# CWE-428. Every Advisory and CVE whose sources give the weakness CWE-428, newest first. ## Records, newest first (an older page) - [Unquoted search path in BUFFALO INC. NAS Navigator2 (Windows version only)](https://agentprime.io/advisories/CVE-2025-61871.md) `CVE-2025-61871` · CVE record: BUFFALO INC. NAS Navigator2 (Windows version only) · CVSS 8.4 High · Not analysed yet · Published 10 Oct 2025 · Tags: CWE-428 - [NetBak Replicator](https://agentprime.io/advisories/CVE-2025-57714.md) `CVE-2025-57714` · CVE record: QNAP Systems Inc. NetBak Replicator · CVSS 8.5 High · Not analysed yet · Published 3 Oct 2025 · Tags: CWE-428 - [Unquoted search path in Dell Wireless 5932e](https://agentprime.io/advisories/CVE-2025-43993.md) `CVE-2025-43993` · CVE record: Dell Wireless 5932e · CVSS 7.8 High · Not analysed yet · Published 25 Sept 2025 · Tags: CWE-428 - [SunshineService Has Unquoted Service Path That Allows Local SYSTEM Code Execution](https://agentprime.io/advisories/CVE-2025-54081.md) `CVE-2025-54081` · CVE record: LizardByte Sunshine · CVSS 6.7 Medium · Not analysed yet · Published 23 Sept 2025 · Tags: CWE-428 - [Unquoted search path in Century Corporation RAID Manager](https://agentprime.io/advisories/CVE-2025-59307.md) `CVE-2025-59307` · CVE record: Century Corporation RAID Manager · CVSS 8.4 High · Not analysed yet · Published 17 Sept 2025 · Tags: CWE-428 - [Vulnerability caused by unquoted file paths of Windows services registered by the Uninterruptible Power Supply (UPS) management application](https://agentprime.io/advisories/CVE-2025-9818.md) `CVE-2025-9818` · CVE record: OMRON SOCIAL SOLUTIONS CO., Ltd. PowerAttendant Standard Edition and 4 more · CVSS 6.7 Medium · Not analysed yet · Published 17 Sept 2025 · Tags: CWE-428 - [A local privilege escalation vulnerability exists in LizardBytes' Sunshine for Windows](https://agentprime.io/advisories/CVE-2025-10199.md) `CVE-2025-10199` · CVE record: LizardByte Sunshine for Windows · CVSS 7.8 High · Not analysed yet · Published 9 Sept 2025 · Tags: CWE-428 - [Unquoted search path in RATOC Systems, Inc. RATOC RAID Monitoring Manager for Windows](https://agentprime.io/advisories/CVE-2025-58400.md) `CVE-2025-58400` · CVE record: RATOC Systems, Inc. RATOC RAID Monitoring Manager for Windows · CVSS 8.4 High · Not analysed yet · Published 5 Sept 2025 · Tags: CWE-428 - [Unquoted search path in Hikvision HikCentral FocSign](https://agentprime.io/advisories/CVE-2025-39246.md) `CVE-2025-39246` · CVE record: Hikvision HikCentral FocSign · CVSS 5.3 Medium · Not analysed yet · Published 29 Aug 2025 · Tags: CWE-428 - [Unquoted Search Path Vulnerability in the Utility for Industrial Computers (Windows)](https://agentprime.io/advisories/CVE-2025-5191.md) `CVE-2025-5191` · CVE record: Moxa Utility for DRP-A100 Series and 1 more · CVSS 7.3 High · Not analysed yet · Published 25 Aug 2025 · Tags: CWE-428 - [Unquoted search path in Western Digital Corporation Western Digital Kitfox for Windows](https://agentprime.io/advisories/CVE-2025-57699.md) `CVE-2025-57699` · CVE record: Western Digital Corporation Western Digital Kitfox for Windows · CVSS 8.4 High · Not analysed yet · Published 22 Aug 2025 · Tags: CWE-428 - [Unquoted search path in Seagate Toolkit](https://agentprime.io/advisories/CVE-2025-9043.md) `CVE-2025-9043` · CVE record: Seagate Toolkit · CVSS 6.7 Medium · Not analysed yet · Published 14 Aug 2025 · Tags: CWE-428 - [Windows service registered with an unquoted ImagePath vulnerability in the system registry](https://agentprime.io/advisories/CVE-2025-8070.md) `CVE-2025-8070` · CVE record: ASUSTOR ABP and AES · CVSS 9.2 Critical · Critical (CVSS 9+) · Not analysed yet · Published 23 Jul 2025 · Tags: CWE-428 - [Unquoted search path in AMD Cloud Manageability Service](https://agentprime.io/advisories/CVE-2025-0035.md) `CVE-2025-0035` · CVE record: AMD AMD Cloud Manageability Service · CVSS 7.3 High · Not analysed yet · Published 13 May 2025 · Tags: CWE-428 - [Unquoted search path in AMD AIM-T Manageability Service](https://agentprime.io/advisories/CVE-2024-36321.md) `CVE-2024-36321` · CVE record: AMD AIM-T Manageability Service · CVSS 7.3 High · Not analysed yet · Published 13 May 2025 · Tags: CWE-428 - [MTSoftware C-Lodop CLodopPrintService unquoted search path](https://agentprime.io/advisories/CVE-2025-4540.md) `CVE-2025-4540` · CVE record: MTSoftware C-Lodop · CVSS 7.3 High · Not analysed yet · Published 11 May 2025 · Tags: CWE-426, CWE-428 - [Local Privilege Escalation on Xerox® Desktop Print Experience® v8.5](https://agentprime.io/advisories/CVE-2025-1984.md) `CVE-2025-1984` · CVE record: Xerox Xerox® Desktop Print Experience · CVSS 5.2 Medium · Not analysed yet · Published 12 Mar 2025 · Tags: CWE-428 - [Privilege Escalation vulnerability has been discovered in OpenText™ Service Manager.](https://agentprime.io/advisories/CVE-2025-0884.md) `CVE-2025-0884` · CVE record: OpenText™ Service Manager · CVSS 7.3 High · Not analysed yet · Published 12 Mar 2025 · Tags: CWE-428 - [Unquoted search path in Acronis Cyber Protect Cloud Agent](https://agentprime.io/advisories/CVE-2025-24831.md) `CVE-2025-24831` · CVE record: Acronis Acronis Cyber Protect Cloud Agent · CVSS 6.6 Medium · Not analysed yet · Published 31 Jan 2025 · Tags: CWE-428 - [Unquoted search path in Dell NetWorker](https://agentprime.io/advisories/CVE-2025-21107.md) `CVE-2025-21107` · CVE record: Dell NetWorker · CVSS 7.8 High · Not analysed yet · Published 30 Jan 2025 · Tags: CWE-428 - [In Electronic Arts Dragon Age Origins 1.05, the DAUpdaterSVC service contains an unquoted service path vulnerability.](https://agentprime.io/advisories/CVE-2024-57276.md) `CVE-2024-57276` · CVE record · CVSS 7.3 High · Not analysed yet · Published 27 Jan 2025 · Tags: CWE-428 - [Virtual environment (venv) activation scripts don't quote paths](https://agentprime.io/advisories/CVE-2024-9287.md) `CVE-2024-9287` · CVE record: Python Software Foundation CPython · CVSS 5.3 Medium · Not analysed yet · Published 22 Oct 2024 · Tags: CWE-428 - [Grafana Agent (Flow mode) on Windows has Unquoted Search Path or Element vulnerability in github.com/grafana/agent](https://agentprime.io/advisories/GHSA-m5gv-m5f9-wgv4.md) `GHSA-m5gv-m5f9-wgv4`, `CVE-2024-8996`, `GO-2024-3170` · Go `github.com/grafana/agent`: affected `<0.43.3`, fixed in `0.43.3` · CVSS 7.3 High · Not analysed yet · Published 9 Oct 2024 · Tags: CWE-428 - [Grafana Alloy on Windows has Unquoted Search Path or Element vulnerability in github.com/grafana/alloy](https://agentprime.io/advisories/GHSA-chqx-36rm-rf8h.md) `GHSA-chqx-36rm-rf8h`, `BIT-grafana-alloy-2024-8975`, `CVE-2024-8975`, `GO-2024-3168` · Go `github.com/grafana/alloy`: affected `<1.3.4 || >=1.4.0-rc.0, <1.4.1`, fixed in `1.3.4`, `1.4.1` · CVSS 7.3 High · Not analysed yet · Published 9 Oct 2024 · Tags: CWE-428 - [Intelbras InControl incontrol-service-watchdog.exe unquoted search path](https://agentprime.io/advisories/CVE-2024-9325.md) `CVE-2024-9325` · CVE record: Intelbras InControl · CVSS 8.5 High · Not analysed yet · Published 29 Sept 2024 · Tags: CWE-426, CWE-428 - [Windows Setup and Deployment Elevation of Privilege Vulnerability](https://agentprime.io/advisories/CVE-2024-43457.md) `CVE-2024-43457` · CVE record: Microsoft Windows 11 Version 24H2 · CVSS 7.8 High · Not analysed yet · Published 10 Sept 2024 · Tags: CWE-428 - [QVR Smart Client](https://agentprime.io/advisories/CVE-2022-27592.md) `CVE-2022-27592` · CVE record: QNAP Systems Inc. QVR Smart Client · CVSS 6.7 Medium · Not analysed yet · Published 6 Sept 2024 · Tags: CWE-428 - [An unquoted executable path exists in Hitachi Device Manager](https://agentprime.io/advisories/CVE-2024-5963.md) `CVE-2024-5963` · CVE record: Hitachi Hitachi Device Manager · CVSS 6.7 Medium · Not analysed yet · Published 6 Aug 2024 · Tags: CWE-428 - [Unquoted search path in Plug&Track Thermoscan IP](https://agentprime.io/advisories/CVE-2024-31201.md) `CVE-2024-31201` · CVE record: Plug&Track Thermoscan IP · CVSS 6.5 Medium · Not analysed yet · Published 31 Jul 2024 · Tags: CWE-428 - [Mint Workbench I Unquoted Service Path Enumeration](https://agentprime.io/advisories/CVE-2024-5402.md) `CVE-2024-5402` · CVE record: ABB Mint Workbench I · CVSS 6.2 Medium · Not analysed yet · Published 15 Jul 2024 · Tags: CWE-428 - [Intelbras InControl incontrolWebcam Service unquoted search path](https://agentprime.io/advisories/CVE-2024-6080.md) `CVE-2024-6080` · CVE record: Intelbras InControl · CVSS 8.5 High · Not analysed yet · Published 17 Jun 2024 · Tags: CWE-426, CWE-428 - [Unquoted search path in Schneider Electric Easergy Studio](https://agentprime.io/advisories/CVE-2024-2747.md) `CVE-2024-2747` · CVE record: Schneider Electric Easergy Studio · CVSS 7.8 High · Not analysed yet · Published 12 Jun 2024 · Tags: CWE-428 - [Sunshine's unquoted executable path could lead to hijacked execution flow](https://agentprime.io/advisories/CVE-2024-31226.md) `CVE-2024-31226` · CVE record: LizardByte Sunshine · CVSS 4.9 Medium · Not analysed yet · Published 16 May 2024 · Tags: CWE-428 - [Rockwell Automation FactoryTalk® Remote Access™ has Unquoted Executables](https://agentprime.io/advisories/CVE-2024-3640.md) `CVE-2024-3640` · CVE record: Rockwell Automation FactoryTalk® Remote Access™ · CVSS 7.0 High · Not analysed yet · Published 16 May 2024 · Tags: CWE-428 - [Unquoted path or search item vulnerability in SugarSync](https://agentprime.io/advisories/CVE-2024-4461.md) `CVE-2024-4461` · CVE record: SugarSync SugarSync · CVSS 7.8 High · Not analysed yet · Published 3 May 2024 · Tags: CWE-428 - [Triangle MicroWorks SCADA Data Gateway GTWWebMonitorService Unquoted Search Path Remote Code Execution Vulnerability](https://agentprime.io/advisories/CVE-2023-39464.md) `CVE-2023-39464` · CVE record: Triangle MicroWorks SCADA Data Gateway · CVSS 7.2 High · Not analysed yet · Published 3 May 2024 · Tags: CWE-428 - [Unquoted search path