Filtered by CWE-427
Filtered by vendor Subscriptions
Total 815 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2022-34848 1 Intel 1 Nuc Pro Software Suite 2024-11-21 6.7 Medium
Uncontrolled search path for the Intel(R) NUC Pro Software Suite before version 2.0.0.3 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVE-2022-34825 1 Nec 2 Expresscluster X, Expresscluster X Singleserversafe 2024-11-21 9.8 Critical
Uncontrolled Search Path Element in CLUSTERPRO X 5.0 for Windows and earlier, EXPRESSCLUSTER X 5.0 for Windows and earlier, CLUSTERPRO X 5.0 SingleServerSafe for Windows and earlier, EXPRESSCLUSTER X 5.0 SingleServerSafe for Windows and earlier allows a remote unauthenticated attacker to overwrite existing files on the file system and to potentially execute arbitrary code.
CVE-2022-34755 1 Schneider-electric 1 Easergy Builder Installer 2024-11-21 6.3 Medium
A CWE-427 - Uncontrolled Search Path Element vulnerability exists that could allow an attacker with a local privileged account to place a specially crafted file on the target machine, which may give the attacker the ability to execute arbitrary code during the installation process initiated by a valid user. Affected Products: Easergy Builder Installer (1.7.23 and prior)
CVE-2022-34396 1 Dell 1 Openmanage Server Administrator 2024-11-21 7 High
Dell OpenManage Server Administrator (OMSA) version 10.3.0.0 and earlier contains a DLL Injection Vulnerability. A local low privileged authenticated attacker could potentially exploit this vulnerability, leading to the execution of arbitrary executable on the operating system with elevated privileges. Exploitation may lead to a complete system compromise.
CVE-2022-34235 3 Adobe, Apple, Microsoft 3 Premiere Elements, Macos, Windows 2024-11-21 7.8 High
Adobe Premiere Elements version 2020v20 (and earlier) is affected by an Uncontrolled Search Path Element which could lead to Privilege Escalation. An attacker could leverage this vulnerability to obtain admin using an existing low-privileged user. Exploitation of this issue does not require user interaction.
CVE-2022-34101 1 Crestron 1 Airmedia 2024-11-21 7.8 High
A vulnerability was discovered in the Crestron AirMedia Windows Application, version 4.3.1.39, in which a user can place a malicious DLL in a certain path to execute code and preform a privilege escalation attack.
CVE-2022-33921 1 Dell 1 Geodrive 2024-11-21 7 High
Dell GeoDrive, versions prior to 2.2, contains Multiple DLL Hijacking Vulnerabilities. A low privilege attacker could potentially exploit this vulnerability, leading to the execution of arbitrary code in the SYSTEM security context.
CVE-2022-33037 1 Orwell-dev-cpp Project 1 Orwell-dev-cpp 2024-11-21 7.8 High
A binary hijack in Orwell-Dev-Cpp v5.11 allows attackers to execute arbitrary code via a crafted .exe file.
CVE-2022-33036 1 Embarcadero 1 Dev-c\+\+ 2024-11-21 7.8 High
A binary hijack in Embarcadero Dev-CPP v6.3 allows attackers to execute arbitrary code via a crafted .exe file.
CVE-2022-33035 1 Netsarang 1 Xlpd 2024-11-21 7.8 High
XLPD v7.0.0094 and below contains an unquoted service path vulnerability which allows local users to launch processes with elevated privileges.
CVE-2022-32972 1 Infoblox 1 Bloxone Endpoint 2024-11-21 7.8 High
Infoblox BloxOne Endpoint for Windows through 2.2.7 allows DLL injection that can result in local privilege escalation.
CVE-2022-32576 1 Intel 1 Unite 2024-11-21 6.7 Medium
Uncontrolled search path in the Intel(R) Unite(R) Plugin SDK before version 4.2 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVE-2022-32498 1 Dell 1 Powerstore Command Line Interface 2024-11-21 5.5 Medium
Dell EMC PowerStore, Versions prior to v3.0.0.0 contain a DLL Hijacking vulnerability in PSTCLI. A local attacker can potentially exploit this vulnerability to execute arbitrary code, escalate privileges, and bypass software allow list solutions, leading to system takeover or IP exposure.
CVE-2022-32223 2 Microsoft, Nodejs 2 Windows, Node.js 2024-11-21 7.3 High
Node.js is vulnerable to Hijack Execution Flow: DLL Hijacking under certain conditions on Windows platforms.This vulnerability can be exploited if the victim has the following dependencies on a Windows machine:* OpenSSL has been installed and “C:\Program Files\Common Files\SSL\openssl.cnf” exists.Whenever the above conditions are present, `node.exe` will search for `providers.dll` in the current user directory.After that, `node.exe` will try to search for `providers.dll` by the DLL Search Order in Windows.It is possible for an attacker to place the malicious file `providers.dll` under a variety of paths and exploit this vulnerability.
CVE-2022-32222 2 Nodejs, Siemens 2 Node.js, Sinec Ins 2024-11-21 5.3 Medium
A cryptographic vulnerability exists on Node.js on linux in versions of 18.x prior to 18.40.0 which allowed a default path for openssl.cnf that might be accessible under some circumstances to a non-admin user instead of /etc/ssl as was the case in versions prior to the upgrade to OpenSSL 3.
CVE-2022-32168 1 Notepad-plus-plus 1 Notepad\+\+ 2024-11-21 7.8 High
Notepad++ versions 8.4.1 and before are vulnerable to DLL hijacking where an attacker can replace the vulnerable dll (UxTheme.dll) with his own dll and run arbitrary code in the context of Notepad++.
CVE-2022-31694 1 Installbuilder 1 Installbuilder 2024-11-21 7.3 High
InstallBuilder Qt installers built with versions previous to 22.10 try to load DLLs from the installer binary parent directory when displaying popups. This may allow an attacker to plant a malicious DLL in the installer parent directory to allow executing code with the privileges of the installer (when the popup triggers the loading of the library). Exploiting these type of vulnerabilities generally require that an attacker has access to a vulnerable machine to plant the malicious DLL.
CVE-2022-31611 2 Microsoft, Nvidia 2 Windows, Geforce Experience 2024-11-21 6.8 Medium
NVIDIA GeForce Experience contains an uncontrolled search path vulnerability in all its client installers, where an attacker with user level privileges may cause the installer to load an arbitrary DLL when the installer is launched. A successful exploit of this vulnerability could lead to escalation of privileges and code execution.
CVE-2022-31467 1 Quickheal 1 Total Security 2024-11-21 7.9 High
A DLL hijacking vulnerability in the installed for Quick Heal Total Security prior to 12.1.1.27 allows a local attacker to achieve privilege escalation, leading to execution of arbitrary code, via the installer not restricting the search path for required DLLs and then not verifying the signature of the DLLs it tries to load.
CVE-2022-30744 1 Samsung 1 Kies 2024-11-21 6.2 Medium
DLL hijacking vulnerability in KiesWrapper in Samsung Kies prior to version 2.6.4.22043_1 allows attacker to execute arbitrary code.