Untrusted Search Path

The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.

CVEs (655)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2018-12589 1Polarisoffice 1Polaris Office 2017 Nov 21, 2024 Jun 28, 2018 N/A· v4 7.8 HIGH· v3 6.8 MEDIUM· v2 Polaris Office 2017 8.1 allows attackers to execute arbitrary code via a Trojan horse puiframeworkproresenu.dll file in the current working directory.
CVE-2018-0609 1Linecorp 1Line Nov 21, 2024 Jun 26, 2018 N/A· v4 7.8 HIGH· v3 6.8 MEDIUM· v2 Untrusted search path vulnerability in LINE for Windows versions before 5.8.0 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
CVE-2018-0601 1Axpdfium Project 1Axpdfium Nov 21, 2024 Jun 26, 2018 N/A· v4 7.8 HIGH· v3 9.3 HIGH· v2 Untrusted search path vulnerability in axpdfium v0.01 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
CVE-2018-0600 1Sony 1Playmemories Home Nov 21, 2024 Jun 26, 2018 N/A· v4 7.8 HIGH· v3 6.8 MEDIUM· v2 Untrusted search path vulnerability in the installer of PlayMemories Home for Windows ver.5.5.01 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
CVE-2018-0599 1Microsoft 1Windows Nov 21, 2024 Jun 26, 2018 N/A· v4 7.8 HIGH· v3 9.3 HIGH· v2 Untrusted search path vulnerability in the installer of Visual C++ Redistributable allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
CVE-2018-0598 1Microsoft 1Windows Nov 21, 2024 Jun 26, 2018 N/A· v4 7.8 HIGH· v3 9.3 HIGH· v2 Untrusted search path vulnerability in Self-extracting archive files created by IExpress bundled with Microsoft Windows allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
CVE-2018-0597 1Microsoft 1Visual Studio Code Nov 21, 2024 Jun 26, 2018 N/A· v4 7.8 HIGH· v3 6.8 MEDIUM· v2 Untrusted search path vulnerability in the installer of Visual Studio Code allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
CVE-2018-0596 1Microsoft 1Visual Studio Community Nov 21, 2024 Jun 26, 2018 N/A· v4 7.8 HIGH· v3 6.8 MEDIUM· v2 Untrusted search path vulnerability in the installer of Visual Studio Community allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
CVE-2018-0595 1Microsoft 1Skype Nov 21, 2024 Jun 26, 2018 N/A· v4 7.8 HIGH· v3 6.8 MEDIUM· v2 Untrusted search path vulnerability in the installer of Skype for Windows allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
CVE-2018-0594 1Microsoft 1Skype Nov 21, 2024 Jun 26, 2018 N/A· v4 7.8 HIGH· v3 6.8 MEDIUM· v2 Untrusted search path vulnerability in Skype for Windows allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
CVE-2018-0593 1Microsoft 1Onedrive Nov 21, 2024 Jun 26, 2018 N/A· v4 7.8 HIGH· v3 6.8 MEDIUM· v2 Untrusted search path vulnerability in the installer of Microsoft OneDrive allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
CVE-2018-0592 1Microsoft 1Onedrive Nov 21, 2024 Jun 26, 2018 N/A· v4 7.8 HIGH· v3 6.8 MEDIUM· v2 Untrusted search path vulnerability in Microsoft OneDrive allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
CVE-2018-0563 1Ntt East 2Flet's Virus Clear Easy Setup & Application Tool Flet's Virus Clear V6 Easy Setup & Application Tool Nov 21, 2024 Jun 26, 2018 N/A· v4 7.8 HIGH· v3 9.3 HIGH· v2 Untrusted search path vulnerability in the installer of FLET'S VIRUS CLEAR Easy Setup & Application Tool ver.13.0 and earlier versions and FLET'S VIRUS CLEAR v6 Easy Setup & Application Tool ver.13.0 and earlier versions...Show more Untrusted search path vulnerability in the installer of FLET'S VIRUS CLEAR Easy Setup & Application Tool ver.13.0 and earlier versions and FLET'S VIRUS CLEAR v6 Easy Setup & Application Tool ver.13.0 and earlier versions allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.Show less
