CWE-428 Unquoted Search Path or Element
baseThe product uses a search path that contains an unquoted element, in which the element contains whitespace or other separators. This can cause the product to access resources in a parent path.
01
übergeordnete Schwächen
Übergeordnete Klassen, zu denen dies gehört.
02
Schwachstellen (478)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2023-38408US | critical9.8 | Exploit | ||
The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-con… | ||||
| CVE-2020-13699US | high8.8 | Exploit | ||
TeamViewer Desktop for Windows before 15.8.3 does not properly quote its custom URI handlers. A malicious website could launch TeamViewer with arbitrary parameters, as demonstrated… | ||||
| CVE-2019-17658US | critical9.8 | Exploit | ||
An unquoted service path vulnerability in the FortiClient FortiTray component of FortiClientWindows v6.2.2 and prior allow an attacker to gain elevated privileges via the FortiClie… | ||||
| CVE-2019-18915US | high7.8 | Exploit | ||
A potential security vulnerability has been identified with certain versions of HP System Event Utility prior to version 1.4.33. This vulnerability may allow a local attacker to ex… | ||||
| CVE-2018-10619US | high7.8 | Exploit | ||
An unquoted search path or element in RSLinx Classic Versions 3.90.01 and prior and FactoryTalk Linx Gateway Versions 3.90.00 and prior may allow an authorized, but non-privileged… | ||||
| CVE-2023-31747US | high7.8 | Exploit | ||
Wondershare Filmora 12 (Build 12.2.1.2088) was discovered to contain an unquoted service path vulnerability via the component NativePushService. This vulnerability allows attackers… | ||||
| CVE-2022-37197US | high7.8 | Exploit | ||
IOBit IOTransfer V4 is vulnerable to Unquoted Service Path. | ||||
| CVE-2022-39959US | high7.8 | Exploit | ||
Panini Everest Engine 2.0.4 allows unprivileged users to create a file named Everest.exe in the %PROGRAMDATA%\Panini folder. This leads to privilege escalation because a service, r… | ||||
| CVE-2022-35899US | high7.8 | Exploit | ||
There is an unquoted service path in ASUSTeK Aura Ready Game SDK service (GameSDK.exe) 1.0.0.4. This might allow a local user to escalate privileges by creating a %PROGRAMFILES(X86… | ||||
| CVE-2022-23909US | high7.8 | Exploit | ||
There is an unquoted service path in Sherpa Connector Service (SherpaConnectorService.exe) 2020.2.20328.2050. This might allow a local user to escalate privileges by creating a "C:… | ||||
| CVE-2020-15261US | medium6.7 | Exploit | ||
On Windows the Veyon Service before version 4.4.2 contains an unquoted service path vulnerability, allowing locally authenticated users with administrative privileges to run malici… | ||||
| CVE-2017-3141US | high7.8 | Exploit | ||
The BIND installer on Windows uses an unquoted service path which can enable a local user to achieve privilege escalation if the host file system permissions allow this. Affects BI… | ||||
| CVE-2017-1000475US | high7.8 | Exploit | ||
FreeSSHd 1.3.1 version is vulnerable to an Unquoted Path Service allowing local users to launch processes with elevated privileges. | ||||
| CVE-2021-36366US | critical9.8 | — | ||
Nagios XI before 5.8.5 incorrectly allows manage_services.sh wildcards. | ||||
| CVE-2020-9292US | critical9.8 | — | ||
An unquoted service path vulnerability in the FortiSIEM Windows Agent component may allow an attacker to gain elevated privileges via the AoWinAgt executable service path. | ||||
| CVE-2022-36344US | critical9.8 | — | ||
An unquoted search path vulnerability exists in 'JustSystems JUST Online Update for J-License' bundled with multiple products for corporate users as in Ichitaro through Pro5 and ot… | ||||
| CVE-2020-14521US | critical9.8OT erhöht | — | ||
Multiple Mitsubishi Electric Factory Automation engineering software products have a malicious code execution vulnerability. A malicious attacker could use this vulnerability to ob… | ||||
| CVE-2019-8459US | critical9.8 | — | ||
Check Point Endpoint Security Client for Windows, with the VPN blade, before version E80.83, starts a process without using quotes in the path. This can cause loading of a previous… | ||||
| CVE-2017-7180US | high7.3 | Exploit | ||
Net Monitor for Employees Pro through 5.3.4 has an unquoted service path, which allows a Security Feature Bypass of its documented "Block applications" design goal. The local attac… | ||||
| CVE-2005-4505US | high7.2 | Exploit | ||
Unquoted Windows search path vulnerability in McAfee VirusScan Enterprise 8.0i (patch 11) and CMA 3.5 (patch 5) might allow local users to gain privileges via a malicious "program.… | ||||
03
Quelle
Wo diese Definition veröffentlicht ist.
MITREUS
scry
Schwächen wie diese tauchen in realen, ausnutzbaren Angriffsflächen auf. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan