# CWE-426. Every Advisory and CVE whose sources give the weakness CWE-426, newest first. ## Records, newest first (an older page) - [Microsoft Dataverse Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2024-35260.md) `CVE-2024-35260` · CVE record: Microsoft Microsoft Power Platform · CVSS 8.0 High · Not analysed yet · Published 27 Jun 2024 · Tags: CWE-426 - [Samsung Magician 8.0.0 on Windows allows an admin to escalate privileges by tampering with the directory and DLL files used during the installation process.](https://agentprime.io/advisories/CVE-2024-36071.md) `CVE-2024-36071` · CVE record · CVSS 6.3 Medium · Not analysed yet · Published 20 Jun 2024 · Tags: CWE-426 - [Intelbras InControl incontrolWebcam Service unquoted search path](https://agentprime.io/advisories/CVE-2024-6080.md) `CVE-2024-6080` · CVE record: Intelbras InControl · CVSS 8.5 High · Not analysed yet · Published 17 Jun 2024 · Tags: CWE-426, CWE-428 - [iRODS before 4.3.2 provides an msiSendMail function with a problematic dependency on the mail binary, such as in the mailMS.cpp#L94-L106 reference.](https://agentprime.io/advisories/CVE-2024-38462.md) `CVE-2024-38462` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Jun 2024 · Tags: CWE-426 - [Microsoft SharePoint Server Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2024-30100.md) `CVE-2024-30100` · CVE record: Microsoft Microsoft SharePoint Enterprise Server 2016 and 2 more · CVSS 7.8 High · Not analysed yet · Published 11 Jun 2024 · Tags: CWE-426 - [An issue was discovered in Apiris Kafeo 6.4.4.](https://agentprime.io/advisories/CVE-2024-28060.md) `CVE-2024-28060` · CVE record · CVSS 7.3 High · Not analysed yet · Published 28 May 2024 · Tags: CWE-426 - [PHOENIX CONTACT: Privilege escalation in CHARX Series](https://agentprime.io/advisories/CVE-2024-28133.md) `CVE-2024-28133` · CVE record: PHOENIX CONTACT CHARX SEC-3000 and 3 more · CVSS 7.8 High · Not analysed yet · Published 14 May 2024 · Tags: CWE-426 - [ndsudo: local privilege escalation via untrusted search path](https://agentprime.io/advisories/CVE-2024-32019.md) `CVE-2024-32019` · CVE record: netdata netdata · CVSS 8.8 High · Not analysed yet · Published 12 Apr 2024 · Tags: CWE-426 - [Windows Kernel Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2024-20693.md) `CVE-2024-20693` · CVE record: Microsoft Windows 10 Version 1809 and 4 more · CVSS 7.8 High · Not analysed yet · Published 9 Apr 2024 · Tags: CWE-426 - [Lightroom Desktop | Untrusted Search Path (CWE-426)](https://agentprime.io/advisories/CVE-2024-20754.md) `CVE-2024-20754` · CVE record: Adobe Lightroom Desktop · CVSS 7.8 High · Not analysed yet · Published 18 Mar 2024 · Tags: CWE-426 - [Windows OLE Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2024-21435.md) `CVE-2024-21435` · CVE record: Microsoft Windows 11 version 22H2 and 2 more · CVSS 8.8 High · Not analysed yet · Published 12 Mar 2024 · Tags: CWE-426 - [Microsoft Exchange Server Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2024-26198.md) `CVE-2024-26198` · CVE record: Microsoft Microsoft Exchange Server 2019 Cumulative Update 14 and 2 more · CVSS 8.8 High · Not analysed yet · Published 12 Mar 2024 · Tags: CWE-426 - [Dynamic Link Library (DLL) Hijacking Vulnerability in CDAC AppSamvid Software](https://agentprime.io/advisories/CVE-2024-25103.md) `CVE-2024-25103` · CVE record: CDAC AppSamvid Software · CVSS 6.3 Medium · Not analysed yet · Published 6 Mar 2024 · Tags: CWE-426 - [electron-builder's NSIS