CWE:

	Topic	Date	Author
Med.	SentinelOne sentinelagent 22.3.2.5 Privilege Escalation	07.12.2022	ouch_this_hurts
Med.	Microsoft SAFER Bypass	30.04.2021	Stefan Kanthak
Med.	Progea Movicon 11.5.1181 Search Path Issues	01.11.2017	Karn Ganeshen
Med.	ArcServe UDP - Download Manager/Setup - DLL Hijacking	06.09.2016	sh4d0wman
High	ArcServe UDP - Unquoted Service Path Privilege Escalation	06.09.2016	sh4d0wman
Med.	Corel Software DLL Hijacking	14.01.2015	CORE
Med.	Karotz Smart Rabbit 12.07.19.00 Hijacking & Cleartext Token	02.08.2013	Daniel Crowley

---

CVEMAP Search Results

CVE

Details

Description

2024-04-10

CVE-2024-22450

Updating...

Dell Alienware Command Center, versions prior to 6.2.7.0, contain an uncontrolled search path element vulnerability. A local malicious user could potentially inject malicious files in the file search path, leading to system compromise.

2024-03-01

CVE-2023-39254

Updating...

Dell Update Package (DUP), Versions prior to 4.9.10 contain an Uncontrolled Search Path vulnerability. A malicious user with local access to the system could potentially exploit this vulnerability to run arbitrary code as admin.

2024-02-29

	CVE-2023-6132	Updating...	The vulnerability, if exploited, could allow a malicious entity with access to the file system to achieve arbitrary code execution and privilege escalation by tricking AVEVA Edge to load an unsafe DLL.
	CVE-2024-1595	Updating...	Delta Electronics CNCSoft-B DOPSoft prior to v4.0.0.82 insecurely loads libraries, which may allow an attacker to use DLL hijacking and take over the system where the software is installed.

2024-01-03

CVE-2023-6338

Updating...

Uncontrolled search path vulnerabilities were reported in the Lenovo Universal Device Client (UDC) that could allow an attacker with local access to execute code with elevated privileges.

2023-12-25

CVE-2023-43064

Updating...

Facsimile Support for IBM i 7.2, 7.3, 7.4, and 7.5 could allow a local user to gain elevated privileges due to an unqualified library call. A malicious actor could cause arbitrary code to run with the privilege of the user invoking the facsimile support. IBM X-Force ID: 267689.

2023-12-17

CVE-2023-6891

Updating...

A vulnerability has been found in PeaZip 9.4.0 and classified as problematic. Affected by this vulnerability is an unknown functionality in the library dragdropfilesdll.dll of the component Library Handler. The manipulation leads to uncontrolled search path. An attack has to be approached locally. Upgrading to version 9.6.0 is able to address this issue. It is recommended to upgrade the affected component. The associated identifier of this vulnerability is VDB-248251. NOTE: Vendor was contacted early, confirmed the existence of the flaw and immediately worked on a patched release.

2023-12-12

	CVE-2020-28369	Updating...	In BeyondTrust Privilege Management for Windows (aka PMfW) through 5.7, a SYSTEM installation causes Cryptbase.dll to be loaded from the user-writable location %WINDIR%\Temp.
	CVE-2023-48677	Updating...	Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 40901.
	CVE-2023-41117	Updating...	An issue was discovered in EnterpriseDB Postgres Advanced Server (EPAS) before 11.21.32, 12.x before 12.16.20, 13.x before 13.12.16, 14.x before 14.9.0, and 15.x before 15.4.0. It contain packages, standalone packages, and functions that run SECURITY DEFINER but are inadequately secured against search_path attacks.

 

---

Copyright 2024, cxsecurity.com