# CWE-427.

Every Advisory and CVE whose sources give the weakness CWE-427, newest first.

## Records, newest first (an older page)

- [Uncontrolled search path in SonicWall Global VPN Client](https://agentprime.io/advisories/CVE-2021-20051.md)
  `CVE-2021-20051` · CVE record: SonicWall SonicWall Global VPN Client · No CVSS score · Not analysed yet · Published 4 May 2022 · Tags: CWE-427
- [Uncontrolled search path in Samsung Mobile Gear IconX PC Manager](https://agentprime.io/advisories/CVE-2022-28792.md)
  `CVE-2022-28792` · CVE record: Samsung Mobile Gear IconX PC Manager · CVSS 6.2 Medium · Not analysed yet · Published 3 May 2022 · Tags: CWE-427
- [Cheetah Path Search Order Hijacking](https://agentprime.io/advisories/GHSA-vxf2-7rc3-pxmx.md)
  `GHSA-vxf2-7rc3-pxmx`, `CVE-2005-1632`, `PYSEC-2026-622` · PyPI `cheetah`: affected `>=0.9.15, <=0.9.16`, no fixed version yet · No CVSS score · Not analysed yet · Published 1 May 2022 · Tags: CWE-427
- [Uncontrolled search path in Lenovo PCManager](https://agentprime.io/advisories/CVE-2022-0192.md)
  `CVE-2022-0192` · CVE record: Lenovo PCManager · CVSS 7.3 High · Not analysed yet · Published 22 Apr 2022 · Tags: CWE-427
- [Uncontrolled search path in Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8) and others](https://agentprime.io/advisories/CVE-2022-24767.md)
  `CVE-2022-24767` · CVE record: Microsoft Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8) and 4 more · CVSS 7.8 High · Not analysed yet · Published 12 Apr 2022 · Tags: CWE-427
- [Uncontrolled search path in Siemens SIMATIC Energy Manager Basic and others](https://agentprime.io/advisories/CVE-2022-23449.md)
  `CVE-2022-23449` · CVE record: Siemens SIMATIC Energy Manager Basic and 1 more · No CVSS score · Not analysed yet · Published 12 Apr 2022 · Tags: CWE-427
- [Uncontrolled search for the Git directory in Git for Windows](https://agentprime.io/advisories/CVE-2022-24765.md)
  `CVE-2022-24765` · CVE record: git-for-windows git · CVSS 6.0 Medium · Not analysed yet · Published 12 Apr 2022 · Tags: CWE-427
- [Uncontrolled search path in Samsung Mobile Samsung Android USB Driver windows installer](https://agentprime.io/advisories/CVE-2022-28779.md)
  `CVE-2022-28779` · CVE record: Samsung Mobile Samsung Android USB Driver windows installer · CVSS 5.3 Medium · Not analysed yet · Published 11 Apr 2022 · Tags: CWE-427
- [Delta Electronics DIAEnergie Uncontrolledly Search Path Element](https://agentprime.io/advisories/CVE-2022-1098.md)
  `CVE-2022-1098` · CVE record: DIAEnerrgie DIAEnergie · CVSS 7.8 High · Not analysed yet · Published 1 Apr 2022 · Tags: CWE-427
- [Uncontrolled search path in Dell Command Update (DCU)](https://agentprime.io/advisories/CVE-2022-24426.md)
  `CVE-2022-24426` · CVE record: Dell Dell Command Update (DCU) · CVSS 7.8 High · Not analysed yet · Published 1 Apr 2022 · Tags: CWE-427
- [SanDisk Professional G-RAID 4/8 Software Utility, Privilege Escalation](https://agentprime.io/advisories/CVE-2022-22996.md)
  `CVE-2022-22996` · CVE record: SanDisk Professional G-RAID 4/8 Software Utility · CVSS 7.8 High · Not analysed yet · Published 30 Mar 2022 · Tags: CWE-427
- [Rockwell Automation ISaGRAF5 Runtime Uncontrolled Search Path Element](https://agentprime.io/advisories/CVE-2020-25182.md)
  `CVE-2020-25182` · CVE record: Rockwell Automation ISaGRAF Runtime · CVSS 6.7 Medium · Not analysed yet · Published 18 Mar 2022 · Tags: CWE-427
