# CWE-427.

Every Advisory and CVE whose sources give the weakness CWE-427, newest first.

## Records, newest first (an older page)

- [Efs Software Easy Chat Server Version 3.1 was discovered to contain a DLL hijacking vulnerability via the component TextShaping.dll.](https://agentprime.io/advisories/CVE-2022-44939.md)
  `CVE-2022-44939` · CVE record · CVSS 7.8 High · Not analysed yet · Published 6 Jan 2023 · Tags: CWE-427
- [Uncontrolled search path in Mozilla Firefox ESR and others](https://agentprime.io/advisories/CVE-2022-36314.md)
  `CVE-2022-36314` · CVE record: Mozilla Firefox ESR and 2 more · CVSS 5.5 Medium · Not analysed yet · Published 22 Dec 2022 · Tags: CWE-427
- [Uncontrolled search path in Mozilla Firefox](https://agentprime.io/advisories/CVE-2022-22736.md)
  `CVE-2022-22736` · CVE record: Mozilla Firefox · CVSS 7.0 High · Not analysed yet · Published 22 Dec 2022 · Tags: CWE-427
- [Untrusted search path vulnerability in Baidunetdisk Version 7.4.3 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.](https://agentprime.io/advisories/CVE-2021-36631.md)
  `CVE-2021-36631` · CVE record · CVSS 6.7 Medium · Not analysed yet · Published 22 Dec 2022 · Tags: CWE-427
- [Uncontrolled search path in Installers generated by Squirrel.Windows](https://agentprime.io/advisories/CVE-2022-46330.md)
  `CVE-2022-46330` · CVE record: Squirrel Installers generated by Squirrel.Windows · CVSS 7.8 High · Not analysed yet · Published 21 Dec 2022 · Tags: CWE-427
- [Uncontrolled search path in DWG TrueView](https://agentprime.io/advisories/CVE-2022-42945.md)
  `CVE-2022-42945` · CVE record: DWG TrueView · CVSS 7.8 High · Not analysed yet · Published 19 Dec 2022 · Tags: CWE-427
- [Path Traversal in Android Google Search App](https://agentprime.io/advisories/CVE-2022-29580.md)
  `CVE-2022-29580` · CVE record: Google Android Google Search App · CVSS 8.9 High · Not analysed yet · Published 13 Dec 2022 · Tags: CWE-427
- [Uncontrolled search path in Siemens SICAM PAS/PQS](https://agentprime.io/advisories/CVE-2022-43722.md)
  `CVE-2022-43722` · CVE record: Siemens SICAM PAS/PQS · CVSS 7.8 High · Not analysed yet · Published 13 Dec 2022 · Tags: CWE-427
- [McAfee Total Protection prior to version 16.0.49 contains an uncontrolled search path element vulnerability due to the use of a variable pointing to a subdirectory that may be controllable by an unpr…](https://agentprime.io/advisories/CVE-2022-43751.md)
  `CVE-2022-43751` · CVE record · CVSS 7.8 High · Not analysed yet · Published 22 Nov 2022 · Tags: CWE-427
- [Uncontrolled search path in LG PC](https://agentprime.io/advisories/CVE-2022-45422.md)
  `CVE-2022-45422` · CVE record: LG PC · CVSS 7.8 High · Not analysed yet · Published 21 Nov 2022 · Tags: CWE-427
- [Uncontrolled search path in HP Inc. HP Support Assistant](https://agentprime.io/advisories/CVE-2022-38395.md)
  `CVE-2022-38395` · CVE record: HP Inc. HP Support Assistant · CVSS 7.8 High · Not analysed yet · Published 18 Nov 2022 · Tags: CWE-427
- [Uncontrolled search path in VMware InstallBuilder](https://agentprime.io/advisories/CVE-2022-31694.md)
  `CVE-2022-31694` · CVE record: VMware InstallBuilder · CVSS 7.3 High · Not analysed yet · Published 18 Nov 2022 · Tags: CWE-427
- [Local Privilege Escalation in Zoom Rooms Installer for Windows](https://agentprime.io/advisories/CVE-2022-36924.md)
  `CVE-2022-36924` · CVE record: Zoom Video Communications Inc Zoom Rooms Installer for Windows · CVSS 8.8 High · Not analysed yet · Published 17 Nov 2022 · Tags: CWE-427
- [Uncontrolled search path in Intel(R) VTune(TM) Profiler software](https://agentprime.io/advisories/CVE-2022-26028.md)
  `CVE-2022-26028` · CVE record: Intel(R) VTune(TM) Profiler software · CVSS 6.7 Medium · Not analysed yet · Published 11 Nov 2022 · Tags: CWE-427
- [Uncontrolled search path in Intel(R) System Studio](https://agentprime.io/advisories/CVE-2021-33064.md)
  `CVE-2021-33064` · CVE record: Intel(R) System Studio · CVSS 6.7 Medium · Not analysed yet · Published 11 Nov 2022 · Tags: CWE-427
- [Uncontrolled search path in Intel(r) NUC Kit Wireless Adapter drivers for Windows 10](https://agentprime.io/advisories/CVE-2022-36380.md)
  `CVE-2022-36380` · CVE record: Intel(r) NUC Kit Wireless Adapter drivers for Windows 10 · CVSS 6.7 Medium · Not analysed yet · Published 11 Nov 2022 · Tags: CWE-427
- [Uncontrolled search path in Intel(R) Quartus Prime Standard edition software](https://agentprime.io/advisories/CVE-2022-27187.md)
  `CVE-2022-27187` · CVE record: Intel(R) Quartus Prime Standard edition software · CVSS 6.7 Medium · Not analysed yet · Published 11 Nov 2022 · Tags: CWE-427
- [Uncontrolled search path in Intel(R) Glorp software](https://agentprime.io/advisories/CVE-2022-30548.md)
  `CVE-2022-30548` · CVE record: Intel(R) Glorp software · CVSS 6.7 Medium · Not analysed yet · Published 11 Nov 2022 · Tags: CWE-427
- [Uncontrolled search path in PresentMon software maintained by Intel(R)](https://agentprime.io/advisories/CVE-2022-26086.md)
  `CVE-2022-26086` · CVE record: PresentMon software maintained by Intel(R) · CVSS 6.7 Medium · Not analysed yet · Published 11 Nov 2022 · Tags: CWE-427
- [Uncontrolled search path in Intel(R) Advanced Link Analyzer Pro and Standard edition](https://agentprime.io/advisories/CVE-2022-27638.md)
  `CVE-2022-27638` · CVE record: Intel(R) Advanced Link Analyzer Pro and Standard edition · CVSS 6.7 Medium · Not analysed yet · Published 11 Nov 2022 · Tags: CWE-427
- [An Uncontrolled Search Path Element in Foxit Software released Foxit Reader v11.2.118.51569 allows attackers to escalate privileges when searching for DLL libraries without specifying an absolute pat…](https://agentprime.io/advisories/CVE-2022-43310.md)
  `CVE-2022-43310` · CVE record · CVSS 7.8 High · Not analysed yet · Published 9 Nov 2022 · Tags: CWE-427
- [Uncontrolled search path in NEC Corporation CLUSTERPRO X](https://agentprime.io/advisories/CVE-2022-34825.md)
  `CVE-2022-34825` · CVE record: NEC Corporation CLUSTERPRO X · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 8 Nov 2022 · Tags: CWE-427
- [Uncontrolled search path in Acronis Cyber Protect Home Office](https://agentprime.io/advisories/CVE-2022-44744.md)
  `CVE-2022-44744` · CVE record: Acronis Acronis Cyber Protect Home Office · CVSS 2.2 Low · Not analysed yet · Published 7 Nov 2022 · Tags: CWE-427
- [Execution with Unnecessary Privileges in JupyterApp](https://agentprime.io/advisories/GHSA-m678-f26j-3hrp.md)
  `GHSA-m678-f26j-3hrp`, `CVE-2022-39286`, `PYSEC-2022-42974` · PyPI `jupyter-core`: affected `<4.11.2`, fixed in `4.11.2` · CVSS 8.8 High · Not analysed yet · Published 26 Oct 2022 · Tags: Privilege escalation, CWE-427
