cve.bz

CWE-427: Uncontrolled Search Path Element, page 19

Filter

The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.

What the weakness is: CWE-427 at MITRE

Related attack patterns (CAPEC): 2
  • CAPEC-38 Leveraging/Manipulating Configuration File Search Paths Likelihood: High · Severity: Very High
  • CAPEC-471 Search Order Hijacking Severity: Medium

The attack patterns MITRE's CAPEC relates to CWE-427, as MITRE names them. Credits.

Ask an AI about CWE-427

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-427: Uncontrolled Search Path Element and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/427.html and https://cve.bz/cve/cwe/427?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.8CVE-2021-28130EPSS 0.4%

    Dr.Web Firewall 12.5.2.4160 on Windows incorrectly restricts applications signed by Dr.Web. A DLL for a custom payload within a legitimate binary (e.g., frwl_svc.exe) bypasses firewall filters.

  2. 7.8CVE-2021-26750EPSS 0.3%

    DLL hijacking in Panda Agent <=1.16.11 in Panda Security, S.L.U. Panda Adaptive Defense 360 <= 8.0.17 allows attacker to escalate privileges via maliciously crafted DLL file.

  3. 7.8CVE-2021-31847EPSS 0.4%

    Improper access control vulnerability in the repair process for McAfee Agent for Windows prior to 5.7.4 could allow a local attacker to perform a DLL preloading attack using unsigned DLLs. This would result in elevation of privileges and t…

  4. 7.8CVE-2021-36216EPSS 0.6%

    LINE for Windows 6.2.1.2289 and before allows arbitrary code execution via malicious DLL injection.

  5. 7.3CVE-2021-28581EPSS 0.9%

    Adobe Creative Cloud Desktop 3.5 (and earlier) is affected by an uncontrolled search path vulnerability that could result in elevation of privileges. Exploitation of this issue requires user interaction in that a victim must log on to the …

  6. 7.8CVE-2021-22775EPSS 0.3%

    A CWE-427: Uncontrolled Search Path Element vulnerability exists in GP-Pro EX,V4.09.250 and prior, that could cause local code execution with elevated privileges when installing the software.

  7. 7.8CVE-2021-20793EPSS 0.3%

    Untrusted search path vulnerability in the installer of Sony Audio USB Driver V1.10 and prior and the installer of HAP Music Transfer Ver.1.3.0 and prior allows an attacker to gain privileges and execute arbitrary code via a Trojan horse D…

  8. 7.8CVE-2021-28594EPSS 2.7%

    Adobe Creative Cloud Desktop Application (installer) version 2.4 (and earlier) is affected by an Uncontrolled Search Path Element vulnerability. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execut…

  9. 7.3CVE-2021-28636EPSS 2.2%

    Acrobat Reader DC versions 2021.005.20054 (and earlier), 2020.004.30005 (and earlier) and 2017.011.30197 (and earlier) are affected by an Uncontrolled Search Path Element vulnerability. An attacker with access to the victim's C:/ folder co…

  10. 7.8CVE-2021-28595EPSS 3.8%

    Adobe Dimension version 3.4 (and earlier) is affected by an Uncontrolled Search Path Element element. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exp…

  11. 7.3CVE-2021-37617EPSS 0.5%

    The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with a computer. The Nextcloud Desktop Client invokes its uninstaller script when being installed to make sure there are no remnants of previous installation…

  12. 7.8CVE-2021-3633EPSS 0.3%

    A DLL preloading vulnerability was reported in Lenovo Driver Management prior to version 2.9.0719.1104 that could allow privilege escalation.

  13. 7.8CVE-2021-38086EPSS 0.3%

    Acronis Cyber Protect 15 for Windows prior to build 27009 and Acronis Agent for Windows prior to build 26226 allowed local privilege escalation via DLL hijacking.

  14. 7.8CVE-2021-36770EPSS 1.4%

    Encode.pm, as distributed in Perl through 5.34.0, allows local users to gain privileges via a Trojan horse Encode::ConfigLocal library (in the current working directory) that preempts dynamic module loading. Exploitation requires an unusua…

  15. 7.8CVE-2021-38571EPSS 0.5%

    An issue was discovered in Foxit Reader and PhantomPDF before 10.1.4. It allows DLL hijacking, aka CNVD-C-2021-68000 and CNVD-C-2021-68502.

  16. 7.8CVE-2021-0160EPSS 0.2%

    Uncontrolled search path in some Intel(R) NUC Pro Chassis Element AverMedia Capture Card drivers before version 3.0.64.143 may allow an authenticated user to potentially enable escalation of privilege via local access.