installer - execute arbitrary code on the target machine (Windows only)](https://agentprime.io/advisories/GHSA-r4pf-3v7r-hh55.md) `GHSA-r4pf-3v7r-hh55`, `CVE-2024-27303` · npm `app-builder-lib`: affected `<24.13.2`, fixed in `24.13.2` · CVSS 7.3 High · Not analysed yet · Published 4 Mar 2024 · Tags: CWE-426, CWE-427 - [Zoom Clients - Untrusted Search Path](https://agentprime.io/advisories/CVE-2024-24697.md) `CVE-2024-24697` · CVE record: Zoom Video Communications, Inc. Zoom Clients · CVSS 7.2 High · Not analysed yet · Published 13 Feb 2024 · Tags: CWE-426 - [PanelSwWix4.Sdk .be TEMP folder is vulnerable to DLL redirection attacks that allow the attacker to escalate privileges](https://agentprime.io/advisories/GHSA-8v28-3g86-chj5.md) `GHSA-8v28-3g86-chj5` · NuGet `PanelSwWix4.Sdk`: affected `<5.0.0-psw-wix.0251-40`, fixed in `5.0.0-psw-wix.0251-40` · CVSS 8.2 High · Not analysed yet · Published 8 Feb 2024 · Tags: CWE-426 - [Panel::Software Customized WiX .be TEMP folder is vulnerable to DLL redirection attacks that allow the attacker to escalate privileges](https://agentprime.io/advisories/GHSA-259p-rvjx-ffwg.md) `GHSA-259p-rvjx-ffwg` · NuGet `PanelSW.Custom.WiX`: affected `<3.15.0-a44`, fixed in `3.15.0-a44` · CVSS 8.2 High · Not analysed yet · Published 8 Feb 2024 · Tags: CWE-426 - [WiX Toolset's .be TEMP folder is vulnerable to DLL redirection attacks that allow the attacker to escalate privileges](https://agentprime.io/advisories/GHSA-7wh2-wxc7-9ph5.md) `GHSA-7wh2-wxc7-9ph5`, `CVE-2024-24810` · NuGet `wix`: affected `<3.14.0 || >=4.0.0, <4.0.4`, fixed in `3.14.0`, `4.0.4` · CVSS 8.3 High · Not analysed yet · Published 8 Feb 2024 · Tags: CWE-426 - [Untrusted search path in Cybozu, Inc. Cybozu KUNAI for Android](https://agentprime.io/advisories/CVE-2024-23304.md) `CVE-2024-23304` · CVE record: Cybozu, Inc. Cybozu KUNAI for Android · CVSS 7.5 High · Not analysed yet · Published 6 Feb 2024 · Tags: CWE-426 - [Yarn untrusted search path vulnerability](https://agentprime.io/advisories/GHSA-mpwj-fcr6-x34c.md) `GHSA-mpwj-fcr6-x34c`, `CVE-2021-4435` · npm `yarn`: affected `<1.22.13`, fixed in `1.22.13` · CVSS 7.7 High · Not analysed yet · Published 4 Feb 2024 · Tags: CWE-426 - [Binary Planting Attack on Windows Platforms in Creditcoin](https://agentprime.io/advisories/CVE-2024-22410.md) `CVE-2024-22410` · CVE record: gluwa creditcoin · CVSS 3.3 Low · Not analysed yet · Published 17 Jan 2024 · Tags: CWE-426 - [Untrusted search path under some conditions on Windows allows arbitrary code execution](https://agentprime.io/advisories/GHSA-2mqj-m65w-jghx.md) `GHSA-2mqj-m65w-jghx`, `CVE-2024-22190`, `PYSEC-2024-4` · PyPI `gitpython`: affected `<3.1.41`, fixed in `3.1.41` · CVSS 7.8 High · Not analysed yet · Published 10 Jan 2024 · Tags: CWE-426 - [Microsoft Printer Metadata Troubleshooter Tool Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2024-21325.md) `CVE-2024-21325` · CVE record: Microsoft Microsoft Printer Metadata Troubleshooter Tool · CVSS 7.8 High · Not analysed yet · Published 9 Jan 2024 · Tags: CWE-426 - [Untrusted search path in Dell SupportAssist Client Consumer](https://agentprime.io/advisories/CVE-2023-48670.md) `CVE-2023-48670` · CVE record: Dell SupportAssist Client Consumer · CVSS 7.3 High · Not analysed yet · Published 22 Dec 2023 · Tags: CWE-426 - [Untrusted search path in Zoom Video Communications, Inc. Zoom Desktop Client for Windows…](https://agentprime.io/advisories/CVE-2023-43586.md) `CVE-2023-43586` · CVE