cve.bz

CWE-427: Uncontrolled Search Path Element, page 13

Filter

The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.

What the weakness is: CWE-427 at MITRE

Related attack patterns (CAPEC): 2
  • CAPEC-38 Leveraging/Manipulating Configuration File Search Paths Likelihood: High · Severity: Very High
  • CAPEC-471 Search Order Hijacking Severity: Medium

The attack patterns MITRE's CAPEC relates to CWE-427, as MITRE names them. Credits.

Ask an AI about CWE-427

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-427: Uncontrolled Search Path Element and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/427.html and https://cve.bz/cve/cwe/427?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.8CVE-2023-51711EPSS 0.2%

    An issue was discovered in Regify Regipay Client for Windows version 4.5.1.0 allows DLL hijacking: a user can trigger the execution of arbitrary code every time the product is executed.

  2. 6.5CVE-2023-27859EPSS 1.0%

    IBM Db2 10.1, 10.5, and 11.1 could allow a remote user to execute arbitrary code caused by installing like named jar files across multiple databases. A user could exploit this by installing a malicious jar file that overwrites the existin…

  3. 5.5CVE-2023-32272EPSS 0.2%

    Uncontrolled search path in some Intel NUC Pro Software Suite Configuration Tool software installers before version 3.0.0.6 may allow an authenticated user to potentially enable denial of service via local access.

  4. 7.8CVE-2023-6740EPSS 0.2%

    Privilege escalation in jar_signature agent plugin in Checkmk before 2.2.0p18, 2.1.0p38 and 2.0.0p39 allows local user to escalate privileges

  5. 7.8CVE-2023-29445EPSS 0.2%

    An uncontrolled search path element vulnerability (DLL hijacking) has been discovered that could allow a locally authenticated adversary to escalate privileges to SYSTEM.

  6. 7.3CVE-2023-29444EPSS 0.2%

    An uncontrolled search path element vulnerability (DLL hijacking) has been discovered that could allow a locally authenticated adversary to escalate privileges to SYSTEM. Alternatively, they could host a trojanized version of the software …

  7. 4.8CVE-2023-41782EPSS 0.2%

    There is a DLL hijacking vulnerability in ZTE ZXCLOUD iRAI, an attacker could place a fake DLL file in a specific directory and successfully exploit this vulnerability to execute malicious code.

  8. 7.8CVE-2023-6338EPSS 0.2%

    Uncontrolled search path vulnerabilities were reported in the Lenovo Universal Device Client (UDC) that could allow an attacker with local access to execute code with elevated privileges.

  9. 7.8CVE-2023-41780EPSS 0.2%

    There is an unsafe DLL loading vulnerability in ZTE ZXCLOUD iRAI. Due to the  program  failed to adequately validate the user's input, an attacker could exploit this vulnerability  to escalate local privileges.

  10. 7.8CVE-2023-43064EPSS 0.2%

    Facsimile Support for IBM i 7.2, 7.3, 7.4, and 7.5 could allow a local user to gain elevated privileges due to an unqualified library call. A malicious actor could cause arbitrary code to run with the privilege of the user invoking the fa…

  11. 7.8CVE-2023-6891EPSS 0.3%

    A vulnerability has been found in PeaZip 9.4.0 and classified as problematic. Affected by this vulnerability is an unknown functionality in the library dragdropfilesdll.dll of the component Library Handler. The manipulation leads to uncont…

  12. 7.8CVE-2023-31210EPSS 0.5%

    Usage of user controlled LD_LIBRARY_PATH in agent in Checkmk 2.2.0p10 up to 2.2.0p16 allows malicious Checkmk site user to escalate rights via injection of malicious libraries

  13. 7.8CVE-2020-28369EPSS 0.2%

    In BeyondTrust Privilege Management for Windows (aka PMfW) through 5.7, a SYSTEM installation causes Cryptbase.dll to be loaded from the user-writable location %WINDIR%\Temp.

  14. 7.8CVE-2023-48677EPSS 0.2%

    Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40901, Acronis Cyber Protect Cloud Agent (Windows) before build 39378, Acronis Cyb…

  15. 9.8CVE-2023-41117EPSS 0.8%

    An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x before 13.12.16, 14.x before 14.9.0, and 15.x before 15.4.0. It contain packages, standalone packages, and functions that r…

  16. 7.8CVE-2023-48861EPSS 0.3%

    DLL hijacking vulnerability in TTplayer version 7.0.2, allows local attackers to escalate privileges and execute arbitrary code via urlmon.dll.