  17. 7.8CVE-2021-32580EPSS 0.3%

    Acronis True Image prior to 2021 Update 4 for Windows allowed local privilege escalation due to DLL hijacking.

  18. 7.3CVE-2021-1593EPSS 0.3%

    A vulnerability in Cisco Packet Tracer for Windows could allow an authenticated, local attacker to perform a DLL injection attack on an affected device. To exploit this vulnerability, the attacker must have valid credentials on the Windows…

  19. 7.8CVE-2020-18173EPSS 0.5%

    A DLL injection vulnerability in 1password.dll of 1Password 7.3.712 allows attackers to execute arbitrary code.

  20. 6.5CVE-2020-4623EPSS 0.3%

    IBM i2 iBase 8.9.13 could allow a local authenticated attacker to execute arbitrary code on the system, caused by a DLL search order hijacking flaw. By using a specially-crafted .DLL file, an attacker could exploit this vulnerability to ex…

  21. 7.8CVE-2020-5316EPSS 0.3%

    Dell SupportAssist for Business PCs versions 2.0, 2.0.1, 2.0.2, 2.1, 2.1.1, 2.1.2, 2.1.3 and Dell SupportAssist for Home PCs version 2.0, 2.0.1, 2.0.2, 2.1, 2.1.1, 2.1.2, 2.1.3, 2.2, 2.2.1, 2.2.2, 2.2.3, 3.0, 3.0.1, 3.0.2, 3.1, 3.2, 3.2.1,…

  22. 7.8CVE-2021-1089EPSS 0.3%

    NVIDIA GPU Display Driver for Windows contains a vulnerability in nvidia-smi where an uncontrolled DLL loading path may lead to arbitrary code execution, denial of service, information disclosure, and data tampering.

  23. 7.8CVE-2021-3550EPSS 0.2%

    A DLL search path vulnerability was reported in Lenovo PCManager, prior to version 3.0.500.5102, that could allow privilege escalation.

  24. 7.8CVE-2021-36753EPSS 0.4%

    sharkdp BAT before 0.18.2 executes less.exe from the current working directory.

  25. 7.8CVE-2020-11634EPSS 0.5%

    The Zscaler Client Connector for Windows prior to 2.1.2.105 had a DLL hijacking vulnerability caused due to the configuration of OpenSSL. A local adversary may be able to execute arbitrary code in the SYSTEM context.

  26. 7.8CVE-2021-3042EPSS 0.2%

    A local privilege escalation (PE) vulnerability exists in the Palo Alto Networks Cortex XDR agent on Windows platforms that enables an authenticated local Windows user to execute programs with SYSTEM privileges. Exploiting this vulnerabili…

  27. 7.8CVE-2020-29157EPSS 0.5%

    An issue in RAONWIZ K Editor v2018.0.0.10 allows attackers to perform a DLL hijacking attack when the service or system is restarted.

  28. 7.8CVE-2021-22000EPSS 0.6%

    VMware Thinapp version 5.x prior to 5.2.10 contain a DLL hijacking vulnerability due to insecure loading of DLLs. A malicious actor with non-administrative privileges may exploit this vulnerability to elevate privileges to administrator le…

  29. 6.7CVE-2021-35957EPSS 0.3%

    Stormshield Endpoint Security Evolution 2.0.0 through 2.0.2 does not accomplish the intended defense against local administrators who can replace the Visual C++ runtime DLLs (in %WINDIR%\system32) with malicious ones.

  30. 7.8CVE-2021-36376EPSS 0.4%

    dandavison delta before 0.8.3 on Windows resolves an executable's pathname as a relative path from the current directory.

  31. 7.8CVE-2021-3613EPSS 0.7%

    OpenVPN Connect 3.2.0 through 3.3.0 allows local users to load arbitrary dynamic loadable libraries via an OpenSSL configuration file if present, which allows the user to run arbitrary code with the same privilege level as the main OpenVPN…

  32. 7.8CVE-2021-3606EPSS 0.3%

    OpenVPN before version 2.5.3 on Windows allows local users to load arbitrary dynamic loadable libraries via an OpenSSL configuration file if present, which allows the user to run arbitrary code with the same privilege level as the main Ope…

  33. 8.6CVE-2021-28570EPSS 2.3%

    Adobe After Effects version 18.1 (and earlier) is affected by an Uncontrolled Search Path element vulnerability. An unauthenticated attacker could exploit this to to plant custom binaries and execute them with System permissions. Exploitat…

  34. 7.8CVE-2021-29949EPSS 0.3%

    When loading the shared library that provides the OTR protocol implementation, Thunderbird will initially attempt to open it using a filename that isn't distributed by Thunderbird. If a computer has already been infected with a malicious l…

  35. 7.8CVE-2021-21999EPSS 1.5%

    VMware Tools for Windows (11.x.y prior to 11.2.6), VMware Remote Console for Windows (12.x prior to 12.0.1) , VMware App Volumes (2.x prior to 2.18.10 and 4 prior to 2103) contain a local privilege escalation vulnerability. An attacker wit…

  36. 6.7CVE-2021-1567EPSS 0.2%

    A vulnerability in the DLL loading mechanism of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to perform a DLL hijacking attack on an affected device if the VPN Posture (HostScan) Module i…

  37. 7.8CVE-2021-34803EPSS 0.5%

    TeamViewer before 14.7.48644 on Windows loads untrusted DLLs in certain situations.

  38. 7.3CVE-2021-31840EPSS 0.3%

    A vulnerability in the preloading mechanism of specific dynamic link libraries in McAfee Agent for Windows prior to 5.7.3 could allow an authenticated, local attacker to perform a DLL preloading attack with unsigned DLLs. To exploit this v…

  39. 7.8CVE-2021-23023EPSS 0.3%

    On version 7.2.1.x before 7.2.1.3 and 7.1.x before 7.1.9.9 Update 1, a DLL hijacking issue exists in cachecleaner.dll included in the BIG-IP Edge Client Windows Installer. Note: Software versions which have reached End of Technical Support…

  40. 7.8CVE-2021-3041EPSS 0.2%

    A local privilege escalation vulnerability exists in the Palo Alto Networks Cortex XDR agent on Windows platforms that enables an authenticated local Windows user to execute programs with SYSTEM privileges. This requires the user to have t…

  41. 7.3CVE-2021-0108EPSS 0.3%

    Uncontrolled search path in the Intel Unite(R) Client for Windows before version 4.2.25031 may allow an authenticated user to potentially enable an escalation of privilege via local access.

  42. 7.8CVE-2021-0104EPSS 0.5%

    Uncontrolled search path element in the installer for the Intel(R) Rapid Storage Technology software, before versions 17.9.0.34, 18.0.0.640 and 18.1.0.24, may allow an authenticated user to potentially enable escalation of privilege via lo…

  43. 7.3CVE-2021-0090EPSS 0.3%

    Uncontrolled search path element in Intel(R) DSA before version 20.11.50.9 may allow an authenticated user to potentially enable an escalation of privilege via local access.

  44. 7.8CVE-2021-0057EPSS 0.3%

    Uncontrolled search path in the Intel(R) NUC M15 Laptop Kit Driver Pack software before updated version 1.1 may allow an authenticated user to potentially enable escalation of privilege via local access.

  45. 7.3CVE-2020-8702EPSS 0.3%

    Uncontrolled search path element in the Intel(R) Processor Diagnostic Tool before version 4.1.5.37 may allow an authenticated user to potentially enable escalation of privilege via local access.

  46. 7.8CVE-2021-1536EPSS 0.3%

    A vulnerability in Cisco Webex Meetings Desktop App for Windows, Cisco Webex Meetings Server, Cisco Webex Network Recording Player for Windows, and Cisco Webex Teams for Windows could allow an authenticated, local attacker to perform a DLL…

  47. 7.8CVE-2019-4588EPSS 0.3%

    IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a local user to execute arbitrary code and conduct DLL hijacking attacks.

  48. 7.8CVE-2021-20726EPSS 0.3%

    Untrusted search path vulnerability in The Installer of Overwolf 2.168.0.n and earlier allows an attacker to gain privileges and execute arbitrary code with the privilege of the user invoking the installer via a Trojan horse DLL in an unsp…

  49. 7.8CVE-2021-20722EPSS 0.4%

    Untrusted search path vulnerability in the installers of ScanSnap Manager prior to versions V7.0L20 and the Software Download Installer prior to WinSSInst2JP.exe and WinSSInst2iX1500JP.exe allows an attacker to gain privileges and execute …

  50. 7.8CVE-2021-3423EPSS 0.2%

    Uncontrolled Search Path Element vulnerability in the openssl component as used in Bitdefender GravityZone Business Security allows an attacker to load a third party DLL to elevate privileges. This issue affects Bitdefender GravityZone Bus…