record: Zoom Video Communications, Inc. Zoom Desktop Client for Windows, Zoom VDI Client for Windows and Zoom SDKs for Windows · CVSS 7.3 High · Not analysed yet · Published 13 Dec 2023 · Tags: CWE-426 - [XAML Diagnostics Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2023-36003.md) `CVE-2023-36003` · CVE record: Microsoft Windows 10 Version 1809 and 4 more · CVSS 6.7 Medium · Not analysed yet · Published 12 Dec 2023 · Tags: CWE-426 - [Apache Hadoop allows local user to gain root privileges](https://agentprime.io/advisories/GHSA-94jh-j374-9r3j.md) `GHSA-94jh-j374-9r3j`, `CVE-2023-26031` · Maven `org.apache.hadoop:hadoop-yarn-project`: affected `>=3.3.1, <3.3.5`, fixed in `3.3.5` · CVSS 7.5 High · Not analysed yet · Published 16 Nov 2023 · Tags: CWE-426 - [Untrusted search path in Zoom Video Communications, Inc. Zoom Rooms Client for Windows and Zoom VDI…](https://agentprime.io/advisories/CVE-2023-39202.md) `CVE-2023-39202` · CVE record: Zoom Video Communications, Inc. Zoom Rooms Client for Windows and Zoom VDI Client · CVSS 3.1 Low · Not analysed yet · Published 14 Nov 2023 · Tags: CWE-426 - [Untrusted search path in Fortinet FortiClientWindows](https://agentprime.io/advisories/CVE-2023-41840.md) `CVE-2023-41840` · CVE record: Fortinet FortiClientWindows · CVSS 7.4 High · Not analysed yet · Published 14 Nov 2023 · Tags: CWE-426 - [Windows User Interface Application Core Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2023-36393.md) `CVE-2023-36393` · CVE record: Microsoft Windows 10 Version 1809 and 4 more · CVSS 7.8 High · Not analysed yet · Published 14 Nov 2023 · Tags: CWE-426 - [Microsoft Windows Defender Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2023-36422.md) `CVE-2023-36422` · CVE record: Microsoft Windows Defender Antimalware Platform · CVSS 7.8 High · Not analysed yet · Published 14 Nov 2023 · Tags: CWE-426 - [Privilege Escalation for ZCC macOS via PATH Variable](https://agentprime.io/advisories/CVE-2021-26738.md) `CVE-2021-26738` · CVE record: Zscaler Client Connector · CVSS 7.8 High · Not analysed yet · Published 23 Oct 2023 · Tags: CWE-426 - [Microsoft Exchange Server Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2023-36778.md) `CVE-2023-36778` · CVE record: Microsoft Microsoft Exchange Server 2019 Cumulative Update 13 and 2 more · CVSS 8.0 High · Not analysed yet · Published 10 Oct 2023 · Tags: CWE-426 - [Skype for Business Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2023-36780.md) `CVE-2023-36780` · CVE record: Microsoft Skype for Business Server 2019 CU7 and 1 more · CVSS 7.2 High · Not analysed yet · Published 10 Oct 2023 · Tags: CWE-426 - [Windows Client Server Run-time Subsystem (CSRSS) Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2023-41766.md) `CVE-2023-41766` · CVE record: Microsoft Windows 10 Version 1809 and 4 more · CVSS 7.8 High · Not analysed yet · Published 10 Oct 2023 · Tags: CWE-426 - [Untrusted search path in Zoom Video Communications, Inc. CleanZoom](https://agentprime.io/advisories/CVE-2023-39201.md) `CVE-2023-39201` · CVE record: Zoom Video Communications, Inc. CleanZoom · CVSS 7.2 High · Not analysed yet · Published 12 Sept 2023 · Tags: CWE-426 - [Untrusted Search Path in vim/vim](https://agentprime.io/advisories/CVE-2023-4736.md) `CVE-2023-4736` · CVE record: vim vim/vim · CVSS 7.8 High · Not analysed yet · Published 2 Sept 2023 · Tags: CWE-426 - [GitPython untrusted search path on Windows systems leading to arbitrary code