Advisories · Weakness
CWE-426.
Every Advisory and CVE whose sources give the weakness CWE-426, newest first.
- CVSS 7.8 High
An issue found in Wondershare Technology Co, Ltd Edrawmind v.10.0.6 allows a remote attacker to executea arbitrary commands via the WindowsCodescs.dll file.
- CWE-426
- CVSS 8.6 High
Adobe Creative Cloud AdobeExtensionService.exe local privilege escalation vulnerability
- Adobe Creative Cloud (desktop component)
- CWE-426
- CVSS 5.4 Medium
ZoneMinder contains Local File Inclusion vulnerability via `web/ajax/modal.php`
- zoneminder
- CWE-426
- CVSS 8.1 High
ZoneMinder contains Local File Inclusion vulnerability
- zoneminder
- CWE-426
- CVSS 4.2 Medium
Untrusted search path in Node
- Node
- CWE-426
- CVSS 7.8 High
Untrusted search path in ELECOM CO.,LTD. ELECOM Camera Assistant and QuickFileDealer
- ELECOM CO.,LTD. ELECOM Camera Assistant and QuickFileDealer
- CWE-426
- CVSS 7.3 High
Git for Windows' installer is susceptible to DLL side loading attacks
- git
- CWE-426
- CVSS 8.6 High
gitk can inadvertently call executables in the worktree
- git
- CWE-426
- CVSS 6.7 Medium
Untrusted search path in Siemens TIA Multiuser Server V14 and others
- Siemens TIA Multiuser Server V14
- Siemens TIA Multiuser Server V15
- CWE-426
- CVSS 8.8 High
Untrusted search path in libXpm
- libXpm
- CWE-426
- CVSS 8.6 High
Git clone remote code execution vulnerability in git-for-windows
- git
- CWE-426
- CVSS 7.8 High
Microsoft Exchange Server Elevation of Privilege Vulnerability
- Microsoft Exchange Server 2019 Cumulative Update 11
- Microsoft Exchange Server 2019 Cumulative Update 12
- CWE-426
- CVSS 7.8 High
Microsoft Exchange Server Elevation of Privilege Vulnerability
- Microsoft Exchange Server 2019 Cumulative Update 11
- Microsoft Exchange Server 2019 Cumulative Update 12
- CWE-426
- CVSS 8.8 High
OpenStack Kolla sudo privilege escalation vulnerability
- Privilege escalation
- CWE-426
<15.0.0.0rc1 · fixed in 15.0.0.0rc1
GHSA-rvxr-pf5f-j2qj · CVE-2022-38060 - CVSS 7.1 High
openldap2: /usr/lib/openldap/start allows ldap user/group to recursively chown arbitrary directory trees to itself
- openSUSE Factory
- CWE-426
- CVSS 6.3 Medium
Redis on Windows dbghelp.dll uncontrolled search path
- Redis
- CWE-426
- CVSS 8.8 High
Privilege Escalation in OpenLiteSpeed Web Server
- LiteSpeed Technologies OpenLiteSpeed Web Server
- LiteSpeed Technologies LiteSpeed Web Server
- CWE-426
- CVSS 7.8 High
Beijing Feishu Technology Co., Ltd Feishu v3.40.3 was discovered to contain an untrusted search path vulnerability.
- CWE-426
- CVSS 7.3 High
Poetry vulnerable to Untrusted Search Path leading to Local Code Execution on Windows
- CWE-426
<1.1.9 · fixed in 1.1.9
GHSA-j4j9-7hg9-97g6 · CVE-2022-36070 - CVSS 7.8 HighCritical · KEV, CVSS 7+ and EPSSKEV
Windows Client Server Run-time Subsystem (CSRSS) Elevation of Privilege Vulnerability
- Microsoft Windows 10 Version 1809
- Microsoft Windows Server 2019
- CWE-426
- CVSS 8.2 High
Git for Windows' installer can be tricked into executing an untrusted binary
- git
- CWE-426
- CVSS 8.8 High
Viscosity DLL untrusted search path
- Viscosity
- CWE-426
- CVSS 7.5 High
sinatra does not validate expanded path matches
- Path traversal
- CWE-426
<2.2.0 · fixed in 2.2.0
GHSA-qp49-3pvw-x4m5 · CVE-2022-29970 - CVSS 7.8 High
Disputed: OS Command injection in github.com/kardianos/service
- Command injection
- CWE-426
<=1.2.1 · no fixed version yet
GHSA-xm99-6pv5-q363 · CVE-2022-29583 - CVSS 9.8 CriticalCritical · CVSS 9+
Git LFS can execute a binary from the current directory on Windows
- CWE-426
>=2.12.1 · no fixed version yet
GHSA-6rw3-3whw-jvjj · CVE-2022-24826 - CVSS 9.8 CriticalCritical · CVSS 9+
Poetry before v1.1.9 contains Untrusted Search Path
- CWE-426
<1.1.9 · fixed in 1.1.9
GHSA-xr2c-5w89-63pv · CVE-2022-26184 - CVSS 8.8 High
Untrusted Search Path in PNPM
- CWE-426
<6.15.1 · fixed in 6.15.1
GHSA-9m87-6fj3-c5xh · CVE-2022-26183 - CVSS 7.3 High
Untrusted Search Path in PostgreSQL
- CWE-426
<12.4 · fixed in 12.4