- [Uncontrolled search path in KINGSOFT JAPAN, INC. WPS Presentation](https://agentprime.io/advisories/CVE-2022-26511.md)
  `CVE-2022-26511` · CVE record: KINGSOFT JAPAN, INC. WPS Presentation · No CVSS score · Not analysed yet · Published 17 Mar 2022 · Tags: CWE-427
- [Uncontrolled search path in KINGSOFT JAPAN, INC. The installer of WPS Office](https://agentprime.io/advisories/CVE-2022-26081.md)
  `CVE-2022-26081` · CVE record: KINGSOFT JAPAN, INC. The installer of WPS Office · No CVSS score · Not analysed yet · Published 17 Mar 2022 · Tags: CWE-427
- [Uncontrolled search path in KINGSOFT JAPAN, INC. The installer of WPS Office](https://agentprime.io/advisories/CVE-2022-25969.md)
  `CVE-2022-25969` · CVE record: KINGSOFT JAPAN, INC. The installer of WPS Office · No CVSS score · Not analysed yet · Published 17 Mar 2022 · Tags: CWE-427
- [Uncontrolled search path in Yokogawa Electric Corporation CENTUM CS 3000 and others](https://agentprime.io/advisories/CVE-2022-23401.md)
  `CVE-2022-23401` · CVE record: Yokogawa Electric Corporation CENTUM CS 3000 and 2 more · No CVSS score · Not analysed yet · Published 11 Mar 2022 · Tags: CWE-427
- [Adobe Creative Cloud Desktop Uncontrolled Search Path Element Arbitrary code execution](https://agentprime.io/advisories/CVE-2022-23202.md)
  `CVE-2022-23202` · CVE record: Adobe Creative Cloud (desktop component) · CVSS 7.0 High · Not analysed yet · Published 16 Feb 2022 · Tags: CWE-427
- [Uncontrolled search path in Atlassian Confluence Server and others](https://agentprime.io/advisories/CVE-2021-43940.md)
  `CVE-2021-43940` · CVE record: Atlassian Confluence Server and 1 more · CVSS 7.8 High · Not analysed yet · Published 15 Feb 2022 · Tags: CWE-427
- [Uncontrolled search path in Axis Communications AB AXIS IP Utility](https://agentprime.io/advisories/CVE-2022-23410.md)
  `CVE-2022-23410` · CVE record: Axis Communications AB AXIS IP Utility · No CVSS score · Not analysed yet · Published 14 Feb 2022 · Tags: CWE-427
- [Git LFS can execute a Git binary from the current directory](https://agentprime.io/advisories/GHSA-4g4p-42wc-9f3m.md)
  `GHSA-4g4p-42wc-9f3m`, `BIT-git-lfs-2020-27955`, `CVE-2020-27955` · Go `github.com/git-lfs/git-lfs`: affected `<2.12.1`, fixed in `2.12.1` · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.82 · Not analysed yet · Published 11 Feb 2022 · Tags: CWE-427
- [Local privilege escalation due to insecure folder permissions](https://agentprime.io/advisories/CVE-2022-0483.md)
  `CVE-2022-0483` · CVE record: Acronis Acronis VSS Doctor · No CVSS score · Not analysed yet · Published 11 Feb 2022 · Tags: CWE-427
- [Uncontrolled search path in SAP SE SAP Adaptive Server Enterprise](https://agentprime.io/advisories/CVE-2022-22528.md)
  `CVE-2022-22528` · CVE record: SAP SE SAP Adaptive Server Enterprise · No CVSS score · Not analysed yet · Published 9 Feb 2022 · Tags: CWE-427
- [Uncontrolled search path in Intel(R) GPA software](https://agentprime.io/advisories/CVE-2021-33101.md)
  `CVE-2021-33101` · CVE record: Intel(R) GPA software · CVSS 7.8 High · Not analysed yet · Published 9 Feb 2022 · Tags: CWE-427
- [Uncontrolled search path in Intel(R) PROSet/Wireless Wi-Fi in Windows 10 and 11](https://agentprime.io/advisories/CVE-2021-0169.md)
  `CVE-2021-0169` · CVE record: Intel(R) PROSet/Wireless Wi-Fi in Windows 10 and 11 · CVSS 6.7 Medium · Not analysed yet · Published 9 Feb 2022 · Tags: CWE-427