execution](https://agentprime.io/advisories/GHSA-wfm5-v35h-vwf4.md) `GHSA-wfm5-v35h-vwf4`, `CVE-2023-40590`, `PYSEC-2023-161` · PyPI `gitpython`: affected `<3.1.33`, fixed in `3.1.33` · CVSS 7.8 High · Not analysed yet · Published 29 Aug 2023 · Tags: CWE-426 - [Adobe Acrobat Reader Untrusted Search Path Application denial-of-service](https://agentprime.io/advisories/CVE-2023-29299.md) `CVE-2023-29299` · CVE record: Adobe Acrobat Reader · CVSS 4.7 Medium · Not analysed yet · Published 10 Aug 2023 · Tags: CWE-426 - [Tablet Windows User Interface Application Core Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2023-36898.md) `CVE-2023-36898` · CVE record: Microsoft Windows 11 version 21H2 and 1 more · CVSS 7.8 High · Not analysed yet · Published 8 Aug 2023 · Tags: CWE-426 - [Untrusted search path in Zoom Video Communications, Inc. Zoom Desktop Client for Windows](https://agentprime.io/advisories/CVE-2023-36540.md) `CVE-2023-36540` · CVE record: Zoom Video Communications, Inc. Zoom Desktop Client for Windows · CVSS 7.3 High · Not analysed yet · Published 8 Aug 2023 · Tags: CWE-426 - [Untrusted search path in Zoom Video Communications, Inc. Zoom Rooms for Windows](https://agentprime.io/advisories/CVE-2023-36538.md) `CVE-2023-36538` · CVE record: Zoom Video Communications, Inc. Zoom Rooms for Windows · CVSS 8.4 High · Not analysed yet · Published 11 Jul 2023 · Tags: CWE-426 - [Untrusted search path in Zoom Video Communications, Inc. Zoom Rooms for Windows](https://agentprime.io/advisories/CVE-2023-36536.md) `CVE-2023-36536` · CVE record: Zoom Video Communications, Inc. Zoom Rooms for Windows · CVSS 8.2 High · Not analysed yet · Published 11 Jul 2023 · Tags: CWE-426 - [Untrusted search path in Zoom Video Communications, Inc. Zoom Rooms for Windows](https://agentprime.io/advisories/CVE-2023-34119.md) `CVE-2023-34119` · CVE record: Zoom Video Communications, Inc. Zoom Rooms for Windows · CVSS 8.2 High · Not analysed yet · Published 11 Jul 2023 · Tags: CWE-426 - [Windows Geolocation Service Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2023-35343.md) `CVE-2023-35343` · CVE record: Microsoft Windows 10 Version 1809 and 4 more · CVSS 7.8 High · Not analysed yet · Published 11 Jul 2023 · Tags: CWE-426 - [sccache vulnerable to privilege escalation if server is run as root](https://agentprime.io/advisories/GHSA-x7fr-pg8f-93f5.md) `GHSA-x7fr-pg8f-93f5`, `CVE-2023-1521` · crates.io `sccache`: affected `<0.4.0`, fixed in `0.4.0` · CVSS 8.4 High · Not analysed yet · Published 30 May 2023 · Tags: CWE-426 - [SoftExpert (SE) Excellence Suite 2.x versions before 2.1.3 is vulnerable to Local File Inclusion in the function /se/v42300/generic/gn_defaultframe/2.0/defaultframe_filter.php.](https://agentprime.io/advisories/CVE-2023-30330.md) `CVE-2023-30330` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 12 May 2023 · Tags: CWE-426 - [kodbox 1.2.x through 1.3.7 has a Sensitive Information Leakage issue.](https://agentprime.io/advisories/CVE-2023-29790.md) `CVE-2023-29790` · CVE record · CVSS 7.5 High · Not analysed yet · Published 12 May 2023 · Tags: CWE-426 - [Local Privilege Escalation](https://agentprime.io/advisories/CVE-2023-28143.md) `CVE-2023-28143` · CVE record: Qualys Cloud Agent · CVSS 6.7 Medium · Not analysed yet · Published 18 Apr 2023 · Tags: CWE-426 - [An issue found in Wondershare Technology Co.,Ltd Creative Centerr v.1.0.8 allows a remote attacker to execute arbitrary commands via the wondershareCC_setup_full10819.exe