CVE-2018-1000201 1Ruby Ffi Project 1Ruby Ffi Nov 21, 2024 Jun 22, 2018 N/A· v4 7.8 HIGH· v3 6.8 MEDIUM· v2 ruby-ffi version 1.9.23 and earlier has a DLL loading issue which can be hijacked on Windows OS, when a Symbol is used as DLL name instead of a String This vulnerability appears to have been fixed in v1.9.24 and later.
CVE-2017-7755 1Mozilla 2Firefox Thunderbird Nov 25, 2025 Jun 11, 2018 N/A· v4 7.8 HIGH· v3 6.8 MEDIUM· v2 The Firefox installer on Windows can be made to load malicious DLL files stored in the same directory as the installer when it is run. This allows privileged execution if the installer is run with elevated privileges. No...Show more The Firefox installer on Windows can be made to load malicious DLL files stored in the same directory as the installer when it is run. This allows privileged execution if the installer is run with elevated privileges. Note: This attack only affects Windows operating systems. Other operating systems are unaffected. This vulnerability affects Firefox < 54, Firefox ESR < 52.2, and Thunderbird < 52.2.Show less
CVE-2018-6514 1Puppet 1Puppet Jun 17, 2026 Jun 11, 2018 N/A· v4 7.8 HIGH· v3 6.8 MEDIUM· v2 In Puppet Agent 1.10.x prior to 1.10.13, Puppet Agent 5.3.x prior to 5.3.7, Puppet Agent 5.5.x prior to 5.5.2, Facter on Windows is vulnerable to a DLL preloading attack, which could lead to a privilege escalation.
CVE-2018-6513 1Puppet 2Puppet Puppet Enterprise Jun 17, 2026 Jun 11, 2018 N/A· v4 8.8 HIGH· v3 6.5 MEDIUM· v2 Puppet Enterprise 2016.4.x prior to 2016.4.12, Puppet Enterprise 2017.3.x prior to 2017.3.7, Puppet Enterprise 2018.1.x prior to 2018.1.1, Puppet Agent 1.10.x prior to 1.10.13, Puppet Agent 5.3.x prior to 5.3.7, and Pupp...Show more Puppet Enterprise 2016.4.x prior to 2016.4.12, Puppet Enterprise 2017.3.x prior to 2017.3.7, Puppet Enterprise 2018.1.x prior to 2018.1.1, Puppet Agent 1.10.x prior to 1.10.13, Puppet Agent 5.3.x prior to 5.3.7, and Puppet Agent 5.5.x prior to 5.5.2, were vulnerable to an attack where an unprivileged user on Windows agents could write custom facts that can escalate privileges on the next puppet run. This was possible through the loading of shared libraries from untrusted paths.Show less
CVE-2018-7884 1Displaylink 1Core Software Cleaner Jun 17, 2026 Jun 5, 2018 N/A· v4 7.8 HIGH· v3 9.3 HIGH· v2 An issue was discovered in DisplayLink Core Software Cleaner Application 8.2.1956. When the drivers are updated to a newer version, the product launches a process as SYSTEM to uninstall the old version: cl_1956.exe is ru...Show more An issue was discovered in DisplayLink Core Software Cleaner Application 8.2.1956. When the drivers are updated to a newer version, the product launches a process as SYSTEM to uninstall the old version: cl_1956.exe is run as SYSTEM on the %systemroot%\Temp folder, where any user can write a DLL (e.g., version.dll) to perform DLL Hijacking and elevate privileges to SYSTEM.Show less
CVE-2018-11551 1Nch 1Axon Pbx Nov 21, 2024 Jun 1, 2018 N/A· v4 7.8 HIGH· v3 9.3 HIGH· v2 AXON PBX 2.02 contains a DLL hijacking vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary code on a targeted system. The vulnerability exists because a DLL file is loaded by 'pbxsetup...Show more AXON PBX 2.02 contains a DLL hijacking vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary code on a targeted system. The vulnerability exists because a DLL file is loaded by 'pbxsetup.exe' improperly.Show less
CVE-2018-10650 1Citrix 1Xenmobile Server Nov 21, 2024 May 23, 2018 N/A· v4 7.8 HIGH· v3 6.8 MEDIUM· v2 There is an Insufficient Path Validation Vulnerability in Citrix XenMobile Server 10.8 before RP2 and 10.7 before RP3.

Previous 1...222324...33 Next