- [Local privilege escalation due to DLL hijacking vulnerability in Acronis Media Builder service](https://agentprime.io/advisories/CVE-2021-44206.md)
  `CVE-2021-44206` · CVE record: Acronis Acronis Cyber Protect Home Office and 1 more · No CVSS score · Not analysed yet · Published 4 Feb 2022 · Tags: CWE-427
- [Local privilege escalation due to DLL hijacking vulnerability](https://agentprime.io/advisories/CVE-2021-44205.md)
  `CVE-2021-44205` · CVE record: Acronis Acronis Cyber Protect Home Office and 1 more · No CVSS score · Not analysed yet · Published 4 Feb 2022 · Tags: CWE-427
- [Emerson DeltaV Uncontrolled Search Path Element](https://agentprime.io/advisories/CVE-2021-44463.md)
  `CVE-2021-44463` · CVE record · CVSS 8.1 High · Not analysed yet · Published 28 Jan 2022 · Tags: CWE-427
- [Pipenv's requirements.txt parsing allows malicious index url in comments](https://agentprime.io/advisories/GHSA-qc9x-gjcv-465w.md)
  `GHSA-qc9x-gjcv-465w`, `CVE-2022-21668`, `PYSEC-2022-6` · PyPI `pipenv`: affected `>=2018.10.9, <2022.1.8`, fixed in `2022.1.8` · CVSS 8.0 High · Not analysed yet · Published 12 Jan 2022 · Tags: Command injection, CWE-20, CWE-427, CWE-791
- [Cortex XDR Agent: An Uncontrolled Search Path Element Leads to Local Privilege Escalation (PE) Vulnerability](https://agentprime.io/advisories/CVE-2022-0015.md)
  `CVE-2022-0015` · CVE record: Palo Alto Networks Cortex XDR Agent · CVSS 7.8 High · Not analysed yet · Published 12 Jan 2022 · Tags: CWE-427
- [DLL Highjack vulnerability in McAfee TechCheck utility](https://agentprime.io/advisories/CVE-2022-0129.md)
  `CVE-2022-0129` · CVE record: McAfee,LLC McAfee TechCheck · CVSS 7.4 High · Not analysed yet · Published 11 Jan 2022 · Tags: CWE-427
- [Uncontrolled search path in Check Point Remote Access Client](https://agentprime.io/advisories/CVE-2021-30360.md)
  `CVE-2021-30360` · CVE record: Check Point Remote Access Client · No CVSS score · Not analysed yet · Published 7 Jan 2022 · Tags: CWE-427
- [Rapid7 Insight Agent Privilege Escalation](https://agentprime.io/advisories/CVE-2021-4007.md)
  `CVE-2021-4007` · CVE record: Rapid7 Insight Agent · CVSS 7.8 High · Not analysed yet · Published 14 Dec 2021 · Tags: CWE-427
- [Uncontrolled search path in SonicWall Global VPN Client](https://agentprime.io/advisories/CVE-2021-20047.md)
  `CVE-2021-20047` · CVE record: SonicWall SonicWall Global VPN Client · No CVSS score · Not analysed yet · Published 8 Dec 2021 · Tags: CWE-427
- [DLL hijacking could lead to denial of service](https://agentprime.io/advisories/CVE-2021-44199.md)
  `CVE-2021-44199` · CVE record: Acronis Acronis Cyber Protect 15 and 2 more · No CVSS score · Not analysed yet · Published 29 Nov 2021 · Tags: CWE-427
- [DLL hijacking could lead to local privilege escalation](https://agentprime.io/advisories/CVE-2021-44198.md)
  `CVE-2021-44198` · CVE record: Acronis Acronis Cyber Protect 15 · No CVSS score · Not analysed yet · Published 29 Nov 2021 · Tags: CWE-427
- [MDE DLL Search Order Hijacking vulnerability](https://agentprime.io/advisories/CVE-2021-31853.md)
  `CVE-2021-31853` · CVE record: McAfee,LLC McAfee Drive Encryption (MDE) · CVSS 7.8 High · Not analysed yet · Published 10 Nov 2021 · Tags: CWE-427
- [Delta Electronics DIALink](https://agentprime.io/advisories/CVE-2021-38416.md)
