GENESIS64 versions 10.97.3 and prior, Mitsubishi Electric ICONICS Suite versions 10.97.3 and prior, Mitsubishi Electric Hyper Historian versions 10.97.3 and prior, Mitsu…

  35. 7.0CVE-2024-39708EPSS 0.2%

    An issue was discovered in the Agent in Delinea Privilege Manager (formerly Thycotic Privilege Manager) before 12.0.1096 on Windows. Sometimes, a non-administrator user can copy a crafted DLL file to a temporary directory (used by .NET Sha…

  36. 7.1CVE-2024-34116EPSS 0.3%

    Creative Cloud Desktop versions 6.1.0.587 and earlier are affected by an Uncontrolled Search Path Element vulnerability that could result in a security feature bypass. An attacker could exploit this vulnerability to load and execute malici…

  37. 7.8CVE-2024-37130EPSS 0.2%

    Dell OpenManage Server Administrator, versions 11.0.1.0 and prior, contains a Local Privilege Escalation vulnerability via XSL Hijacking. A local low-privileged malicious user could potentially exploit this vulnerability and escalate their…

  38. 7.8CVE-2024-5509EPSS 0.5%

    Luxion KeyShot BIP File Parsing Uncontrolled Search Path Element Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Luxion KeyShot. User interaction is req…

  39. 7.8CVE-2024-5292EPSS 0.5%

    D-Link Network Assistant Uncontrolled Search Path Element Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of D-Link Network Assistant. An attacker must fi…

  40. 6.7CVE-2024-22379EPSS 0.2%

    Uncontrolled search path in some Intel(R) Inspector software before version 2024.0 may allow an authenticated user to potentially enable escalation of privilege via local access.

  41. 7.3CVE-2024-21862EPSS 0.2%

    Uncontrolled search path in some Intel(R) Quartus(R) Prime Standard Edition Design software before version 23.1 may allow an authenticated user to potentially enable escalation of privilege via local access.

  42. 7.8CVE-2024-21861EPSS 0.2%

    Uncontrolled search path in some Intel(R) GPA Framework software before version 2023.4 may allow an authenticated user to potentially enable escalation of privilege via local access.

  43. 6.7CVE-2024-21843EPSS 0.2%

    Uncontrolled search path for some Intel(R) Computing Improvement Program software before version 2.4.0.10654 may allow an authenticated user to potentially enable escalation of privilege via local access.

  44. 6.7CVE-2024-21841EPSS 0.2%

    Uncontrolled search path for some Intel(R) Distribution for GDB software before version 2024.0 may allow an authenticated user to potentially enable escalation of privilege via local access.

  45. 7.3CVE-2024-21837EPSS 0.2%

    Uncontrolled search path in some Intel(R) Quartus(R) Prime Lite Edition Design software before version 23.1 may allow an authenticated user to potentially enable escalation of privilege via local access.

  46. 7.8CVE-2024-21831EPSS 0.2%

    Uncontrolled search path in some Intel(R) Processor Diagnostic Tool software before version 4.1.9.41 may allow an authenticated user to potentially enable escalation of privilege via local access.

  47. 6.7CVE-2024-21818EPSS 0.2%

    Uncontrolled search path in some Intel(R) PCM software before version 202311 may allow an authenticated user to potentially enable escalation of privilege via local access.

  48. 7.3CVE-2024-21814EPSS 0.2%

    Uncontrolled search path for some Intel(R) Chipset Device Software before version 10.1.19444.8378 may allow an authenticated user to potentially enable escalation of privilege via local access.

  49. 7.8CVE-2024-21788EPSS 0.2%

    Uncontrolled search path in some Intel(R) GPA software before version 2023.4 may allow an authenticated user to potentially enable escalation of privilege via local access.

  50. 7.3CVE-2024-21777EPSS 0.2%

    Uncontrolled search path in some Intel(R) Quartus(R) Prime Pro Edition Design software before version 23.4 may allow an authenticated user to potentially enable escalation of privilege via local access.