Filtered by CWE-427
Filtered by vendor Subscriptions
Total 815 CVE
CVE Vendors Products Updated CVSS v3.1
CVE-2022-26062 1 Intel 1 Trace Analyzer And Collector 2024-11-21 6.7 Medium
Uncontrolled search path element in the Intel(R) Trace Analyzer and Collector before version 2021.6 for Intel(R) oneAPI HPC Toolkit may allow an authenticated user to potentially enable escalation of privilege via local access.
CVE-2022-26052 1 Intel 1 Mpi Library 2024-11-21 6.7 Medium
Uncontrolled search path element in the Intel(R) MPI Library before version 2021.6 for Intel(R) oneAPI HPC Toolkit may allow an authenticated user to potentially enable escalation of privilege via local access.
CVE-2022-26032 1 Intel 1 Distribution For Python 2024-11-21 6.7 Medium
Uncontrolled search path element in the Intel(R) Distribution for Python programming language before version 2022.1 for Intel(R) oneAPI Toolkits may allow an authenticated user to potentially enable escalation of privilege via local access.
CVE-2022-26028 1 Intel 1 Vtune Profiler 2024-11-21 6.7 Medium
Uncontrolled search path in the Intel(R) VTune(TM) Profiler software before version 2022.2.0 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVE-2022-25999 1 Intel 1 Enpirion Digital Power Configurator Gui 2024-11-21 7.8 High
Uncontrolled search path element in the Intel(R) Enpirion(R) Digital Power Configurator GUI software, all versions may allow an authenticated user to potentially enable escalation of privilege via local access.
CVE-2022-25969 1 Kingsoft 1 Wps Office 2024-11-21 7.8 High
The installer of WPS Office Version 10.8.0.6186 insecurely load VERSION.DLL (or some other DLLs), allowing an attacker to execute arbitrary code with the privilege of the user invoking the installer.
CVE-2022-25905 1 Intel 1 Oneapi Data Analytics Library 2024-11-21 6.7 Medium
Uncontrolled search path element in the Intel(R) oneAPI Data Analytics Library (oneDAL) before version 2021.5 for Intel(R) oneAPI Base Toolkit may allow an authenticated user to potentially enable escalation of privilege via local access.
CVE-2022-25864 1 Intel 1 Oneapi Math Kernel Library 2024-11-21 6.7 Medium
Uncontrolled search path in some Intel(R) oneMKL software before version 2022.0 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVE-2022-25841 1 Intel 1 Datacenter Group Event 2024-11-21 7.8 High
Uncontrolled search path elements in the Intel(R) Datacenter Group Event Android application, all versions, may allow an authenticated user to potentially enable escalation of privilege via local access.
CVE-2022-25348 2 Hibara, Microsoft 2 Attachecase, Windows 2024-11-21 7.8 High
Untrusted search path vulnerability in AttacheCase ver.4.0.2.7 and earlier allows an attacker to gain privileges and execute arbitrary code via a Trojan horse DLL in an unspecified directory.
CVE-2022-25255 4 Linux, Opengroup, Qt and 1 more 4 Linux Kernel, Unix, Qt and 1 more 2024-11-21 7.8 High
In Qt 5.9.x through 5.15.x before 5.15.9 and 6.x before 6.2.4 on Linux and UNIX, QProcess could execute a binary from the current working directory when not found in the PATH.
CVE-2022-25154 1 Samsung 2 T5, T5 Firmware 2024-11-21 7.3 High
A DLL hijacking vulnerability in Samsung portable SSD T5 PC software before 1.6.9 could allow a local attacker to escalate privileges. (An attacker must already have user privileges on Windows 7, 10, or 11 to exploit this vulnerability.)
CVE-2022-24955 2 Foxit, Microsoft 3 Pdf Editor, Pdf Reader, Windows 2024-11-21 9.8 Critical
Foxit PDF Reader before 11.2.1 and Foxit PDF Editor before 11.2.1 have an Uncontrolled Search Path Element for DLL files.
CVE-2022-24767 2 Git For Windows Project, Microsoft 4 Git For Windows, Visual Studio 2017, Visual Studio 2019 and 1 more 2024-11-21 7.8 High
GitHub: Git for Windows' uninstaller vulnerable to DLL hijacking when run under the SYSTEM user account.
CVE-2022-24765 6 Apple, Debian, Fedoraproject and 3 more 7 Xcode, Debian Linux, Fedora and 4 more 2024-11-21 6 Medium
Git for Windows is a fork of Git containing Windows-specific patches. This vulnerability affects users working on multi-user machines, where untrusted parties have write access to the same hard disk. Those untrusted parties could create the folder `C:\.git`, which would be picked up by Git operations run supposedly outside a repository while searching for a Git directory. Git would then respect any config in said Git directory. Git Bash users who set `GIT_PS1_SHOWDIRTYSTATE` are vulnerable as well. Users who installed posh-gitare vulnerable simply by starting a PowerShell. Users of IDEs such as Visual Studio are vulnerable: simply creating a new project would already read and respect the config specified in `C:\.git\config`. Users of the Microsoft fork of Git are vulnerable simply by starting a Git Bash. The problem has been patched in Git for Windows v2.35.2. Users unable to upgrade may create the folder `.git` on all drives where Git commands are run, and remove read/write access from those folders as a workaround. Alternatively, define or extend `GIT_CEILING_DIRECTORIES` to cover the _parent_ directory of the user profile, e.g. `C:\Users` if the user profile is located in `C:\Users\my-user-name`.
CVE-2022-24426 1 Dell 3 Alienware Update, Command Update, Update 2024-11-21 7.8 High
Dell Command | Update, Dell Update, and Alienware Update version 4.4.0 contains a Local Privilege Escalation Vulnerability in the Advanced Driver Restore component. A local malicious user could potentially exploit this vulnerability, leading to privilege escalation.
CVE-2022-24077 1 Naver 1 Cloud Explorer 2024-11-21 7.8 High
Naver Cloud Explorer Beta allows the attacker to execute arbitrary code as System privilege via malicious DLL injection.
CVE-2022-23853 1 Kde 2 Kate, Ktexteditor 2024-11-21 7.8 High
The LSP (Language Server Protocol) plugin in KDE Kate before 21.12.2 and KTextEditor before 5.91.0 tries to execute the associated LSP server binary when opening a file of a given type. If this binary is absent from the PATH, it will try running the LSP server binary in the directory of the file that was just opened (due to a misunderstanding of the QProcess API, that was never intended). This can be an untrusted directory.
CVE-2022-23449 1 Siemens 2 Simatic Energy Manager Basic, Simatic Energy Manager Pro 2024-11-21 7.3 High
A vulnerability has been identified in SIMATIC Energy Manager Basic (All versions < V7.3 Update 1), SIMATIC Energy Manager PRO (All versions < V7.3 Update 1). A DLL Hijacking vulnerability could allow a local attacker to execute code with elevated privileges by placing a malicious DLL in one of the directories on the DLL search path.
CVE-2022-23410 1 Axis 1 Ip Utility 2024-11-21 7.8 High
AXIS IP Utility before 4.18.0 allows for remote code execution and local privilege escalation by the means of DLL hijacking. IPUtility.exe would attempt to load DLLs from its current working directory which could allow for remote code execution if a compromised DLL would be placed in the same folder.