  `CVE-2021-38416` · CVE record: Delta Electronics DIALink · CVSS 7.8 High · Not analysed yet · Published 3 Nov 2021 · Tags: CWE-427
- [Delta Electronics DIALink](https://agentprime.io/advisories/CVE-2021-38420.md)
  `CVE-2021-38420` · CVE record: Delta Electronics DIALink · CVSS 7.8 High · Not analysed yet · Published 3 Nov 2021 · Tags: CWE-427
- [Antilles Dependency Confusion Vulnerability](https://agentprime.io/advisories/GHSA-hgc3-hp6x-wpgx.md)
  `GHSA-hgc3-hp6x-wpgx`, `CVE-2021-3840`, `PYSEC-2021-840` · PyPI `antilles-tools`: affected `<1.0.1`, fixed in `1.0.1` · CVSS 8.8 High · Not analysed yet · Published 3 Nov 2021 · Tags: CWE-427
- [Uncontrolled search path in Check Point Harmony Browse and SandBlast Agent for Browsers](https://agentprime.io/advisories/CVE-2021-30359.md)
  `CVE-2021-30359` · CVE record: Check Point Harmony Browse and SandBlast Agent for Browsers · No CVSS score · Not analysed yet · Published 22 Oct 2021 · Tags: CWE-427
- [AUVESY Versiondog](https://agentprime.io/advisories/CVE-2021-38469.md)
  `CVE-2021-38469` · CVE record: AUVESY Versiondog · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 22 Oct 2021 · Tags: CWE-427
- [Adobe Reader DC Windows Installer Uncontrolled Search Path element could lead to Arbitrary Code Execution](https://agentprime.io/advisories/CVE-2021-35982.md)
  `CVE-2021-35982` · CVE record: Adobe Acrobat Reader · CVSS 7.3 High · Not analysed yet · Published 29 Sept 2021 · Tags: CWE-427
- [Uncontrolled search path in Trend Micro HouseCall for Home Networks](https://agentprime.io/advisories/CVE-2021-32466.md)
  `CVE-2021-32466` · CVE record: Trend Micro Trend Micro HouseCall for Home Networks · No CVSS score · Not analysed yet · Published 29 Sept 2021 · Tags: CWE-427
- [Uncontrolled search path in LINE Corporation LINE for Windows](https://agentprime.io/advisories/CVE-2021-36216.md)
  `CVE-2021-36216` · CVE record: LINE Corporation LINE for Windows · No CVSS score · Not analysed yet · Published 8 Sept 2021 · Tags: CWE-427
- [Adobe Creative Cloud Desktop uncontrolled search path element vulnerability could lead to local privilege escalation](https://agentprime.io/advisories/CVE-2021-28581.md)
  `CVE-2021-28581` · CVE record: Adobe Creative Cloud (desktop component) · CVSS 7.3 High · Not analysed yet · Published 8 Sept 2021 · Tags: CWE-427
- [Uncontrolled search path in GP-Pro EX V4.09.250 and prior](https://agentprime.io/advisories/CVE-2021-22775.md)
  `CVE-2021-22775` · CVE record: GP-Pro EX V4.09.250 and prior · No CVSS score · Not analysed yet · Published 2 Sept 2021 · Tags: CWE-427
- [Relative Path Traversal in git-delta](https://agentprime.io/advisories/GHSA-5xg3-j2j6-rcx4.md)
  `GHSA-5xg3-j2j6-rcx4`, `CVE-2021-36376`, `RUSTSEC-2021-0105` · crates.io `git-delta`: affected `<0.8.3`, fixed in `0.8.3` · CVSS 7.8 High · Not analysed yet · Published 25 Aug 2021 · Tags: Path traversal, CWE-427
- [Uncontrolled Search Path Element in sharkdp/bat](https://agentprime.io/advisories/GHSA-p24j-h477-76q3.md)
  `GHSA-p24j-h477-76q3`, `CVE-2021-36753`, `RUSTSEC-2021-0106` · crates.io `bat`: affected `<0.18.2`, fixed in `0.18.2` · CVSS 7.8 High · Not analysed yet · Published 25 Aug 2021 · Tags: CWE-427
- [Creative Cloud Desktop installer Uncontrolled Search Path element could lead to arbitrary code execution](https://agentprime.io/advisories/CVE-2021-28594.md)
