cve.bz

CWE-427: Uncontrolled Search Path Element, page 21

Filter

The product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.

What the weakness is: CWE-427 at MITRE

Related attack patterns (CAPEC): 2
  • CAPEC-38 Leveraging/Manipulating Configuration File Search Paths Likelihood: High · Severity: Very High
  • CAPEC-471 Search Order Hijacking Severity: Medium

The attack patterns MITRE's CAPEC relates to CWE-427, as MITRE names them. Credits.

Ask an AI about CWE-427

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-427: Uncontrolled Search Path Element and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/427.html and https://cve.bz/cve/cwe/427?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.8CVE-2021-20616EPSS 0.3%

    Untrusted search path vulnerability in the installer of SKYSEA Client View Ver.1.020.05b to Ver.16.001.01g allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.

  2. 7.8CVE-2020-26050EPSS 0.6%

    SaferVPN for Windows Ver 5.0.3.3 through 5.0.4.15 could allow local privilege escalation from low privileged users to SYSTEM via a crafted openssl configuration file. This issue is similar to CVE-2019-12572.

  3. 7.8CVE-2020-35483EPSS 0.5%

    AnyDesk before 6.1.0 on Windows, when run in portable mode on a system where the attacker has write access to the application directory, allows this attacker to compromise a local user account via a read-only setting for a Trojan horse gca…

  4. 7.8CVE-2020-5681EPSS 0.9%

    Untrusted search path vulnerability in self-extracting files created by EpsonNet SetupManager versions 2.2.14 and earlier, and Offirio SynergyWare PrintDirector versions 1.6x/1.6y and earlier allows an attacker to gain privileges via a Tro…

  5. 6.5CVE-2020-24578EPSS 1.8%

    An issue was discovered on D-Link DSL-2888A devices with firmware prior to AU_2.31_V1.1.47ae55. It has a misconfigured FTP service that allows a malicious network user to access system folders and download sensitive files (such as the pass…

  6. 7.8CVE-2020-29654EPSS 0.4%

    Western Digital Dashboard before 3.2.2.9 allows DLL Hijacking that leads to compromise of the SYSTEM account.

  7. 7.0CVE-2020-24447EPSS 0.8%

    Adobe Lightroom Classic version 10.0 (and earlier) for Windows is affected by an uncontrolled search path vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires u…

  8. 7.0CVE-2020-24440EPSS 0.6%

    Adobe Prelude version 9.0.1 (and earlier) is affected by an uncontrolled search path element that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a v…

  9. 7.8CVE-2020-2049EPSS 0.3%

    A local privilege escalation vulnerability exists in Palo Alto Networks Cortex XDR Agent on the Windows platform that allows an authenticated local Windows user to execute programs with SYSTEM privileges. This requires the user to have the…

  10. 7.8CVE-2020-28950EPSS 0.5%

    The installer of Kaspersky Anti-Ransomware Tool (KART) prior to KART 4.0 Patch C was vulnerable to a DLL hijacking attack that allowed an attacker to elevate privileges during installation process.

  11. 6.8CVE-2020-27348EPSS 0.7%

    In some conditions, a snap package built by snapcraft includes the current directory in LD_LIBRARY_PATH, allowing a malicious snap to gain code execution within the context of another snap if both plug the home interface or similar. This i…

  12. 7.8CVE-2020-6021EPSS 0.3%

    Check Point Endpoint Security Client for Windows before version E84.20 allows write access to the directory from which the installation repair takes place. Since the MS Installer allows regular users to run the repair, an attacker can init…

  13. 5.5CVE-2020-25738EPSS 0.4%

    CyberArk Endpoint Privilege Manager (EPM) 11.1.0.173 allows attackers to bypass a Credential Theft protection mechanism by injecting a DLL into a process that normally has credential access, such as a Chrome process that reads credentials …

  14. 7.8CVE-2020-5674EPSS 0.3%

    Untrusted search path vulnerability in the installers of multiple SEIKO EPSON products allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.

  15. 7.8CVE-2020-12329EPSS 0.3%

    Uncontrolled search path in the Intel(R) VTune(TM) Profiler before version 2020 Update 1 may allow an authenticated user to potentially enable escalation of privilege via local access.