  17. 7.8CVE-2023-41613EPSS 0.5%

    EzViz Studio v2.2.0 is vulnerable to DLL hijacking.

  18. 7.8CVE-2023-45252EPSS 0.3%

    DLL Hijacking vulnerability in Huddly HuddlyCameraService before version 8.0.7, not including version 7.99, due to the installation of the service in a directory that grants write privileges to standard users, allows attackers to manipulat…

  19. 7.8CVE-2023-47454EPSS 0.3%

    An Untrusted search path vulnerability in NetEase CloudMusic 2.10.4 for Windows allows local users to gain escalated privileges through the urlmon.dll file in the current working directory.

  20. 7.8CVE-2023-47453EPSS 0.3%

    An Untrusted search path vulnerability in Sohu Video Player 7.0.15.0 allows local users to gain escalated privileges through the version.dll file in the current working directory.

  21. 7.8CVE-2023-47452EPSS 0.5%

    An Untrusted search path vulnerability in notepad++ 6.5 allows local users to gain escalated privileges through the msimg32.dll file in the current working directory.

  22. 7.8CVE-2023-6401EPSS 0.3%

    A vulnerability classified as problematic was found in NotePad++ up to 8.1. Affected by this vulnerability is an unknown functionality of the file dbghelp.exe. The manipulation leads to uncontrolled search path. An attack has to be approac…

  23. 7.8CVE-2023-4770EPSS 0.3%

    An uncontrolled search path element vulnerability has been found on 4D and 4D server Windows executables applications, affecting version 19 R8 100218. This vulnerability consists in a DLL hijacking by replacing x64 shfolder.dll in the inst…

  24. 7.8CVE-2023-4931EPSS 0.2%

    Uncontrolled search path element vulnerability in Plesk Installer affects version 3.27.0.0. A local attacker could execute arbitrary code by injecting DLL files into the same folder where the application is installed, resulting in DLL hija…

  25. 9.8CVE-2023-41790EPSS 0.6%

    Uncontrolled Search Path Element vulnerability in Pandora FMS on all allows Leveraging/Manipulating Configuration File Search Paths. This vulnerability allows to access the server configuration file and to compromise the database. This iss…

  26. 7.5CVE-2023-41787EPSS 0.5%

    Uncontrolled Search Path Element vulnerability in Pandora FMS on all allows Leveraging/Manipulating Configuration File Search Paths. This vulnerability allows access to files with sensitive information. This issue affects Pandora FMS: from…

  27. 7.8CVE-2023-29069EPSS 0.3%

    A maliciously crafted DLL file can be forced to install onto a non-default location, and attacker can overwrite parts of the product with malicious DLLs. These files may then have elevated privileges leading to a Privilege Escalation vulne…

  28. 7.8CVE-2023-46814EPSS 0.3%

    A binary hijacking vulnerability exists within the VideoLAN VLC media player before 3.0.19 on Windows. The uninstaller attempts to execute code with elevated privileges out of a standard user writable location. Standard users may use this …

  29. 7.8CVE-2023-6235EPSS 0.3%

    An uncontrolled search path element vulnerability has been found in the Duet Display product, affecting version 2.5.9.1. An attacker could place an arbitrary libusk.dll file in the C:\Users\user\AppData\Local\Microsoft\WindowsApps\ directo…

  30. 7.8CVE-2023-22818EPSS 0.2%

    Multiple DLL Search Order Hijack vulnerabilities were addressed in the SanDisk Security Installer for Windows that could allow attackers with local access to execute arbitrary code by executing the installer in the same folder as the malic…

  31. 7.8CVE-2023-34430EPSS 0.2%

    Uncontrolled search path in some Intel Battery Life Diagnostic Tool software before version 2.2.1 may allow an authenticated user to potentially enable escalation of privilege via local access.

  32. 7.8CVE-2023-34350EPSS 0.2%

    Uncontrolled search path element in some Intel(R) XTU software before version 7.12.0.15 may allow an authenticated user to potentially enable escalation of privilege via local access.

  33. 7.3CVE-2023-33874EPSS 0.2%

    Uncontrolled search path in some Intel(R) NUC 12 Pro Kits & Mini PCs - NUC12WS Intel(R) HID Event Filter Driver installation software before version 2.2.2.1 for Windows may allow an authenticated user to potentially enable escalation of pr…

  34. 7.3CVE-2023-32660EPSS 0.2%

    Uncontrolled search path in some Intel(R) NUC Kit NUC6i7KYK Thunderbolt(TM) 3 Firmware Update Tool installation software before version 46 may allow an authenticated user to potentially enable escalation of privilege via local access.

  35. 7.8CVE-2023-29504EPSS 0.2%

    Uncontrolled search path element in some Intel(R) RealSense(TM) Dynamic Calibration software before version 2.13.1.0 may allow an authenticated user to potentially enable escalation of privilege via local access.

  36. 7.8CVE-2023-29161EPSS 0.2%

    Uncontrolled search path in some Intel(R) OFU software before version 14.1.31 may allow an authenticated user to potentially enable escalation of privilege via local access.

  37. 7.8CVE-2023-28740EPSS 0.2%

    Uncontrolled search path element in some Intel(R) QAT drivers for Windows - HW Version 2.0 before version 2.0.4 may allow an authenticated user to potentially enable escalation of privilege via local access.

  38. 7.8CVE-2023-28388EPSS 0.2%

    Uncontrolled search path element in some Intel(R) Chipset Device Software before version 10.1.19444.8378 may allow an authenticated user to potentially enable escalation of privilege via local access.

  39. 7.8CVE-2023-27513EPSS 0.2%

    Uncontrolled search path element in some Intel(R) Server Information Retrieval Utility software before version 16.0.9 may allow an authenticated user to potentially enable escalation of privilege via local access.

  40. 7.8CVE-2023-4632EPSS 0.3%

    An uncontrolled search path vulnerability was reported in Lenovo System Update that could allow an attacker with local access to execute code with elevated privileges.

  41. 7.3CVE-2023-47113EPSS 0.2%

    BleachBit cleans files to free disk space and to maintain privacy. BleachBit for Windows up to version 4.4.2 is vulnerable to a DLL Hijacking vulnerability. By placing a DLL in the Folder c:\DLLs, an attacker can run arbitrary code on ever…

  42. 7.3CVE-2023-0898EPSS 0.3%

    General Electric MiCOM S1 Agile is vulnerable to an attacker achieving code execution by placing malicious DLL files in the directory of the application.

  43. 7.3CVE-2023-31027EPSS 0.2%

    NVIDIA GPU Display Driver for Windows contains a vulnerability that allows Windows users with low levels of privilege to escalate privileges when an administrator is updating GPU drivers, which may lead to escalation of privileges.

  44. 7.8CVE-2023-31016EPSS 0.2%

    NVIDIA GPU Display Driver for Windows contains a vulnerability where an uncontrolled search path element may allow an attacker to execute arbitrary code, which may lead to code execution, denial of service, escalation of privileges, inform…

  45. 7.3CVE-2023-44220EPSS 0.3%

    SonicWall NetExtender Windows (32-bit and 64-bit) client 10.2.336 and earlier versions have a DLL Search Order Hijacking vulnerability in the start-up DLL component. Successful exploitation via a local attacker could result in command exec…

  46. 6.7CVE-2023-4936EPSS 0.2%

    It is possible to sideload a compromised DLL during the installation at elevated privilege.

  47. 7.8CVE-2023-5463EPSS 0.3%

    A vulnerability was found in XINJE XDPPro up to 3.7.17a. It has been rated as critical. Affected by this issue is some unknown functionality in the library cfgmgr32.dll. The manipulation leads to uncontrolled search path. An attack has to …

  48. 7.3CVE-2023-45248EPSS 0.3%

    Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Cloud Agent (Windows) before build 36497, Acronis Cyber Protect 16 (Windows) before build 37391.

  49. 7.8CVE-2023-35897EPSS 0.2%

    IBM Spectrum Protect Client and IBM Storage Protect for Virtual Environments 8.1.0.0 through 8.1.19.0 could allow a local user to execute arbitrary code on the system using a specially crafted file, caused by a DLL hijacking flaw. IBM X-F…

  50. 7.8CVE-2022-4956EPSS 0.4%

    A vulnerability classified as critical has been found in Caphyon Advanced Installer 19.7. This affects an unknown part of the component WinSxS DLL Handler. The manipulation leads to uncontrolled search path. Attacking locally is a requirem…