  `CVE-2021-28594` · CVE record: Adobe Prelude · CVSS 7.8 High · Not analysed yet · Published 24 Aug 2021 · Tags: CWE-427
- [Adobe Acrobat Reader Unquoted Search Path Vulnerability](https://agentprime.io/advisories/CVE-2021-28636.md)
  `CVE-2021-28636` · CVE record: Adobe Acrobat Reader · CVSS 7.3 High · Not analysed yet · Published 20 Aug 2021 · Tags: CWE-427
- [Adobe Dimension Uncontrolled Search Path Element Could Lead To Remote Code Execution](https://agentprime.io/advisories/CVE-2021-28595.md)
  `CVE-2021-28595` · CVE record: Adobe Dimension · CVSS 7.8 High · Not analysed yet · Published 20 Aug 2021 · Tags: CWE-427
- [Cisco Packet Tracer for Windows DLL Injection Vulnerability](https://agentprime.io/advisories/CVE-2021-1593.md)
  `CVE-2021-1593` · CVE record: Cisco Cisco Packet Tracer · CVSS 7.3 High · Not analysed yet · Published 4 Aug 2021 · Tags: CWE-427
- [Uncontrolled search path in Dell SupportAssist Client](https://agentprime.io/advisories/CVE-2020-5316.md)
  `CVE-2020-5316` · CVE record: Dell Dell SupportAssist Client · CVSS 7.8 High · Not analysed yet · Published 22 Jul 2021 · Tags: CWE-427
- [Uncontrolled search path in Lenovo PCManager](https://agentprime.io/advisories/CVE-2021-3550.md)
  `CVE-2021-3550` · CVE record: Lenovo PCManager · CVSS 7.8 High · Not analysed yet · Published 16 Jul 2021 · Tags: CWE-427
- [Cortex XDR Agent: Improper Control of User-Controlled File Leads to Local Privilege Escalation](https://agentprime.io/advisories/CVE-2021-3042.md)
  `CVE-2021-3042` · CVE record: Palo Alto Networks Cortex XDR Agent · CVSS 7.8 High · Not analysed yet · Published 15 Jul 2021 · Tags: CWE-427
- [Uncontrolled search path in OpenVPN Connect](https://agentprime.io/advisories/CVE-2021-3613.md)
  `CVE-2021-3613` · CVE record: OpenVPN Connect · No CVSS score · Not analysed yet · Published 2 Jul 2021 · Tags: CWE-427
- [Uncontrolled search path in OpenVPN-GUI](https://agentprime.io/advisories/CVE-2021-3606.md)
  `CVE-2021-3606` · CVE record: OpenVPN-GUI · No CVSS score · Not analysed yet · Published 2 Jul 2021 · Tags: CWE-427
- [Adobe After Effects uncontrolled search path element vulnerability could lead to remote code execution](https://agentprime.io/advisories/CVE-2021-28570.md)
  `CVE-2021-28570` · CVE record: Adobe After Effects · CVSS 8.3 High · Not analysed yet · Published 28 Jun 2021 · Tags: CWE-427
- [DLL preload vulnerability in McAfee Agent for Windows](https://agentprime.io/advisories/CVE-2021-31840.md)
  `CVE-2021-31840` · CVE record: McAfee,LLC McAfee Agent for Windows · CVSS 7.3 High · Not analysed yet · Published 10 Jun 2021 · Tags: CWE-427
- [Cortex XDR Agent: Improper control of user-controlled file leads to local privilege escalation](https://agentprime.io/advisories/CVE-2021-3041.md)
  `CVE-2021-3041` · CVE record: Palo Alto Networks Cortex XDR Agent · CVSS 7.8 High · Not analysed yet · Published 10 Jun 2021 · Tags: CWE-427

Newest: <https://agentprime.io/advisories/tag/cwe-427.md>
Older: <https://agentprime.io/advisories/tag/cwe-427.md?cursor=WyIyMDIxLTA2LTEwVDEyOjMzOjA2LjU1MjAwMFoiLCJDVkUtMjAyMS0zMDQxIl0>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-427&cursor=WyIyMDIyLTA1LTA1VDE2OjQwOjUzLjI5NzAwMFoiLCJDVkUtMjAyMi0yODcxNCJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-427/?cursor=WyIyMDIyLTA1LTA1VDE2OjQwOjUzLjI5NzAwMFoiLCJDVkUtMjAyMi0yODcxNCJd>. Everything for agents: <https://agentprime.io/llms.txt>.