  16. 7.8CVE-2020-12320EPSS 0.3%

    Uncontrolled search path in Intel(R) SCS Add-on for Microsoft* SCCM before version 2.1.10 may allow an authenticated user to potentially enable escalation of privilege via local access.

  17. 7.8CVE-2020-13771EPSS 0.8%

    Various components in Ivanti Endpoint Manager through 2020.1.1 rely on Windows search order when loading a (nonexistent) library file, allowing (under certain conditions) one to gain code execution (and elevation of privileges to the level…

  18. 7.8CVE-2020-5992EPSS 0.5%

    NVIDIA GeForce NOW application software on Windows, all versions prior to 2.0.25.119, contains a vulnerability in its open-source software dependency in which the OpenSSL library is vulnerable to binary planting attacks by a local user, wh…

  19. 7.8CVE-2020-25174EPSS 0.5%

    A DLL hijacking vulnerability in the B. Braun OnlineSuite Version AP 3.0 and earlier allows local attackers to execute code on the system as a high privileged user.

  20. 9.8CVE-2020-27955ExploitEPSS 82%

    Git LFS 2.12.0 allows Remote Code Execution.

  21. 7.8CVE-2020-27708EPSS 0.6%

    A vulnerability exists in the Origin Client that could allow a non-Administrative user to elevate their access to either Administrator or System. Once the user has obtained elevated access, they may be able to take control of the system an…

  22. 8.6CVE-2020-5145EPSS 1.2%

    SonicWall Global VPN client version 4.10.4.0314 and earlier have an insecure library loading (DLL hijacking) vulnerability. Successful exploitation could lead to remote code execution in the target system.

  23. 7.8CVE-2020-24425EPSS 0.7%

    Dreamweaver version 20.2 (and earlier) is affected by an uncontrolled search path element vulnerability that could lead to privilege escalation. Successful exploitation could result in a local user with permissions to write to the file sys…

  24. 7.8CVE-2020-24424EPSS 1.2%

    Adobe Premiere Pro version 14.4 (and earlier) is affected by an uncontrolled search path element that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that…

  25. 7.8CVE-2020-24423EPSS 1.2%

    Adobe Media Encoder version 14.4 (and earlier) for Windows is affected by an uncontrolled search path vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user …

  26. 7.8CVE-2020-24420EPSS 0.8%

    Adobe Photoshop for Windows version 21.2.1 (and earlier) is affected by an uncontrolled search path element vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires…

  27. 7.8CVE-2020-24419EPSS 0.7%

    Adobe After Effects version 17.1.1 (and earlier) for Windows is affected by an uncontrolled search path vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires use…

  28. 7.8CVE-2020-24422EPSS 3.1%

    Adobe Creative Cloud Desktop Application version 5.2 (and earlier) and 2.1 (and earlier) for Windows is affected by an uncontrolled search path vulnerability that could result in arbitrary code execution in the context of the current user.…

  29. 7.8CVE-2020-8345EPSS 0.4%

    A DLL search path vulnerability was reported in the Lenovo HardwareScan Plugin for the Lenovo Vantage hardware scan feature prior to version 1.0.46.11 that could allow escalation of privilege.

  30. 7.8CVE-2020-26947EPSS 0.3%

    monero-wallet-gui in Monero GUI before 0.17.1.0 includes the . directory in an embedded RPATH (with a preference ahead of /usr/lib), which allows local users to gain privileges via a Trojan horse library in the current working directory.

  31. 7.8CVE-2019-19115EPSS 0.6%

    An escalation of privilege vulnerability in Nahimic APO Software Component Driver 1.4.2, 1.5.0, 1.5.1, 1.6.1 and 1.6.2 allows an attacker to execute code with SYSTEM privileges.

  32. 7.8CVE-2020-26894EPSS 0.4%

    LiveCode v9.6.1 on Windows allows local, low-privileged users to gain privileges by creating a malicious "cmd.exe" in the folder of the vulnerable LiveCode application. If the application is using LiveCode's "shell()" function, it will att…

  33. 8.4CVE-2020-3535EPSS 0.6%

    A vulnerability in the loading mechanism of specific DLLs in the Cisco Webex Teams client for Windows could allow an authenticated, local attacker to load a malicious library. To exploit this vulnerability, the attacker needs valid credent…

  34. 7.8CVE-2020-24356EPSS 0.3%

    `cloudflared` versions prior to 2020.8.1 contain a local privilege escalation vulnerability on Windows systems. When run on a Windows system, `cloudflared` searches for configuration files which could be abused by a malicious entity to exe…

  35. 7.8CVE-2020-26538EPSS 0.5%

    An issue was discovered in Foxit Reader and PhantomPDF before 10.1. It allows attackers to execute arbitrary code via a Trojan horse taskkill.exe in the current working directory.

  36. 8.8CVE-2020-15663EPSS 2.7%

    If Firefox is installed to a user-writable directory, the Mozilla Maintenance Service would execute updater.exe from the install location with system privileges. Although the Mozilla Maintenance Service does ensure that updater.exe is sign…

  37. 7.8CVE-2020-6654EPSS 0.4%

    A DLL Hijacking vulnerability in Eaton's 9000x Programming and Configuration Software v 2.0.38 and prior allows an attacker to execute arbitrary code by replacing the required DLLs with malicious DLLs when the software try to load vci11un6…

  38. 7.8CVE-2020-3979EPSS 0.4%

    InstallBuilder for Qt Windows (versions prior to 20.7.0) installers look for plugins at a predictable location at initialization time, writable by non-admin users. While those plugins are not required, they are loaded if present, which cou…

  39. 6.5CVE-2020-7358EPSS 0.3%

    In AppSpider installer versions prior to 7.2.126, the AppSpider installer calls an executable which can be placed in the appropriate directory by an attacker with access to the local machine. This would prevent the installer from distingui…

  40. 7.8CVE-2020-7312EPSS 0.3%

    DLL Search Order Hijacking Vulnerability in the installer in McAfee Agent (MA) for Windows prior to 5.6.6 allows local users to execute arbitrary code and escalate privileges via execution from a compromised folder.

  41. 7.8CVE-2019-3881EPSS 0.5%

    Bundler prior to 2.1.0 uses a predictable path in /tmp/, created with insecure permissions as a storage location for gems, if locations under the user's home directory are not available. If Bundler is used in a scenario where the user does…

  42. 7.8CVE-2020-24162EPSS 0.4%

    The Shenzhen Tencent app 5.8.2.5300 for PC platforms (from Tencent App Center) has a DLL hijacking vulnerability. Attackers can use this vulnerability to execute malicious code.

  43. 7.8CVE-2020-24161EPSS 0.4%

    Guangzhou NetEase Mail Master 4.14.1.1004 on Windows has a DLL hijacking vulnerability. Attackers can use this vulnerability to execute malicious code.

  44. 7.8CVE-2020-24160EPSS 0.5%

    Shenzhen Tencent TIM Windows client 3.0.0.21315 has a DLL hijacking vulnerability, which can be exploited by attackers to execute malicious code.

  45. 7.8CVE-2020-24159EPSS 0.4%

    NetEase Youdao Dictionary has a DLL hijacking vulnerability, which can be exploited by attackers to gain server permissions. This affects Guangzhou NetEase Youdao Dictionary 8.9.2.0.

  46. 7.8CVE-2020-24158EPSS 0.3%

    360 Speed Browser 12.0.1247.0 has a DLL hijacking vulnerability, which can be exploited by attackers to execute malicious code. It is a dual-core browser owned by Beijing Qihoo Technology.

  47. 7.8CVE-2020-25045EPSS 0.4%

    Installers of Kaspersky Security Center and Kaspersky Security Center Web Console prior to 12 & prior to 12 Patch A were vulnerable to a DLL hijacking attack that allowed an attacker to elevate privileges in the system.

  48. 8.6CVE-2020-15167EPSS 0.4%

    In Miller (command line utility) using the configuration file support introduced in version 5.9.0, it is possible for an attacker to cause Miller to run arbitrary code by placing a malicious `.mlrrc` file in the working directory. See link…

  49. 6.7CVE-2020-5419EPSS 0.5%

    RabbitMQ versions 3.8.x prior to 3.8.7 are prone to a Windows-specific binary planting security vulnerability that allows for arbitrary code execution. An attacker with write privileges to the RabbitMQ installation directory and local acce…

  50. 7.1CVE-2020-14349EPSS 2.2%

    It was found that PostgreSQL versions before 12.4, before 11.9 and before 10.14 did not properly sanitize the search_path during logical replication. An authenticated attacker could use this flaw in an attack similar to CVE-2018-1058, in o…