# CWE-426.

Every Advisory and CVE whose sources give the weakness CWE-426, newest first.

## Records, newest first (an older page)

- [An issue found in Wondershare Technology Co, Ltd Edrawmind v.10.0.6 allows a remote attacker to executea arbitrary commands via the WindowsCodescs.dll file.](https://agentprime.io/advisories/CVE-2023-27759.md)
  `CVE-2023-27759` · CVE record · CVSS 7.8 High · Not analysed yet · Published 4 Apr 2023 · Tags: CWE-426
- [Adobe Creative Cloud AdobeExtensionService.exe local privilege escalation vulnerability](https://agentprime.io/advisories/CVE-2023-26358.md)
  `CVE-2023-26358` · CVE record: Adobe Creative Cloud (desktop component) · CVSS 8.6 High · Not analysed yet · Published 22 Mar 2023 · Tags: CWE-426
- [ZoneMinder contains Local File Inclusion vulnerability via \`web/ajax/modal.php\`](https://agentprime.io/advisories/CVE-2023-26038.md)
  `CVE-2023-26038` · CVE record: ZoneMinder zoneminder · CVSS 5.4 Medium · Not analysed yet · Published 25 Feb 2023 · Tags: CWE-426
- [ZoneMinder contains Local File Inclusion vulnerability](https://agentprime.io/advisories/CVE-2023-26036.md)
  `CVE-2023-26036` · CVE record: ZoneMinder zoneminder · CVSS 8.1 High · Not analysed yet · Published 25 Feb 2023 · Tags: CWE-426
- [Untrusted search path in Node](https://agentprime.io/advisories/CVE-2023-23920.md)
  `CVE-2023-23920` · CVE record: NodeJS Node · CVSS 4.2 Medium · Not analysed yet · Published 23 Feb 2023 · Tags: CWE-426
- [Untrusted search path in ELECOM CO.,LTD. ELECOM Camera Assistant and QuickFileDealer](https://agentprime.io/advisories/CVE-2023-22368.md)
  `CVE-2023-22368` · CVE record: ELECOM CO.,LTD. ELECOM Camera Assistant and QuickFileDealer · CVSS 7.8 High · Not analysed yet · Published 15 Feb 2023 · Tags: CWE-426
- [Git for Windows' installer is susceptible to DLL side loading attacks](https://agentprime.io/advisories/CVE-2023-22743.md)
  `CVE-2023-22743` · CVE record: git-for-windows git · CVSS 7.3 High · Not analysed yet · Published 14 Feb 2023 · Tags: CWE-426
- [gitk can inadvertently call executables in the worktree](https://agentprime.io/advisories/CVE-2023-23618.md)
  `CVE-2023-23618` · CVE record: git-for-windows git · CVSS 8.6 High · Not analysed yet · Published 14 Feb 2023 · Tags: CWE-426
- [Untrusted search path in Siemens TIA Multiuser Server V14 and others](https://agentprime.io/advisories/CVE-2022-35868.md)
  `CVE-2022-35868` · CVE record: Siemens TIA Multiuser Server V14 and 4 more · CVSS 6.7 Medium · Not analysed yet · Published 14 Feb 2023 · Tags: CWE-426
- [Untrusted search path in libXpm](https://agentprime.io/advisories/CVE-2022-4883.md)
  `CVE-2022-4883` · CVE record: libXpm · CVSS 8.8 High · Not analysed yet · Published 7 Feb 2023 · Tags: CWE-426
- [Git clone remote code execution vulnerability in git-for-windows](https://agentprime.io/advisories/CVE-2022-41953.md)
  `CVE-2022-41953` · CVE record: git-for-windows git · CVSS 8.6 High · Not analysed yet · Published 17 Jan 2023 · Tags: CWE-426
- [Microsoft Exchange Server Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2023-21764.md)
  `CVE-2023-21764` · CVE record: Microsoft Microsoft Exchange Server 2019 Cumulative Update 11 and 2 more · CVSS 7.8 High · Not analysed yet · Published 10 Jan 2023 · Tags: CWE-426
- [Microsoft Exchange Server Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2023-21763.md)
