CWE-427 Uncontrolled Search Path Element
baseThe product uses a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors.
01
parent weaknesses
Broader classes this is a kind of.
02
vulnerabilities (1388)
Known CVEs related to this entry.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-110936DE | medium6.7OT critical | KEV | ||
A vulnerability has been identified in Siemens Software Center (All versions < V4.0.9.8). The affected application loads dynamic-link libraries (DLLs) from an uncontrolled search p… | ||||
| CVE-2020-3433US | high7.8OT critical | KEV | ||
A vulnerability in the interprocess communication (IPC) channel of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated, local attacker to perform a DLL… | ||||
| CVE-2020-3153US | medium6.5OT critical | KEV | ||
A vulnerability in the installer component of Cisco AnyConnect Secure Mobility Client for Windows could allow an authenticated local attacker to copy user-supplied files to system… | ||||
| CVE-2020-27955US | critical9.8 | Exploit | ||
Git LFS 2.12.0 allows Remote Code Execution. | ||||
| CVE-2017-6517US | critical9.8 | — | ||
Microsoft Skype 7.16.0.102 contains a vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary code on the targeted system. This vulnerability exists… | ||||
| CVE-2010-3139US | high9.3 | Exploit | ||
Untrusted search path vulnerability in Microsoft Windows Progman Group Converter (grpconv.exe) allows local users, and possibly remote attackers, to execute arbitrary code and cond… | ||||
| CVE-2010-3143US | high9.3 | Exploit | ||
Untrusted search path vulnerability in Microsoft Windows Contacts allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via… | ||||
| CVE-2002-0866US | high7.5 | Exploit | ||
Java Database Connectivity (JDBC) classes in Microsoft Virtual Machine (VM) up to and including 5.0.3805 allow remote attackers to load and execute DLLs (dynamic link libraries) vi… | ||||
| CVE-2010-3152US | high9.3 | Exploit | ||
Untrusted search path vulnerability in Adobe Illustrator CS4 14.0.0, CS5 15.0.1 and earlier, and possibly other versions allows local users, and possibly remote attackers, to execu… | ||||
| CVE-2010-3151US | high9.3 | Exploit | ||
Untrusted search path vulnerability in Adobe On Location CS4 Build 315 allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attack… | ||||
| CVE-2010-3150US | high9.3 | Exploit | ||
Untrusted search path vulnerability in Adobe Premier Pro CS4 4.0.0 (314 (MC: 160820)) allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL h… | ||||
| CVE-2010-3149US | high9.3 | Exploit | ||
Untrusted search path vulnerability in Adobe Device Central CS5 3.0.0(376), 3.0.1.0 (3027), and probably other versions allows local users, and possibly remote attackers, to execut… | ||||
| CVE-2010-3144US | high9.3 | Exploit | ||
Untrusted search path vulnerability in the Internet Connection Signup Wizard in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 allows local users to gain privileges via a Tro… | ||||
| CVE-2010-3141US | high9.3 | Exploit | ||
Untrusted search path vulnerability in Microsoft PowerPoint 2010 allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attacks via… | ||||
| CVE-2010-3140US | high9.3 | Exploit | ||
Untrusted search path vulnerability in Microsoft Windows Internet Communication Settings on Windows XP SP3 allows local users, and possibly remote attackers, to execute arbitrary c… | ||||
| CVE-2010-3132US | high9.3 | Exploit | ||
Untrusted search path vulnerability in Adobe Dreamweaver CS5 11.0 build 4916, build 4909, and probably other versions, allows local users, and possibly remote attackers, to execute… | ||||
| CVE-2010-3127US | high9.3 | Exploit | ||
Untrusted search path vulnerability in Adobe PhotoShop CS2 through CS5 allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking attack… | ||||
| CVE-2010-3155US | high9.3 | Exploit | ||
Untrusted search path vulnerability in Adobe ExtendScript Toolkit (ESTK) CS5 3.5.0.52 allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL h… | ||||
| CVE-2010-3154US | high9.3 | Exploit | ||
Untrusted search path vulnerability in Adobe Extension Manager CS5 5.0.298 allows local users, and possibly remote attackers, to execute arbitrary code and conduct DLL hijacking at… | ||||
| CVE-2010-3124US | high9.3 | Exploit | ||
Untrusted search path vulnerability in bin/winvlc.c in VLC Media Player 1.1.3 and earlier allows local users, and possibly remote attackers, to execute arbitrary code and conduct D… | ||||
03
attack patterns (2)
CAPEC attack patterns that exploit this.
04
source
Where this definition is published.
MITREUS
scry
Weaknesses like this turn up in real, exploitable exposures. See what is exposed on your perimeter with a free passive scan.
Free scan