file.](https://agentprime.io/advisories/CVE-2023-27771.md) `CVE-2023-27771` · CVE record · CVSS 7.8 High · Not analysed yet · Published 4 Apr 2023 · Tags: CWE-426 - [An issue found in Wondershare Technology Co.,Ltd PDF Reader v.1.0.1 allows a remote attacker to execute arbitrary commands via the pdfreader_setup_full13143.exe file.](https://agentprime.io/advisories/CVE-2023-27769.md) `CVE-2023-27769` · CVE record · CVSS 7.8 High · Not analysed yet · Published 4 Apr 2023 · Tags: CWE-426 - [An issue found in Wondershare Technology Co.,Ltd PDFelement v9.1.1 allows a remote attacker to execute arbitrary commands via the pdfelement-pro_setup_full5239.exe file.](https://agentprime.io/advisories/CVE-2023-27768.md) `CVE-2023-27768` · CVE record · CVSS 7.8 High · Not analysed yet · Published 4 Apr 2023 · Tags: CWE-426 - [An issue found in Wondershare Technology Co.,Ltd Dr.Fone v.12.4.9 allows a remote attacker to execute arbitrary commands via the drfone_setup_full3360.exe file.](https://agentprime.io/advisories/CVE-2023-27767.md) `CVE-2023-27767` · CVE record · CVSS 7.8 High · Not analysed yet · Published 4 Apr 2023 · Tags: CWE-426 - [An issue found in Wondershare Technology Co.,Ltd Anireel 1.5.4 allows a remote attacker to execute arbitrary commands via the anireel_setup_full9589.exe file.](https://agentprime.io/advisories/CVE-2023-27766.md) `CVE-2023-27766` · CVE record · CVSS 7.8 High · Not analysed yet · Published 4 Apr 2023 · Tags: CWE-426 - [An issue found in Wondershare Technology Co.,Ltd Recoverit v.10.6.3 allows a remote attacker to execute arbitrary commands via the recoverit_setup_full4134.exe file.](https://agentprime.io/advisories/CVE-2023-27765.md) `CVE-2023-27765` · CVE record · CVSS 7.8 High · Not analysed yet · Published 4 Apr 2023 · Tags: CWE-426 - [An issue found in Wondershare Technology Co.,Ltd Repairit v.3.5.4 allows a remote attacker to execute arbitrary commands via the repairit_setup_full5913.exe file.](https://agentprime.io/advisories/CVE-2023-27764.md) `CVE-2023-27764` · CVE record · CVSS 7.8 High · Not analysed yet · Published 4 Apr 2023 · Tags: CWE-426 - [An issue found in Wondershare Technology Co.,Ltd MobileTrans v.4.0.2 allows a remote attacker to execute arbitrary commands via the mobiletrans_setup_full5793.exe file.](https://agentprime.io/advisories/CVE-2023-27763.md) `CVE-2023-27763` · CVE record · CVSS 7.8 High · Not analysed yet · Published 4 Apr 2023 · Tags: CWE-426 - [An issue found in Wondershare Technology Co., Ltd DemoCreator v.6.0.0 allows a remote attacker to execute arbitrary commands via the democreator_setup_full7743.exe file.](https://agentprime.io/advisories/CVE-2023-27762.md) `CVE-2023-27762` · CVE record · CVSS 7.8 High · Not analysed yet · Published 4 Apr 2023 · Tags: CWE-426 - [An issue found in Wondershare Technology Co., Ltd UniConverter v.14.0.0 allows a remote attacker to execute arbitrary commands via the uniconverter14_64bit_setup_full14204.exe file.](https://agentprime.io/advisories/CVE-2023-27761.md) `CVE-2023-27761` · CVE record · CVSS 7.8 High · Not analysed yet · Published 4 Apr 2023 · Tags: CWE-426 - [An issue found in Wondershare Technology Co, Ltd Filmora v.12.0.9 allows a remote attacker to execute arbitrary commands via the filmora_setup_full846.exe.](https://agentprime.io/advisories/CVE-2023-27760.md) `CVE-2023-27760` · CVE record · CVSS 7.8 High · Not analysed yet · Published 4 Apr 2023 · Tags: CWE-426 Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .