# CWE-427.

Every Advisory and CVE whose sources give the weakness CWE-427, newest first.

## Records, newest first (an older page)

- [Binary hijack in SAP BusinessObjects Business Intelligence (Installer)](https://agentprime.io/advisories/CVE-2023-37490.md)
  `CVE-2023-37490` · CVE record: SAP_SE SAP BusinessObjects Business Intelligence (Installer) · CVSS 7.6 High · Not analysed yet · Published 8 Aug 2023 · Tags: CWE-427
- [CODESYS: Vulnerability in CODESYS Development System allows for execution of binaries](https://agentprime.io/advisories/CVE-2023-3662.md)
  `CVE-2023-3662` · CVE record: CODESYS CODESYS Development System · CVSS 7.3 High · Not analysed yet · Published 3 Aug 2023 · Tags: CWE-427
- [Incomplete verification of installation file signature](https://agentprime.io/advisories/CVE-2022-43703.md)
  `CVE-2022-43703` · CVE record: Arm Ltd Arm Compiler 5 (AC5), Arm Compiler for Embedded 6 (AC6), Fast Models (FM), Arm Compiler for Embedded FuSA (ACEF), Arm Development Studio (ADS), Arm Forge (AF), Arm Mobile Studio (AMS), DS-5 Development Studio, Fast Models (FM), GNU Toolchain (GT), Keil MDK (KMDK), Mbed Studio (MS) · No CVSS score · Not analysed yet · Published 27 Jul 2023 · Tags: CWE-427
- [Tenable Plugin Feed ID #202306261202 Fixes Privilege Escalation Vulnerability](https://agentprime.io/advisories/CVE-2023-2005.md)
  `CVE-2023-2005` · CVE record: Tenable Tenable.io and 2 more · CVSS 6.3 Medium · Not analysed yet · Published 26 Jun 2023 · Tags: CWE-427
- [Uncontrolled search path in Synology DiskStation Manager (DSM) and others](https://agentprime.io/advisories/CVE-2023-0142.md)
  `CVE-2023-0142` · CVE record: Synology DiskStation Manager (DSM) and 2 more · CVSS 6.5 Medium · Not analysed yet · Published 13 Jun 2023 · Tags: CWE-427
- [Uncontrolled search path in Trellix Agent](https://agentprime.io/advisories/CVE-2023-0976.md)
  `CVE-2023-0976` · CVE record: Trellix Trellix Agent · CVSS 6.3 Medium · Not analysed yet · Published 7 Jun 2023 · Tags: CWE-427
- [Captura CRYPTBASE.dll uncontrolled search path](https://agentprime.io/advisories/CVE-2023-3091.md)
  `CVE-2023-3091` · CVE record: Captura · CVSS 7.0 High · Not analysed yet · Published 3 Jun 2023 · Tags: CWE-427
- [Uncontrolled search path in Dell PowerPath Windows](https://agentprime.io/advisories/CVE-2023-28080.md)
  `CVE-2023-28080` · CVE record: Dell PowerPath Windows · CVSS 6.7 Medium · Not analysed yet · Published 30 May 2023 · Tags: CWE-427
- [Uncontrolled search path in Intel(R) Trace Analyzer and Collector](https://agentprime.io/advisories/CVE-2023-31197.md)
  `CVE-2023-31197` · CVE record: Intel(R) Trace Analyzer and Collector · CVSS 6.7 Medium · Not analysed yet · Published 12 May 2023 · Tags: CWE-427
- [A DLL Hijacking issue discovered in Soft-o Free Password Manager 1.1.20 allows attackers to create arbitrary DLLs leading to code execution.](https://agentprime.io/advisories/CVE-2023-25428.md)
  `CVE-2023-25428` · CVE record · CVSS 7.8 High · Not analysed yet · Published 12 May 2023 · Tags: CWE-427
- [Uncontrolled search path in Autodesk InfraWorks](https://agentprime.io/advisories/CVE-2023-25005.md)
  `CVE-2023-25005` · CVE record: Autodesk InfraWorks · CVSS 7.8 High · Not analysed yet · Published 12 May 2023 · Tags: CWE-427
- [Uncontrolled search path in WULT software maintained by Intel(R)](https://agentprime.io/advisories/CVE-2023-27298.md)
  `CVE-2023-27298` · CVE record: WULT software maintained by Intel(R) · CVSS 8.8 High · Not analysed yet · Published 10 May 2023 · Tags: CWE-427
- [Uncontrolled search path in DSP Builder software installer for Intel(R) FPGAs Pro Edition](https://agentprime.io/advisories/CVE-2022-43474.md)
  `CVE-2022-43474` · CVE record: DSP Builder software installer for Intel(R) FPGAs Pro Edition · CVSS 6.7 Medium · Not analysed yet · Published 10 May 2023 · Tags: CWE-427
- [Uncontrolled search path in Intel(R) Quartus(R) Prime Pro edition software](https://agentprime.io/advisories/CVE-2022-41693.md)
  `CVE-2022-41693` · CVE record: Intel(R) Quartus(R) Prime Pro edition software · CVSS 6.7 Medium · Not analysed yet · Published 10 May 2023 · Tags: CWE-427
- [Uncontrolled search path in Intel(R) MacCPUID software](https://agentprime.io/advisories/CVE-2022-27180.md)
  `CVE-2022-27180` · CVE record: Intel(R) MacCPUID software · CVSS 4.2 Medium · Not analysed yet · Published 10 May 2023 · Tags: CWE-427
- [Uncontrolled search path in Intel(R) NUC Chaco Canyon BIOS update software](https://agentprime.io/advisories/CVE-2022-38101.md)
  `CVE-2022-38101` · CVE record: Intel(R) NUC Chaco Canyon BIOS update software · CVSS 6.7 Medium · Not analysed yet · Published 10 May 2023 · Tags: CWE-427
- [Uncontrolled search path in Intel(R) Unite(R) Plugin SDK](https://agentprime.io/advisories/CVE-2022-32576.md)
  `CVE-2022-32576` · CVE record: Intel(R) Unite(R) Plugin SDK · CVSS 6.7 Medium · Not analysed yet · Published 10 May 2023 · Tags: CWE-427
- [Uncontrolled search path in Intel(R) oneAPI Toolkit and component software installers](https://agentprime.io/advisories/CVE-2023-22355.md)
  `CVE-2023-22355` · CVE record: Intel(R) oneAPI Toolkit and component software installers · CVSS 6.7 Medium · Not analysed yet · Published 10 May 2023 · Tags: CWE-427
- [Uncontrolled search path in Intel(R) DCM software](https://agentprime.io/advisories/CVE-2022-41998.md)
  `CVE-2022-41998` · CVE record: Intel(R) DCM software · CVSS 6.7 Medium · Not analysed yet · Published 10 May 2023 · Tags: CWE-427
- [Uncontrolled search path in Intel(R) NUC Pro Software Suite](https://agentprime.io/advisories/CVE-2022-34848.md)
  `CVE-2022-34848` · CVE record: Intel(R) NUC Pro Software Suite · CVSS 6.7 Medium · Not analysed yet · Published 10 May 2023 · Tags: CWE-427
- [Uncontrolled search path in Intel(R) HDMI Firmware Update tool for NUC](https://agentprime.io/advisories/CVE-2022-21162.md)
  `CVE-2022-21162` · CVE record: Intel(R) HDMI Firmware Update tool for NUC · CVSS 6.7 Medium · Not analysed yet · Published 10 May 2023 · Tags: CWE-427
- [Uncontrolled search path in Intel(R) Pathfinder for RISC-V software](https://agentprime.io/advisories/CVE-2023-27386.md)
  `CVE-2023-27386` · CVE record: Intel(R) Pathfinder for RISC-V software · CVSS 6.7 Medium · Not analysed yet · Published 10 May 2023 · Tags: CWE-427
- [Uncontrolled search path in Intel(R) NUC P14E Laptop Element software for Windows 10](https://agentprime.io/advisories/CVE-2022-41628.md)
  `CVE-2022-41628` · CVE record: Intel(R) NUC P14E Laptop Element software for Windows 10 · CVSS 6.7 Medium · Not analysed yet · Published 10 May 2023 · Tags: CWE-427
- [Uncontrolled search path in Intel(R) VTune(TM) Profiler software](https://agentprime.io/advisories/CVE-2022-41982.md)
  `CVE-2022-41982` · CVE record: Intel(R) VTune(TM) Profiler software · CVSS 6.7 Medium · Not analysed yet · Published 10 May 2023 · Tags: CWE-427
- [CyberGhostVPN Windows Client before v8.3.10.10015 was discovered to contain a DLL injection vulnerability via the component Dashboard.exe.](https://agentprime.io/advisories/CVE-2023-30237.md)
  `CVE-2023-30237` · CVE record · CVSS 7.8 High · Not analysed yet · Published 9 May 2023 · Tags: CWE-427
- [Uncontrolled search path in Acronis Snap Deploy](https://agentprime.io/advisories/CVE-2023-2355.md)
  `CVE-2023-2355` · CVE record: Acronis Acronis Snap Deploy · CVSS 6.7 Medium · Not analysed yet · Published 27 Apr 2023 · Tags: CWE-427
- [Git CMD erroneously executes \`doskey.exe\` in the current directory, if it exists](https://agentprime.io/advisories/CVE-2023-29012.md)
  `CVE-2023-29012` · CVE record: git-for-windows git · CVSS 7.3 High · Not analysed yet · Published 25 Apr 2023 · Tags: CWE-427
- [Git for Windows's config file of \`connect.exe\` is susceptible to malicious placing](https://agentprime.io/advisories/CVE-2023-29011.md)
  `CVE-2023-29011` · CVE record: git-for-windows git · CVSS 7.6 High · Not analysed yet · Published 25 Apr 2023 · Tags: CWE-427
- [Uncontrolled search path in Schneider Electric Easergy Builder Installer](https://agentprime.io/advisories/CVE-2022-34755.md)
  `CVE-2022-34755` · CVE record: Schneider Electric Easergy Builder Installer · CVSS 6.3 Medium · Not analysed yet · Published 18 Apr 2023 · Tags: CWE-427
- [Executable Hijacking](https://agentprime.io/advisories/CVE-2023-28140.md)
  `CVE-2023-28140` · CVE record: Qualys Cloud Agent · CVSS 6.7 Medium · Not analysed yet · Published 18 Apr 2023 · Tags: CWE-427
- [DLL Hijacking vulnerability in SapSetup (Software Installation Program)](https://agentprime.io/advisories/CVE-2023-29187.md)
  `CVE-2023-29187` · CVE record: SAP SapSetup (Software Installation Program) · CVSS 6.7 Medium · Not analysed yet · Published 11 Apr 2023 · Tags: CWE-427
- [KMPlayer SHFOLDER.dll uncontrolled search path](https://agentprime.io/advisories/CVE-2023-1745.md)
  `CVE-2023-1745` · CVE record: KMPlayer · CVSS 5.3 Medium · Not analysed yet · Published 30 Mar 2023 · Tags: CWE-427
- [Local Elevation of Privilege in M-Files](https://agentprime.io/advisories/CVE-2023-0213.md)
  `CVE-2023-0213` · CVE record: M-Files M-Files · CVSS 8.8 High · Not analysed yet · Published 29 Mar 2023 · Tags: CWE-427
- [Uncontrolled search path in AVEVA Edge](https://agentprime.io/advisories/CVE-2022-28688.md)
  `CVE-2022-28688` · CVE record: AVEVA Edge · CVSS 7.8 High · Not analysed yet · Published 29 Mar 2023 · Tags: CWE-427
- [Uncontrolled search path in AVEVA Edge](https://agentprime.io/advisories/CVE-2022-28687.md)
  `CVE-2022-28687` · CVE record: AVEVA Edge · CVSS 7.8 High · Not analysed yet · Published 29 Mar 2023 · Tags: CWE-427
- [Uncontrolled search path in AVEVA Edge](https://agentprime.io/advisories/CVE-2022-28686.md)
  `CVE-2022-28686` · CVE record: AVEVA Edge · CVSS 7.8 High · Not analysed yet · Published 29 Mar 2023 · Tags: CWE-427
- [Local Privilege Escalation in Zoom for macOS Installers](https://agentprime.io/advisories/CVE-2023-28596.md)
  `CVE-2023-28596` · CVE record: Zoom Video Communications Inc Zoom Client for Meetings for IT Admin macOS installers · CVSS 7.8 High · Not analysed yet · Published 27 Mar 2023 · Tags: CWE-427
- [Apache OpenOffice: Empty entry in Java class path](https://agentprime.io/advisories/CVE-2022-38745.md)