GHSA-6v9v-3f4c-cjgx - CVSS 7.2 High
Git LFS can execute a Git binary from the current directory on Windows
- Code injection
- CWE-426
<2.13.2 · fixed in 2.13.2
GHSA-cx3w-xqmc-84g5 · CVE-2021-21237 - CVSS 6.7 Medium
Cortex XDR Agent: Unintended Program Execution When Using Live Terminal Session
- Palo Alto Networks Cortex XDR Agent
- CWE-426
-
Untrusted search path in Calibre
- Calibre
- CWE-426
- CVSS 7.8 High
Untrusted search path in Dell SupportAssist Client Consumer
- Dell SupportAssist Client Consumer
- CWE-426
- CVSS 8.2 High
DLL side loading vulnerability in MA for Windows
- McAfee,LLC McAfee Agent for Windows
- Weak cryptography or TLS
- CWE-426
- CVSS 7.3 High
Untrusted Search Path in Nextcloud Desktop Client
- nextcloud security-advisories
- CWE-426
- CVSS 4.4 Medium
Untrusted search path in Dell PowerScale OneFS
- Dell PowerScale OneFS
- CWE-426
-
Untrusted search path in - PCoIP Standard Agent - PCoIP Graphics Agent - PCoIP Software Client
- - PCoIP Standard Agent - PCoIP Graphics Agent - PCoIP Software Client
- CWE-426
-
Untrusted search path in - PCoIP Standard Agent - PCoIP Graphics Agent - PCoIP Software Client
- - PCoIP Standard Agent - PCoIP Graphics Agent - PCoIP Software Client
- CWE-426
- CVSS 7.8 High
CA eHealth Performance Manager through 6.3.2.12 is affected by Privilege Escalation via a Dynamically Linked Shared Object Library.
- CWE-426
- CVSS 6.5 Medium
Adobe Creative Cloud Unquoted Service Path in CCXProcess
- Adobe Creative Cloud (desktop component)
- CWE-426
- CVSS 6.2 Medium
Adobe Dreamweaver Untrusted Search Path Vulnerability Could Lead To Information Disclosure
- Adobe Dreamweaver
- CWE-426
-
Untrusted search path in SonicWall Global VPN Client
- SonicWall Global VPN Client
- CWE-426
-
Untrusted search path in Check Point ZoneAlarm
- Check Point ZoneAlarm
- CWE-426
- CVSS 7.8 High
Untrusted search path in Lenovo Diagnostics
- Lenovo Diagnostics
- CWE-426
- CVSS 7.8 High
DLL Hijacking
- Eaton 9000x Programming and Configuration Software
- CWE-426
- CWE-427
-
Untrusted search path in PostgreSQL
- PostgreSQL
- CWE-426
- CVSS 6.0 Medium
DLL Injection vulnerability in MA for Windows
- McAfee LLC MA for Windows
- CWE-426
- CVSS 7.3 High
Untrusted search path in Lenovo Drivers Management
- Lenovo Drivers Management
- CWE-426
- CVSS 7.8 High
Untrusted search path in Adobe ColdFusion 2016 and others
- Adobe ColdFusion 2016
- Adobe ColdFusion 2018
- CWE-426
- CVSS 7.8 High
Untrusted search path in Adobe ColdFusion 2016 and others
- Adobe ColdFusion 2016
- Adobe ColdFusion 2018
- CWE-426
- CVSS 4.6 Medium
DLL search order hijacking in Host IPS
- McAfee, LLC McAfee Host Intrusion Prevention System (Host IPS) for Windows
- CWE-426
- CVSS 6.7 Medium
Untrusted search path in Lenovo Installation Packages
- Lenovo Installation Packages
- CWE-426
- CVSS 6.7 Medium
Untrusted search path in Lenovo Installation Packages
- Lenovo Installation Packages
- CWE-426
-
Untrusted search path in Vijeo Designer Basic (V1.1 HotFix 15 and prior) and Vijeo Designer (V6.9 SP9…
- Vijeo Designer Basic (V1.1 HotFix 15 and prior) and Vijeo Designer (V6.9 SP9 and prior)
- CWE-426
- CVSS 6.3 Medium
Untrusted Search Path Vulnerability in High-Level Antimalware SDK
- Bitdefender High-Level Antimalware SDK for Windows
- CWE-426
-
Untrusted search path in ZigBee Installation Toolkit (Versions prior to 1.0.1)
- ZigBee Installation Toolkit (Versions prior to 1.0.1)
- CWE-426
- CVSS 7.5 High
Untrusted search path in Fortinet FortiClientEMS
- Fortinet FortiClientEMS
- CWE-426
- CVSS 7.1 High
Untrusted search path in Fortinet FortiClientWindows
- Fortinet FortiClientWindows
- CWE-426
- CVSS 5.3 Medium
Untrusted Search Path vulnerability in EPSecurityService.exe (VA-3500)
- Bitdefender EPSecurityService.exe
- CWE-426
- CVSS 5.2 Medium
Untrusted Search Path vulnerability in Bitdefender Total Security 2020 (VA-5895)
- Bitdefender bdserviceshost.exe
- CWE-426
-
Untrusted search path in Schneider Electric SE SoMachine HVAC
- Schneider Electric SE SoMachine HVAC
- CWE-426