in Acronis Cyber Protect Cloud Agent and others](https://agentprime.io/advisories/CVE-2024-34010.md) `CVE-2024-34010` · CVE record: Acronis Acronis Cyber Protect Cloud Agent and 3 more · CVSS 8.2 High · Not analysed yet · Published 29 Apr 2024 · Tags: CWE-428 - [MEVO WEBCAM APP Windows Unquoted Service Path Vulnerability](https://agentprime.io/advisories/CVE-2024-4031.md) `CVE-2024-4031` · CVE record: Logitech MEVO WEBCAM APP · CVSS 4.4 Medium · Not analysed yet · Published 23 Apr 2024 · Tags: CWE-428 - [An unquoted service path vulnerability in Terratec DMX_6Fire USB v.1.23.0.02 allows a local attacker to escalate privileges via the Program.exe component.](https://agentprime.io/advisories/CVE-2024-31804.md) `CVE-2024-31804` · CVE record · CVSS 6.7 Medium · Not analysed yet · Published 23 Apr 2024 · Tags: CWE-428 - [HPE MSA SAN Storage VSS Provider and CAPI Proxy Software, Elevation of Privilege](https://agentprime.io/advisories/CVE-2024-22437.md) `CVE-2024-22437` · CVE record: Hewlett Packard Enterprise HPE MSA SAN Storage VSS Provider and CAPI Proxy Software · CVSS 7.3 High · Not analysed yet · Published 15 Apr 2024 · Tags: CWE-428 - [Unquoted item or search path vulnerability in Faronics Deep Freeze Server Standard](https://agentprime.io/advisories/CVE-2024-1618.md) `CVE-2024-1618` · CVE record: Faronics Deep Freeze Server Standard · CVSS 7.8 High · Not analysed yet · Published 12 Mar 2024 · Tags: CWE-428 - [Wiesemann & Theis: Multiple products prone to unquoted search path](https://agentprime.io/advisories/CVE-2024-25552.md) `CVE-2024-25552` · CVE record: W&T Com Redirector PnP and 2 more · CVSS 7.8 High · Not analysed yet · Published 1 Mar 2024 · Tags: CWE-428 - [An unquoted service path vulnerability in the 12d Synergy Server and File Replication Server components may allow an attacker to gain elevated privileges via the 12d Synergy Server and/or 12d Synergy…](https://agentprime.io/advisories/CVE-2024-24722.md) `CVE-2024-24722` · CVE record · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 19 Feb 2024 · Tags: CWE-428 - [Unquoted search path in Intel(R) Thunderbolt(TM) DCH drivers for Windows](https://agentprime.io/advisories/CVE-2023-24542.md) `CVE-2023-24542` · CVE record: Intel(R) Thunderbolt(TM) DCH drivers for Windows · CVSS 6.7 Medium · Not analysed yet · Published 14 Feb 2024 · Tags: CWE-428 - [PanteraSoft HDD Health search path or unquoted item vulnerability](https://agentprime.io/advisories/CVE-2024-1201.md) `CVE-2024-1201` · CVE record: PanteraSoft HDD Health · CVSS 7.8 High · Not analysed yet · Published 2 Feb 2024 · Tags: CWE-428 - [Automation Studio and PVI Multiple unquoted service path vulnerabilities](https://agentprime.io/advisories/CVE-2020-24682.md) `CVE-2020-24682` · CVE record: B&R Industrial Automation Automation Studio and 1 more · CVSS 7.2 High · Not analysed yet · Published 2 Feb 2024 · Tags: CWE-428 - [Unquoted path privilege vulnerability in ESET products for Windows](https://agentprime.io/advisories/CVE-2023-7043.md) `CVE-2023-7043` · CVE record: ESET, spol. s r.o. ESET Endpoint Security and 4 more · CVSS 3.3 Low · Not analysed yet · Published 31 Jan 2024 · Tags: CWE-428 - [Subnet Solutions Inc. PowerSYSTEM Center Unquoted Search Path or Element](https://agentprime.io/advisories/CVE-2023-6631.md) `CVE-2023-6631` · CVE