  `CVE-2022-38745` · CVE record: Apache Software Foundation Apache OpenOffice · CVSS 7.8 High · Not analysed yet · Published 24 Mar 2023 · Tags: Code injection, CWE-427, CWE-1188
- [An issue was discovered in Veritas NetBackup before 10.0 on Windows.](https://agentprime.io/advisories/CVE-2023-28759.md)
  `CVE-2023-28759` · CVE record · CVSS 7.8 High · Not analysed yet · Published 23 Mar 2023 · Tags: CWE-427
- [ONLYOFFICE Docs through 7.3 on certain Linux distributions allows local users to gain privileges via a Trojan horse libgcc_s.so.1 in the current working directory, which may be any directory in which…](https://agentprime.io/advisories/CVE-2022-48422.md)
  `CVE-2022-48422` · CVE record · CVSS 7.8 High · Not analysed yet · Published 19 Mar 2023 · Tags: CWE-427
- [An issue found in UwAmp v.1.1, 1.2, 1.3, 2.0, 2.1, 2.2, 2.2.1, 3.0.0, 3.0.1, 3.0.2 allows a remote attacker to execute arbitrary code via a crafted DLL.](https://agentprime.io/advisories/CVE-2021-31637.md)
  `CVE-2021-31637` · CVE record · CVSS 7.8 High · Not analysed yet · Published 16 Mar 2023 · Tags: CWE-427
- [Uncontrolled search path in Tenable.io, Tenable.sc and Nessus](https://agentprime.io/advisories/CVE-2022-4313.md)
  `CVE-2022-4313` · CVE record: Tenable.io, Tenable.sc and Nessus · CVSS 8.8 High · Not analysed yet · Published 15 Mar 2023 · Tags: CWE-427
- [McAfee Total Protection prior to 16.0.49 allows attackers to elevate user privileges due to DLL sideloading.](https://agentprime.io/advisories/CVE-2023-24578.md)
  `CVE-2023-24578` · CVE record · CVSS 5.5 Medium · Not analysed yet · Published 13 Mar 2023 · Tags: CWE-427
- [Uncontrolled search path in Trend Micro, Inc. Trend Micro Apex One](https://agentprime.io/advisories/CVE-2023-25147.md)
  `CVE-2023-25147` · CVE record: Trend Micro, Inc. Trend Micro Apex One · CVSS 6.7 Medium · Not analysed yet · Published 7 Mar 2023 · Tags: CWE-427
- [Uncontrolled search path in Trend Micro, Inc. Trend Micro Apex One](https://agentprime.io/advisories/CVE-2023-25143.md)
  `CVE-2023-25143` · CVE record: Trend Micro, Inc. Trend Micro Apex One · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 7 Mar 2023 · Tags: CWE-427
- [Uncontrolled search path in IVM Development Group pg_ivm](https://agentprime.io/advisories/CVE-2023-23554.md)
  `CVE-2023-23554` · CVE record: IVM Development Group pg_ivm · CVSS 8.8 High · Not analysed yet · Published 7 Mar 2023 · Tags: CWE-427
- [In AFL++ 4.05c, the CmpLog component uses the current working directory to resolve and execute unprefixed fuzzing targets, allowing code execution.](https://agentprime.io/advisories/CVE-2023-26266.md)
  `CVE-2023-26266` · CVE record · CVSS 7.3 High · Not analysed yet · Published 21 Feb 2023 · Tags: CWE-427
- [Infoblox BloxOne Endpoint for Windows through 2.2.7 allows DLL injection that can result in local privilege escalation.](https://agentprime.io/advisories/CVE-2022-32972.md)
  `CVE-2022-32972` · CVE record · CVSS 7.8 High · Not analysed yet · Published 17 Feb 2023 · Tags: CWE-427
- [Genymotion Desktop v3.3.2 was discovered to contain a DLL hijacking vulnerability that allows attackers to escalate privileges and execute arbitrary code via a crafted DLL.](https://agentprime.io/advisories/CVE-2022-48077.md)
  `CVE-2022-48077` · CVE record · CVSS 7.8 High · Not analysed yet · Published 13 Feb 2023 · Tags: CWE-427
- [Privilege escalation via manipulated unixcat executable](https://agentprime.io/advisories/CVE-2022-43440.md)
  `CVE-2022-43440` · CVE record: Tribe29 Checkmk · CVSS 8.8 High · Not analysed yet · Published 9 Feb 2023 · Tags: CWE-427
- [Uncontrolled search path in NVIDIA GeForce Experience](https://agentprime.io/advisories/CVE-2022-31611.md)
  `CVE-2022-31611` · CVE record: NVIDIA GeForce Experience · CVSS 6.8 Medium · Not analysed yet · Published 7 Feb 2023 · Tags: CWE-427
- [BIG-IP Edge Client for Windows vulnerability](https://agentprime.io/advisories/CVE-2023-22358.md)
  `CVE-2023-22358` · CVE record: F5 APM Clients · CVSS 7.8 High · Not analysed yet · Published 1 Feb 2023 · Tags: CWE-427
- [BIG-IP Edge Client for Windows vulnerability](https://agentprime.io/advisories/CVE-2023-22283.md)
  `CVE-2023-22283` · CVE record: F5 APM Clients · CVSS 6.5 Medium · Not analysed yet · Published 1 Feb 2023 · Tags: CWE-427
- [Uncontrolled search path in Dell OpenManage Server Administrator (OMSA)](https://agentprime.io/advisories/CVE-2022-34396.md)
  `CVE-2022-34396` · CVE record: Dell OpenManage Server Administrator (OMSA) · CVSS 7.0 High · Not analysed yet · Published 1 Feb 2023 · Tags: CWE-427
- [Razer Synapse before 3.7.0830.081906 allows privilege escalation due to an unsafe installation path, improper privilege management, and improper certificate validation.](https://agentprime.io/advisories/CVE-2022-47632.md)
  `CVE-2022-47632` · CVE record · CVSS 6.8 Medium · Not analysed yet · Published 27 Jan 2023 · Tags: CWE-427
- [Uncontrolled search path in Windscribe](https://agentprime.io/advisories/CVE-2022-41141.md)
  `CVE-2022-41141` · CVE record: Windscribe Windscribe · CVSS 7.8 High · Not analysed yet · Published 26 Jan 2023 · Tags: CWE-427
- [Cybereason EDR version 19.1.282 and above, 19.2.182 and above, 20.1.343 and above, and 20.2.X and above has a DLL hijacking vulnerability, which could allow a local attacker to execute code with elev…](https://agentprime.io/advisories/CVE-2020-25502.md)
  `CVE-2020-25502` · CVE record · CVSS 7.8 High · Not analysed yet · Published 20 Jan 2023 · Tags: CWE-427
- [Bloom Uncontrolled Search Path Element vulnerability](https://agentprime.io/advisories/GHSA-fgwp-pwqq-g3w4.md)
  `GHSA-fgwp-pwqq-g3w4`, `CVE-2023-0247` · Go `github.com/bits-and-blooms/bloom`: affected `<3.3.1`, fixed in `3.3.1` · CVSS 7.8 High · Not analysed yet · Published 12 Jan 2023 · Tags: CWE-427
- [Insecure folder permissions in the Windows installation path of Shibboleth Service Provider (SP) before 3.4.1 allow an unprivileged local attacker to escalate privileges to SYSTEM via DLL planting in…](https://agentprime.io/advisories/CVE-2023-22947.md)
  `CVE-2023-22947` · CVE record · CVSS 7.3 High · Not analysed yet · Published 11 Jan 2023 · Tags: CWE-427
- [Local Privilege Escalation in Zoom Rooms for Windows Installers](https://agentprime.io/advisories/CVE-2022-36930.md)
  `CVE-2022-36930` · CVE record: Zoom Video Communications Inc Zoom Rooms for Windows · CVSS 8.8 High · Not analysed yet · Published 9 Jan 2023 · Tags: CWE-427

Newest: <https://agentprime.io/advisories/tag/cwe-427.md>
Older: <https://agentprime.io/advisories/tag/cwe-427.md?cursor=WyIyMDIzLTAxLTA5VDAwOjAwOjAwLjAwMDAwMFoiLCJDVkUtMjAyMi0zNjkzMCJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-427&cursor=WyIyMDIzLTA4LTA4VDA5OjIwOjA4LjY3NzAwMFoiLCJDVkUtMjAyMS00MTU0NCJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-427/?cursor=WyIyMDIzLTA4LTA4VDA5OjIwOjA4LjY3NzAwMFoiLCJDVkUtMjAyMS00MTU0NCJd>. Everything for agents: <https://agentprime.io/llms.txt>.