  `CVE-2023-21763` · CVE record: Microsoft Microsoft Exchange Server 2019 Cumulative Update 11 and 2 more · CVSS 7.8 High · Not analysed yet · Published 10 Jan 2023 · Tags: CWE-426
- [OpenStack Kolla sudo privilege escalation vulnerability](https://agentprime.io/advisories/GHSA-rvxr-pf5f-j2qj.md)
  `GHSA-rvxr-pf5f-j2qj`, `CVE-2022-38060`, `PYSEC-2026-838` · PyPI `kolla`: affected `<15.0.0.0rc1`, fixed in `15.0.0.0rc1` · CVSS 8.8 High · Not analysed yet · Published 21 Dec 2022 · Tags: Privilege escalation, CWE-426
- [openldap2: /usr/lib/openldap/start allows ldap user/group to recursively chown arbitrary directory trees to itself](https://agentprime.io/advisories/CVE-2022-31253.md)
  `CVE-2022-31253` · CVE record: openSUSE Factory · CVSS 7.1 High · Not analysed yet · Published 9 Nov 2022 · Tags: CWE-426
- [Redis on Windows dbghelp.dll uncontrolled search path](https://agentprime.io/advisories/CVE-2022-3734.md)
  `CVE-2022-3734` · CVE record: unspecified Redis · CVSS 6.3 Medium · Not analysed yet · Published 28 Oct 2022 · Tags: CWE-426
- [Privilege Escalation in OpenLiteSpeed Web Server](https://agentprime.io/advisories/CVE-2022-0074.md)
  `CVE-2022-0074` · CVE record: LiteSpeed Technologies OpenLiteSpeed Web Server and 1 more · CVSS 8.8 High · Not analysed yet · Published 27 Oct 2022 · Tags: CWE-426
- [Beijing Feishu Technology Co., Ltd Feishu v3.40.3 was discovered to contain an untrusted search path vulnerability.](https://agentprime.io/advisories/CVE-2021-3305.md)
  `CVE-2021-3305` · CVE record · CVSS 7.8 High · Not analysed yet · Published 18 Oct 2022 · Tags: CWE-426
- [Poetry vulnerable to Untrusted Search Path leading to Local Code Execution on Windows](https://agentprime.io/advisories/GHSA-j4j9-7hg9-97g6.md)
  `GHSA-j4j9-7hg9-97g6`, `CVE-2022-36070`, `PYSEC-2022-43179` · PyPI `poetry`: affected `<1.1.9`, fixed in `1.1.9` · CVSS 7.3 High · Not analysed yet · Published 11 Oct 2022 · Tags: CWE-426
- [Windows Client Server Run-time Subsystem (CSRSS) Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2022-22047.md)
  `CVE-2022-22047` · CVE record: Microsoft Windows 10 Version 1809 and 4 more · CVSS 7.8 High · Critical (KEV, CVSS 7+ and EPSS) · In CISA KEV · EPSS 0.19 · Not analysed yet · Published 12 Jul 2022 · Tags: CWE-426
- [Git for Windows' installer can be tricked into executing an untrusted binary](https://agentprime.io/advisories/CVE-2022-31012.md)
  `CVE-2022-31012` · CVE record: git-for-windows git · CVSS 8.2 High · Not analysed yet · Published 12 Jul 2022 · Tags: CWE-426
- [Viscosity DLL untrusted search path](https://agentprime.io/advisories/CVE-2017-20123.md)
  `CVE-2017-20123` · CVE record: unspecified Viscosity · CVSS 8.8 High · Not analysed yet · Published 30 Jun 2022 · Tags: CWE-426
- [sinatra does not validate expanded path matches](https://agentprime.io/advisories/GHSA-qp49-3pvw-x4m5.md)
  `GHSA-qp49-3pvw-x4m5`, `CVE-2022-29970` · RubyGems `sinatra`: affected `<2.2.0`, fixed in `2.2.0` · CVSS 7.5 High · Not analysed yet · Published 3 May 2022 · Tags: Path traversal, CWE-426
- [Disputed: OS Command injection in github.com/kardianos/service](https://agentprime.io/advisories/GHSA-xm99-6pv5-q363.md)
  `GHSA-xm99-6pv5-q363`, `CVE-2022-29583` · Go `github.com/kardianos/service`: affected `<=1.2.1`, no fixed version yet · CVSS 7.8 High · Withdrawn · Not analysed yet · Published 23 Apr 2022 · Tags: Command injection, CWE-426
- [Git LFS can execute a binary from the current directory on Windows](https://agentprime.io/advisories/GHSA-6rw3-3whw-jvjj.md)
  `GHSA-6rw3-3whw-jvjj`, `BIT-git-lfs-2022-24826`, `CVE-2022-24826` · Go `github.com/git-lfs/git-lfs` and 1 more: affected `>=2.12.1`, no fixed version yet · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Apr 2022 · Tags: CWE-426
- [Poetry before v1.1.9 contains Untrusted Search Path](https://agentprime.io/advisories/GHSA-xr2c-5w89-63pv.md)
  `GHSA-xr2c-5w89-63pv`, `CVE-2022-26184`, `PYSEC-2022-234` · PyPI `poetry`: affected `<1.1.9`, fixed in `1.1.9` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Mar 2022 · Tags: CWE-426
- [Untrusted Search Path in PNPM](https://agentprime.io/advisories/GHSA-9m87-6fj3-c5xh.md)
  `GHSA-9m87-6fj3-c5xh`, `CVE-2022-26183` · npm `pnpm`: affected `<6.15.1`, fixed in `6.15.1` · CVSS 8.8 High · Not analysed yet · Published 23 Mar 2022 · Tags: CWE-426
- [Untrusted Search Path in PostgreSQL](https://agentprime.io/advisories/GHSA-6v9v-3f4c-cjgx.md)
  `GHSA-6v9v-3f4c-cjgx` · Maven `org.postgresql:postgresql`: affected `<12.4`, fixed in `12.4` · CVSS 7.3 High · Withdrawn · Not analysed yet · Published 15 Feb 2022 · Tags: CWE-426
- [Git LFS can execute a Git binary from the current directory on Windows](https://agentprime.io/advisories/GHSA-cx3w-xqmc-84g5.md)
  `GHSA-cx3w-xqmc-84g5`, `BIT-git-lfs-2021-21237`, `CVE-2021-21237`, `GO-2021-0098` · Go `github.com/git-lfs/git-lfs`: affected `<2.13.2`, fixed in `2.13.2` · CVSS 7.2 High · Not analysed yet · Published 15 Feb 2022 · Tags: Code injection, CWE-426
- [Cortex XDR Agent: Unintended Program Execution When Using Live Terminal Session](https://agentprime.io/advisories/CVE-2022-0014.md)
  `CVE-2022-0014` · CVE record: Palo Alto Networks Cortex XDR Agent · CVSS 6.7 Medium · Not analysed yet · Published 12 Jan 2022 · Tags: CWE-426
- [Untrusted search path in Calibre](https://agentprime.io/advisories/CVE-2011-4125.md)
  `CVE-2011-4125` · CVE record: Calibre · No CVSS score · Not analysed yet · Published 27 Oct 2021 · Tags: CWE-426
- [Untrusted search path in Dell SupportAssist Client Consumer](https://agentprime.io/advisories/CVE-2021-36297.md)
  `CVE-2021-36297` · CVE record: Dell SupportAssist Client Consumer · CVSS 7.8 High · Not analysed yet · Published 28 Sept 2021 · Tags: CWE-426
- [DLL side loading vulnerability in MA for Windows](https://agentprime.io/advisories/CVE-2021-31841.md)
  `CVE-2021-31841` · CVE record: McAfee,LLC McAfee Agent for Windows · CVSS 8.2 High · Not analysed yet · Published 22 Sept 2021 · Tags: Weak cryptography or TLS, CWE-426
- [Untrusted Search Path in Nextcloud Desktop Client](https://agentprime.io/advisories/CVE-2021-37617.md)
  `CVE-2021-37617` · CVE record: nextcloud security-advisories · CVSS 7.3 High · Not analysed yet · Published 18 Aug 2021 · Tags: CWE-426
- [Untrusted search path in Dell PowerScale OneFS](https://agentprime.io/advisories/CVE-2021-21562.md)
  `CVE-2021-21562` · CVE record: Dell PowerScale OneFS · CVSS 4.4 Medium · Not analysed yet · Published 2 Aug 2021 · Tags: CWE-426
- [Untrusted search path in - PCoIP Standard Agent - PCoIP Graphics Agent - PCoIP Software Client](https://agentprime.io/advisories/CVE-2021-25698.md)
  `CVE-2021-25698` · CVE record: \- PCoIP Standard Agent - PCoIP Graphics Agent - PCoIP Software Client · No CVSS score · Not analysed yet · Published 21 Jul 2021 · Tags: CWE-426