- [Uncontrolled search path in Sony Corporation Content Transfer (for Windows)](https://agentprime.io/advisories/CVE-2022-41796.md)
  `CVE-2022-41796` · CVE record: Sony Corporation Content Transfer (for Windows) · CVSS 7.8 High · Not analysed yet · Published 24 Oct 2022 · Tags: CWE-427
- [Uncontrolled search path in Dell GeoDrive](https://agentprime.io/advisories/CVE-2022-33921.md)
  `CVE-2022-33921` · CVE record: Dell GeoDrive · CVSS 7.0 High · Not analysed yet · Published 12 Oct 2022 · Tags: CWE-427
- [notepad-plus-plus - DLL Hijacking](https://agentprime.io/advisories/CVE-2022-32168.md)
  `CVE-2022-32168` · CVE record: notepad-plus-plus notepad-plus-plus · CVSS 7.8 High · Not analysed yet · Published 28 Sept 2022 · Tags: CWE-427
- [Uncontrolled search path in JetBrains IntelliJ IDEA](https://agentprime.io/advisories/CVE-2022-40978.md)
  `CVE-2022-40978` · CVE record: JetBrains IntelliJ IDEA · CVSS 7.5 High · Not analysed yet · Published 19 Sept 2022 · Tags: CWE-427
- [Honeywell SoftMaster Uncontrolled Search Path Element](https://agentprime.io/advisories/CVE-2022-2333.md)
  `CVE-2022-2333` · CVE record: Honeywell SoftMaster · CVSS 8.8 High · Not analysed yet · Published 16 Sept 2022 · Tags: CWE-427
- [Uncontrolled search path in Samsung Mobile Smart Switch PC](https://agentprime.io/advisories/CVE-2022-39846.md)
  `CVE-2022-39846` · CVE record: Samsung Mobile Smart Switch PC · CVSS 6.2 Medium · Not analysed yet · Published 9 Sept 2022 · Tags: CWE-427
- [Outbyte PC Repair Installation File 1.7.112.7856 is vulnerable to Dll Hijacking. iertutil.dll is missing so an attacker can use a malicious dll with same name and can get admin privileges.](https://agentprime.io/advisories/CVE-2022-36271.md)
  `CVE-2022-36271` · CVE record · CVSS 7.8 High · Not analysed yet · Published 7 Sept 2022 · Tags: CWE-427
- [AutomationDirect C-more EA9 HMI Uncontrolled Search Path Element](https://agentprime.io/advisories/CVE-2022-2006.md)
  `CVE-2022-2006` · CVE record: AutomationDirect C-more EA9 · CVSS 7.8 High · Not analysed yet · Published 31 Aug 2022 · Tags: CWE-427
- [Uncontrolled search path in version](https://agentprime.io/advisories/CVE-2022-26374.md)
  `CVE-2022-26374` · CVE record: version · CVSS 7.8 High · Not analysed yet · Published 18 Aug 2022 · Tags: CWE-427
- [Uncontrolled search path in Intel(R) Distribution for Python](https://agentprime.io/advisories/CVE-2022-28696.md)
  `CVE-2022-28696` · CVE record: Intel(R) Distribution for Python · CVSS 7.8 High · Not analysed yet · Published 18 Aug 2022 · Tags: CWE-427
- [Uncontrolled search path in version](https://agentprime.io/advisories/CVE-2022-25841.md)
  `CVE-2022-25841` · CVE record: version · CVSS 7.8 High · Not analysed yet · Published 18 Aug 2022 · Tags: CWE-427
- [Uncontrolled search path in version](https://agentprime.io/advisories/CVE-2022-25999.md)
  `CVE-2022-25999` · CVE record: version · CVSS 7.8 High · Not analysed yet · Published 18 Aug 2022 · Tags: CWE-427
- [Uncontrolled search path in Intel(R) VTune(TM) Profiler software](https://agentprime.io/advisories/CVE-2022-21807.md)
  `CVE-2022-21807` · CVE record: Intel(R) VTune(TM) Profiler software · CVSS 7.8 High · Not analysed yet · Published 18 Aug 2022 · Tags: CWE-427
- [Softing Secure Integration Server Uncontrolled Search Path Element](https://agentprime.io/advisories/CVE-2022-2334.md)
  `CVE-2022-2334` · CVE record: Softing Secure Integration Server · CVSS 7.2 High · Critical (CVSS 7+ and EPSS) · EPSS 0.12 · Not analysed yet · Published 17 Aug 2022 · Tags: CWE-427
- [Adobe Premiere Elements Uncontrolled Search Path Element Privilege Escalation](https://agentprime.io/advisories/CVE-2022-34235.md)
  `CVE-2022-34235` · CVE record: Adobe Premiere Elements · CVSS 7.8 High · Not analysed yet · Published 11 Aug 2022 · Tags: CWE-427
- [Uncontrolled search path in Samsung Mobile Samsung Update Setup](https://agentprime.io/advisories/CVE-2022-36840.md)
  `CVE-2022-36840` · CVE record: Samsung Mobile Samsung Update Setup · CVSS 4.5 Medium · Not analysed yet · Published 5 Aug 2022 · Tags: CWE-427
- [AVEVA PCS Portal Uncontrolled Search Path Element](https://agentprime.io/advisories/CVE-2021-38410.md)
  `CVE-2021-38410` · CVE record: AVEVA Platform Common Services (PCS) Portal · CVSS 7.3 High · Not analysed yet · Published 27 Jul 2022 · Tags: CWE-427
- [Uncontrolled search path in Dell PowerStore](https://agentprime.io/advisories/CVE-2022-32498.md)
  `CVE-2022-32498` · CVE record: Dell PowerStore · CVSS 5.5 Medium · Not analysed yet · Published 20 Jul 2022 · Tags: CWE-427
- [Uncontrolled search path in Parallels Access](https://agentprime.io/advisories/CVE-2022-34902.md)
  `CVE-2022-34902` · CVE record: Parallels Access · CVSS 7.8 High · Not analysed yet · Published 18 Jul 2022 · Tags: CWE-427
- [Uncontrolled search path in Parallels Access](https://agentprime.io/advisories/CVE-2022-34901.md)
  `CVE-2022-34901` · CVE record: Parallels Access · CVSS 7.8 High · Not analysed yet · Published 18 Jul 2022 · Tags: CWE-427
- [Uncontrolled search path in Parallels Access](https://agentprime.io/advisories/CVE-2022-34900.md)
  `CVE-2022-34900` · CVE record: Parallels Access · CVSS 7.8 High · Not analysed yet · Published 18 Jul 2022 · Tags: CWE-427
- [Uncontrolled search path in Node](https://agentprime.io/advisories/CVE-2022-32223.md)
  `CVE-2022-32223` · CVE record: NodeJS Node · No CVSS score · Not analysed yet · Published 14 Jul 2022 · Tags: CWE-427
- [Bypass of safe.directory protections in Git](https://agentprime.io/advisories/CVE-2022-29187.md)
  `CVE-2022-29187` · CVE record: git git · CVSS 7.8 High · Not analysed yet · Published 12 Jul 2022 · Tags: CWE-282, CWE-427
- [McAfee MCPR privilege escalation](https://agentprime.io/advisories/CVE-2022-1824.md)
  `CVE-2022-1824` · CVE record: McAfee,LLC McAfee Consumer Product Removal Tool · CVSS 7.9 High · Not analysed yet · Published 20 Jun 2022 · Tags: CWE-427
- [Python pgAdmin4 uncontrolled search path](https://agentprime.io/advisories/CVE-2017-20052.md)
  `CVE-2017-20052` · CVE record: unspecified Python · CVSS 5.0 Medium · Not analysed yet · Published 16 Jun 2022 · Tags: CWE-427
- [Uncontrolled search path in Dell SupportAssist Consumer](https://agentprime.io/advisories/CVE-2022-29092.md)
  `CVE-2022-29092` · CVE record: Dell SupportAssist Consumer · CVSS 7.8 High · Not analysed yet · Published 10 Jun 2022 · Tags: CWE-427
- [XAMPP Installer uncontrolled search path](https://agentprime.io/advisories/CVE-2017-20018.md)
  `CVE-2017-20018` · CVE record: unspecified XAMPP · CVSS 6.3 Medium · Not analysed yet · Published 9 Jun 2022 · Tags: CWE-427
- [Duplicate Advisory: Kerberos for NodeJS allows DLL Injection](https://agentprime.io/advisories/GHSA-f478-xwv9-p93q.md)
  `GHSA-f478-xwv9-p93q` · npm `kerberos`: affected `<1.0.0`, fixed in `1.0.0` · CVSS 7.8 High · Withdrawn · Not analysed yet · Published 24 May 2022 · Tags: CWE-427
- [Local privilege escalation due to insecure folder permissions](https://agentprime.io/advisories/CVE-2022-30697.md)
  `CVE-2022-30697` · CVE record: Acronis Acronis Snap Deploy · No CVSS score · Not analysed yet · Published 16 May 2022 · Tags: CWE-427
- [Local privilege escalation due to a DLL hijacking vulnerability](https://agentprime.io/advisories/CVE-2022-30696.md)
  `CVE-2022-30696` · CVE record: Acronis Acronis Snap Deploy · No CVSS score · Not analysed yet · Published 16 May 2022 · Tags: CWE-427
- [Uncontrolled search path in Intel(R) XTU software](https://agentprime.io/advisories/CVE-2022-22139.md)
  `CVE-2022-22139` · CVE record: Intel(R) XTU software · CVSS 7.3 High · Not analysed yet · Published 12 May 2022 · Tags: CWE-427
- [Adobe Acrobat Uninstaller Hard Link Leads To Remote Code Execution](https://agentprime.io/advisories/CVE-2022-28247.md)
  `CVE-2022-28247` · CVE record: Adobe Acrobat Reader · CVSS 6.7 Medium · Not analysed yet · Published 11 May 2022 · Tags: CWE-427
- [Cortex XDR Agent: An Uncontrolled Search Path Element Leads to Local Privilege Escalation (PE) Vulnerability](https://agentprime.io/advisories/CVE-2022-0025.md)
  `CVE-2022-0025` · CVE record: Palo Alto Networks Cortex XDR Agent · CVSS 6.7 Medium · Not analysed yet · Published 11 May 2022 · Tags: CWE-427
- [XINJE XD/E Series PLC Program Tool DLL Hijacking](https://agentprime.io/advisories/CVE-2021-34606.md)
  `CVE-2021-34606` · CVE record: XINJE XD/E Series PLC Program Tool · CVSS 7.3 High · Not analysed yet · Published 11 May 2022 · Tags: CWE-427
- [Local privilege escalation via a default path in Splunk Enterprise Windows](https://agentprime.io/advisories/CVE-2021-42743.md)
  `CVE-2021-42743` · CVE record: Splunk Splunk Enterprise · CVSS 8.8 High · Not analysed yet · Published 6 May 2022 · Tags: CWE-427
- [Uncontrolled search path in F5 BIG-IP APM and others](https://agentprime.io/advisories/CVE-2022-28714.md)
  `CVE-2022-28714` · CVE record: F5 BIG-IP APM and 1 more · CVSS 7.3 High · Not analysed yet · Published 5 May 2022 · Tags: CWE-427

Newest: <https://agentprime.io/advisories/tag/cwe-427.md>
Older: <https://agentprime.io/advisories/tag/cwe-427.md?cursor=WyIyMDIyLTA1LTA1VDE2OjQwOjUzLjI5NzAwMFoiLCJDVkUtMjAyMi0yODcxNCJd>

## Filters and formats

Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page.

- The same list as JSON: <https://api.agentprime.io/v1/advisories?tag=cwe-427&cursor=WyIyMDIzLTAxLTA5VDAwOjAwOjAwLjAwMDAwMFoiLCJDVkUtMjAyMi0zNjkzMCJd>
- Every list: <https://agentprime.io/advisories.md>, critical: <https://agentprime.io/advisories/critical.md>; by weakness: <https://agentprime.io/advisories/tag/sql-injection.md> and the other tags in <https://agentprime.io/llms.txt>; by technology: `/advisories/technology/<slug>.md` (`fortinet-fortimail`)

---

The web page: <https://agentprime.io/advisories/tag/cwe-427/?cursor=WyIyMDIzLTAxLTA5VDAwOjAwOjAwLjAwMDAwMFoiLCJDVkUtMjAyMi0zNjkzMCJd>. Everything for agents: <https://agentprime.io/llms.txt>.