record: Subnet Solutions Inc. PowerSYSTEM Center · CVSS 7.8 High · Not analysed yet · Published 8 Jan 2024 · Tags: CWE-428 - [Unquoted search path in Intel(R) NUC Kits NUC7i3DN, NUC7i5DN…](https://agentprime.io/advisories/CVE-2023-32658.md) `CVE-2023-32658` · CVE record: Intel(R) NUC Kits NUC7i3DN, NUC7i5DN, NUC7i7DN HDMI firmware update tool software · CVSS 6.7 Medium · Not analysed yet · Published 14 Nov 2023 · Tags: CWE-428 - [Unquoted search path in Intel Server Configuration Utility software](https://agentprime.io/advisories/CVE-2023-25075.md) `CVE-2023-25075` · CVE record: Intel Server Configuration Utility software · CVSS 6.7 Medium · Not analysed yet · Published 14 Nov 2023 · Tags: CWE-428 - [Unquoted search path in Intel(R) Arc(TM) Control software](https://agentprime.io/advisories/CVE-2023-29165.md) `CVE-2023-29165` · CVE record: Intel(R) Arc(TM) Control software · CVSS 6.7 Medium · Not analysed yet · Published 14 Nov 2023 · Tags: CWE-428 - [Unquoted search path in Okta LDAP Agent](https://agentprime.io/advisories/CVE-2023-0392.md) `CVE-2023-0392` · CVE record: Okta LDAP Agent · CVSS 3.9 Low · Not analysed yet · Published 8 Nov 2023 · Tags: CWE-428 - [Fortect - CWE-428: Unquoted Search Path or Element](https://agentprime.io/advisories/CVE-2023-42486.md) `CVE-2023-42486` · CVE record: Fortect Fortect · CVSS 6.3 Medium · Not analysed yet · Published 27 Sept 2023 · Tags: CWE-428 - [Topaz OFD Protection Module Warsaw core.exe unquoted search path](https://agentprime.io/advisories/CVE-2023-5012.md) `CVE-2023-5012` · CVE record: Topaz OFD · CVSS 5.3 Medium · Not analysed yet · Published 16 Sept 2023 · Tags: CWE-428 - [NextBX QWAlerter QWAlerter.exe unquoted search path](https://agentprime.io/advisories/CVE-2023-4991.md) `CVE-2023-4991` · CVE record: NextBX QWAlerter · CVSS 7.8 High · Not analysed yet · Published 15 Sept 2023 · Tags: CWE-428 - [Unquoted search path in System Firmware Update Utility (SysFwUpdt) for some Intel(R) Server Boards and…](https://agentprime.io/advisories/CVE-2023-22841.md) `CVE-2023-22841` · CVE record: System Firmware Update Utility (SysFwUpdt) for some Intel(R) Server Boards and Intel(R) Server Systems Based on Intel(R) 621A Chipset · CVSS 6.7 Medium · Not analysed yet · Published 11 Aug 2023 · Tags: CWE-428 - [Unquoted Service Path in ABB AO-OPC](https://agentprime.io/advisories/CVE-2023-2685.md) `CVE-2023-2685` · CVE record: ABB AO-OPC · CVSS 7.2 High · Not analysed yet · Published 28 Jul 2023 · Tags: CWE-428 - [Pointware EasyInventory Easy2W.exe unquoted search path](https://agentprime.io/advisories/CVE-2023-3842.md) `CVE-2023-3842` · CVE record: Pointware EasyInventory · CVSS 7.8 High · Not analysed yet · Published 23 Jul 2023 · Tags: CWE-428 - [The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-controlled system.](https://agentprime.io/advisories/CVE-2023-38408.md) `CVE-2023-38408` · CVE record · CVSS 9.8 Critical · Critical (CVSS 9+, CVSS 7+ and EPSS) · EPSS 0.80 · Not analysed yet · Published 20 Jul 2023 · Tags: CWE-428 - [Unquoted search path in Trellix Move](https://agentprime.io/advisories/CVE-2023-3438.md) `CVE-2023-3438` · CVE record: Trellix Trellix Move · CVSS 4.4 Medium · Not analysed yet · Published 3 Jul 2023 · Tags: CWE-428 Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .