CWE:

	Tytuł	Data	Autor
Med.	SentinelOne sentinelagent 22.3.2.5 Privilege Escalation	07.12.2022	ouch_this_hurts
Med.	Microsoft SAFER Bypass	30.04.2021	Stefan Kanthak
Med.	Progea Movicon 11.5.1181 Search Path Issues	01.11.2017	Karn Ganeshen
Med.	ArcServe UDP - Download Manager/Setup - DLL Hijacking	06.09.2016	sh4d0wman
High	ArcServe UDP - Unquoted Service Path Privilege Escalation	06.09.2016	sh4d0wman
Med.	Corel Software DLL Hijacking	14.01.2015	CORE
Med.	Karotz Smart Rabbit 12.07.19.00 Hijacking & Cleartext Token	02.08.2013	Daniel Crowley

---

Common Weakness Enumeration (CWE)

CVE

Szczegóły

Opis

2023-03-29

	CVE-2022-28686	Updating...	This vulnerability allows remote attackers to execute arbitrary code on affected installations of AVEVA Edge 2020 SP2 Patch 0(4201.2111.1802.0000). User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of APP files. The process loads a library from an unsecured location. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17114.
	CVE-2022-28687	Updating...	This vulnerability allows remote attackers to execute arbitrary code on affected installations of AVEVA Edge 2020 SP2 Patch 0(4201.2111.1802.0000). User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of APP files. The process loads a library from an unsecured location. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-16257.
	CVE-2022-28688	Updating...	This vulnerability allows remote attackers to execute arbitrary code on affected installations of AVEVA Edge 2020 SP2 Patch 0(4201.2111.1802.0000). User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the handling of APP files. The process loads a library from an unsecured location. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-17201.

2023-01-12

CVE-2023-0247

Updating...

Uncontrolled Search Path Element in GitHub repository bits-and-blooms/bloom prior to 3.3.1.

2022-10-28

CVE-2022-3734

Updating...

A vulnerability was found in Redis. It has been declared as critical. This vulnerability affects unknown code in the library C:/Program Files/Redis/dbghelp.dll. The manipulation leads to uncontrolled search path. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. The identifier of this vulnerability is VDB-212416.

2022-09-28

CVE-2022-32168

Updating...

Notepad++ versions 8.4.1 and before are vulnerable to DLL hijacking where an attacker can replace the vulnerable dll (UxTheme.dll) with his own dll and run arbitrary code in the context of Notepad++.

2022-08-31

CVE-2022-2006

Updating...

AutomationDirect DirectLOGIC has a DLL vulnerability in the install directory that may allow an attacker to execute code during the installation process. This issue affects: AutomationDirect C-more EA9 EA9-T6CL versions prior to 6.73; EA9-T6CL-R versions prior to 6.73; EA9-T7CL versions prior to 6.73; EA9-T7CL-R versions prior to 6.73; EA9-T8CL versions prior to 6.73; EA9-T10CL versions prior to 6.73; EA9-T10WCL versions prior to 6.73; EA9-T12CL versions prior to 6.73; EA9-T15CL versions prior to 6.73; EA9-RHMI versions prior to 6.73; EA9-PGMSW versions prior to 6.73;

2022-08-17

CVE-2022-2334

Updating...

The application searches for a library dll that is not found. If an attacker can place a dll with this name, then the attacker can leverage it to execute arbitrary code on the targeted Softing Secure Integration Server V1.22.

2022-08-11

CVE-2022-34235

Updating...

Adobe Premiere Elements version 2020v20 (and earlier) is affected by an Uncontrolled Search Path Element which could lead to Privilege Escalation. An attacker could leverage this vulnerability to obtain admin using an existing low-privileged user. Exploitation of this issue does not require user interaction.

2022-07-18

CVE-2022-34901

Updating...

This vulnerability allows local attackers to escalate privileges on affected installations of Parallels Access 6.5.4 (39316) Agent. An attacker must first obtain the ability to execute low-privileged code on the target host system in order to exploit this vulnerability. The specific flaw exists within the Parallels Service. The service executes files from an unsecured location. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of root. Was ZDI-CAN-16137.

 

---

Copyright 2023, cxsecurity.com