- [Untrusted search path in - PCoIP Standard Agent - PCoIP Graphics Agent - PCoIP Software Client](https://agentprime.io/advisories/CVE-2021-25699.md)
  `CVE-2021-25699` · CVE record: \- PCoIP Standard Agent - PCoIP Graphics Agent - PCoIP Software Client · No CVSS score · Not analysed yet · Published 21 Jul 2021 · Tags: CWE-426
- [CA eHealth Performance Manager through 6.3.2.12 is affected by Privilege Escalation via a Dynamically Linked Shared Object Library.](https://agentprime.io/advisories/CVE-2021-28246.md)
  `CVE-2021-28246` · CVE record · CVSS 7.8 High · Not analysed yet · Published 26 Mar 2021 · Tags: CWE-426
- [Adobe Creative Cloud Unquoted Service Path in CCXProcess](https://agentprime.io/advisories/CVE-2021-21078.md)
  `CVE-2021-21078` · CVE record: Adobe Creative Cloud (desktop component) · CVSS 6.5 Medium · Not analysed yet · Published 12 Mar 2021 · Tags: CWE-426
- [Adobe Dreamweaver Untrusted Search Path Vulnerability Could Lead To Information Disclosure](https://agentprime.io/advisories/CVE-2021-21055.md)
  `CVE-2021-21055` · CVE record: Adobe Dreamweaver · CVSS 6.2 Medium · Not analysed yet · Published 11 Feb 2021 · Tags: CWE-426
- [Untrusted search path in SonicWall Global VPN Client](https://agentprime.io/advisories/CVE-2020-5144.md)
  `CVE-2020-5144` · CVE record: SonicWall SonicWall Global VPN Client · No CVSS score · Not analysed yet · Published 28 Oct 2020 · Tags: CWE-426
- [Untrusted search path in Check Point ZoneAlarm](https://agentprime.io/advisories/CVE-2020-6023.md)
  `CVE-2020-6023` · CVE record: Check Point ZoneAlarm · No CVSS score · Not analysed yet · Published 27 Oct 2020 · Tags: CWE-426
- [Untrusted search path in Lenovo Diagnostics](https://agentprime.io/advisories/CVE-2020-8338.md)
  `CVE-2020-8338` · CVE record: Lenovo Diagnostics · CVSS 7.8 High · Not analysed yet · Published 14 Oct 2020 · Tags: CWE-426
- [DLL Hijacking](https://agentprime.io/advisories/CVE-2020-6654.md)
  `CVE-2020-6654` · CVE record: Eaton 9000x Programming and Configuration Software · CVSS 7.8 High · Not analysed yet · Published 30 Sept 2020 · Tags: CWE-426, CWE-427
- [Untrusted search path in PostgreSQL](https://agentprime.io/advisories/CVE-2020-10733.md)
  `CVE-2020-10733` · CVE record: PostgreSQL · No CVSS score · Not analysed yet · Published 16 Sept 2020 · Tags: CWE-426
- [DLL Injection vulnerability in MA for Windows](https://agentprime.io/advisories/CVE-2020-7315.md)
  `CVE-2020-7315` · CVE record: McAfee LLC MA for Windows · CVSS 6.0 Medium · Not analysed yet · Published 10 Sept 2020 · Tags: CWE-426
- [Untrusted search path in Lenovo Drivers Management](https://agentprime.io/advisories/CVE-2020-8317.md)
  `CVE-2020-8317` · CVE record: Lenovo Drivers Management · CVSS 7.3 High · Not analysed yet · Published 24 Jul 2020 · Tags: CWE-426
- [Untrusted search path in Adobe ColdFusion 2016 and others](https://agentprime.io/advisories/CVE-2020-9673.md)
  `CVE-2020-9673` · CVE record: Adobe Adobe ColdFusion 2016 and 1 more · CVSS 7.8 High · Not analysed yet · Published 17 Jul 2020 · Tags: CWE-426
- [Untrusted search path in Adobe ColdFusion 2016 and others](https://agentprime.io/advisories/CVE-2020-9672.md)
  `CVE-2020-9672` · CVE record: Adobe Adobe ColdFusion 2016 and 1 more · CVSS 7.8 High · Not analysed yet · Published 17 Jul 2020 · Tags: CWE-426
- [DLL search order hijacking in Host IPS](https://agentprime.io/advisories/CVE-2020-7279.md)
  `CVE-2020-7279` · CVE record: McAfee, LLC McAfee Host Intrusion Prevention System (Host IPS) for Windows · CVSS 4.6 Medium · Not analysed yet · Published 10 Jun 2020 · Tags: CWE-426
- [Untrusted search path in Lenovo Installation Packages](https://agentprime.io/advisories/CVE-2019-6196.md)
  `CVE-2019-6196` · CVE record: Lenovo Installation Packages · CVSS 6.7 Medium · Not analysed yet · Published 9 Jun 2020 · Tags: CWE-426
- [Untrusted search path in Lenovo Installation Packages](https://agentprime.io/advisories/CVE-2019-6173.md)
  `CVE-2019-6173` · CVE record: Lenovo Installation Packages · CVSS 6.7 Medium · Not analysed yet · Published 9 Jun 2020 · Tags: CWE-426
- [Untrusted search path in Vijeo Designer Basic (V1.1 HotFix 15 and prior) and Vijeo Designer (V6.9 SP9…](https://agentprime.io/advisories/CVE-2020-7490.md)
  `CVE-2020-7490` · CVE record: Vijeo Designer Basic (V1.1 HotFix 15 and prior) and Vijeo Designer (V6.9 SP9 and prior) · No CVSS score · Not analysed yet · Published 22 Apr 2020 · Tags: CWE-426
- [Untrusted Search Path Vulnerability in High-Level Antimalware SDK](https://agentprime.io/advisories/CVE-2020-8096.md)
  `CVE-2020-8096` · CVE record: Bitdefender High-Level Antimalware SDK for Windows · CVSS 6.3 Medium · Not analysed yet · Published 7 Apr 2020 · Tags: CWE-426
- [Untrusted search path in ZigBee Installation Toolkit (Versions prior to 1.0.1)](https://agentprime.io/advisories/CVE-2020-7476.md)
  `CVE-2020-7476` · CVE record: ZigBee Installation Toolkit (Versions prior to 1.0.1) · No CVSS score · Not analysed yet · Published 23 Mar 2020 · Tags: CWE-426
- [Untrusted search path in Fortinet FortiClientEMS](https://agentprime.io/advisories/CVE-2020-9287.md)
  `CVE-2020-9287` · CVE record: Fortinet FortiClientEMS · CVSS 7.5 High · Not analysed yet · Published 15 Mar 2020 · Tags: CWE-426
- [Untrusted search path in Fortinet FortiClientWindows](https://agentprime.io/advisories/CVE-2020-9290.md)
  `CVE-2020-9290` · CVE record: Fortinet FortiClientWindows · CVSS 7.1 High · Not analysed yet · Published 15 Mar 2020 · Tags: CWE-426
- [Untrusted Search Path vulnerability in EPSecurityService.exe (VA-3500)](https://agentprime.io/advisories/CVE-2019-17099.md)
  `CVE-2019-17099` · CVE record: Bitdefender EPSecurityService.exe · CVSS 5.3 Medium · Not analysed yet · Published 27 Jan 2020 · Tags: CWE-426
- [Untrusted Search Path vulnerability in Bitdefender Total Security 2020 (VA-5895)](https://agentprime.io/advisories/CVE-2019-17100.md)
  `CVE-2019-17100` · CVE record: Bitdefender bdserviceshost.exe · CVSS 5.2 Medium · Not analysed yet · Published 27 Jan 2020 · Tags: CWE-426
- [Untrusted search path in Schneider Electric SE SoMachine HVAC](https://agentprime.io/advisories/CVE-2019-6826.md)
  `CVE-2019-6826` · CVE record: Schneider Electric SE SoMachine HVAC · No CVSS score · Not analysed yet · Published 17 Sept 2019 · Tags: CWE-426

Newest: <https://agentprime.io/advisories/tag/cwe-426.md>
Older: <https://agentprime.io/advisories/tag/cwe-426.md?cursor=WyIyMDE5LTA5LTE3VDE5OjU3OjU1LjAwMDAwMFoiLCJDVkUtMjAxOS02ODI2Il0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-426&cursor=WyIyMDIzLTA0LTA0VDAwOjAwOjAwLjAwMDAwMFoiLCJDVkUtMjAyMy0yNzc2MCJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-426/?cursor=WyIyMDIzLTA0LTA0VDAwOjAwOjAwLjAwMDAwMFoiLCJDVkUtMjAyMy0yNzc2MCJd>. Everything for agents: <https://agentprime.io/llms.txt>.