cve.bz

CWE-428: Unquoted Search Path or Element, page 10

Filter

The product uses a search path that contains an unquoted element, in which the element contains whitespace or other separators. This can cause the product to access resources in a parent path.

What the weakness is: CWE-428 at MITRE. All weaknesses

Ask an AI about CWE-428

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CWE-428: Unquoted Search Path or Element and how to prevent and detect it in code. Use https://cwe.mitre.org/data/definitions/428.html and https://cve.bz/cve/cwe/428?via=ask-ai-copy for recent CVEs with this weakness. Cite the sources.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this weakness's id and public links.

  1. 7.8CVE-2017-3005EPSS 0.9%

    Adobe Photoshop versions CC 2017 (18.0.1) and earlier, CC 2015.5.1 (17.0.1) and earlier have an unquoted search path vulnerability.

  2. 6.7CVE-2017-5873EPSS 0.4%

    Unquoted Windows search path vulnerability in the guest service in Unisys s-Par before 4.4.20 allows local users to gain privileges via a Trojan horse executable file in the %SYSTEMDRIVE% directory, as demonstrated by program.exe.

  3. 7.8CVE-2016-8225EPSS 0.4%

    Unquoted service path vulnerability in Lenovo Edge and Lenovo Slim USB Keyboard Driver versions earlier than 1.21 allows local users to execute code with elevated privileges.

  4. 7.8CVE-2016-6935EPSS 0.8%

    Unquoted Windows search path vulnerability in Adobe Creative Cloud Desktop Application before 3.8.0.310 on Windows allows local users to gain privileges via a Trojan horse executable file in the %SYSTEMDRIVE% directory.

  5. 8.8CVE-2016-5793EPSS 0.4%

    Unquoted Windows search path vulnerability in Moxa Active OPC Server before 2.4.19 allows local users to gain privileges via a Trojan horse executable file in the %SYSTEMDRIVE% directory.

  6. –CVE-2015-4173EPSS 2.1%

    Unquoted Windows search path vulnerability in the autorun value in Dell SonicWall NetExtender before 7.5.227 and 8.0.x before 8.0.238, as used in the SRA firmware before 7.5.1.2-40sv and 8.x before 8.0.0.3-23sv, allows local users to gain …

  7. 5.3CVE-2014-5455ExploitEPSS 1.0%

    Unquoted Windows search path vulnerability in the ptservice service prior to PrivateTunnel version 3.0 (Windows) and OpenVPN Connect version 3.1 (Windows) allows local users to gain privileges via a crafted program.exe file in the %SYSTEMD…

  8. 5.9CVE-2014-0759EPSS 0.4%

    Unquoted Windows search path vulnerability in Schneider Electric Floating License Manager 1.0.0 through 1.4.0 allows local users to gain privileges via a Trojan horse application with a name composed of an initial substring of a path that …

  9. 7.8CVE-2013-1609EPSS 0.4%

    Multiple unquoted Windows search path vulnerabilities in the (1) File Collector and (2) File PlaceHolder services in Symantec Enterprise Vault (EV) for File System Archiving before 9.0.4 and 10.x before 10.0.1 allow local users to gain pri…