Unquoted Search Path or Element

The product uses a search path that contains an unquoted element, in which the element contains whitespace or other separators. This can cause the product to access resources in a parent path.

CVEs (450)

CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS
CVE-2019-6008 1Yokogawa 8Exaopc ExaplogExaquantum+5 more Jun 17, 2026 Dec 26, 2019 N/A· v4 7.8 HIGH· v3 6.8 MEDIUM· v2 An unquoted search path vulnerability in Multiple Yokogawa products for Windows (Exaopc (R1.01.00 ? R3.77.00), Exaplog (R1.10.00 ? R3.40.00), Exaquantum (R1.10.00 ? R3.02.00 and R3.15.00), Exaquantum/Batch (R1.01.00 ? R2...Show more An unquoted search path vulnerability in Multiple Yokogawa products for Windows (Exaopc (R1.01.00 ? R3.77.00), Exaplog (R1.10.00 ? R3.40.00), Exaquantum (R1.10.00 ? R3.02.00 and R3.15.00), Exaquantum/Batch (R1.01.00 ? R2.50.40), Exasmoc (all revisions), Exarqe (all revisions), GA10 (R1.01.01 ? R3.05.01), and InsightSuiteAE (R1.01.00 ? R1.06.00)) allow local users to gain privileges via a Trojan horse executable file and execute arbitrary code with eleveted privileges.Show less
CVE-2019-7487 1Sonicwall 2Sonicos Sonicos Sslvpn Nacagent Jun 17, 2026 Dec 19, 2019 N/A· v4 7.8 HIGH· v3 4.6 MEDIUM· v2 Installation of the SonicOS SSLVPN NACagent 3.5 on the Windows operating system, an autorun value is created does not put the path in quotes, so if a malicious binary by an attacker within the parent path could allow cod...Show more Installation of the SonicOS SSLVPN NACagent 3.5 on the Windows operating system, an autorun value is created does not put the path in quotes, so if a malicious binary by an attacker within the parent path could allow code execution.Show less
CVE-2019-18245 1Reliablecontrols 1Rc Licensemanager Jun 17, 2026 Dec 11, 2019 N/A· v4 7.8 HIGH· v3 7.2 HIGH· v2 Reliable Controls LicenseManager versions 3.4 and prior may allow an authenticated user to insert malicious code into the system root path, which may allow execution of code with elevated privileges of the application.
CVE-2019-7201 1Qnap 1Netbak Replicator Jun 17, 2026 Dec 4, 2019 N/A· v4 7.8 HIGH· v3 7.2 HIGH· v2 An unquoted service path vulnerability is reported to affect the service QVssService in QNAP NetBak Replicator. This vulnerability could allow an authorized but non-privileged local user to execute arbitrary code with el...Show more An unquoted service path vulnerability is reported to affect the service QVssService in QNAP NetBak Replicator. This vulnerability could allow an authorized but non-privileged local user to execute arbitrary code with elevated system privileges. QNAP have already fixed this issue in QNAP NetBak Replicator 4.5.12.1108.Show less
CVE-2019-16647 1Maxthon 1Maxthon Browser Jun 17, 2026 Oct 29, 2019 N/A· v4 7.2 HIGH· v3 9.0 HIGH· v2 Unquoted Search Path in Maxthon 5.1.0 to 5.2.7 Browser for Windows.
CVE-2019-6145 1Forcepoint 1Vpn Client Jun 17, 2026 Sep 20, 2019 N/A· v4 6.7 MEDIUM· v3 7.2 HIGH· v2 Forcepoint VPN Client for Windows versions lower than 6.6.1 have an unquoted search path vulnerability. This enables local privilege escalation to SYSTEM user. By default, only local administrators can write executables...Show more Forcepoint VPN Client for Windows versions lower than 6.6.1 have an unquoted search path vulnerability. This enables local privilege escalation to SYSTEM user. By default, only local administrators can write executables to the vulnerable directories. Forcepoint thanks Peleg Hadar of SafeBreach Labs for finding this vulnerability and for reporting it to us.Show less
CVE-2019-14685 1Trendmicro 4Antivirus + Security 2019 Internet Security 2019Maximum Security 2019+1 more Jun 17, 2026 Aug 21, 2019 N/A· v4 7.8 HIGH· v3 7.2 HIGH· v2 A local privilege escalation vulnerability exists in Trend Micro Security 2019 (v15.0) in which, if exploited, would allow an attacker to manipulate a specific product feature to load a malicious service.
CVE-2019-7590 1Johnsoncontrols 1Exacqvision Server Jun 17, 2026 Jul 19, 2019 N/A· v4 7.8 HIGH· v3 4.6 MEDIUM· v2 ExacqVision Server’s services 'exacqVisionServer', 'dvrdhcpserver' and 'mdnsresponder' have an unquoted service path. If an authenticated user is able to insert code in their system root path it potentially can be execut...Show more ExacqVision Server’s services 'exacqVisionServer', 'dvrdhcpserver' and 'mdnsresponder' have an unquoted service path. If an authenticated user is able to insert code in their system root path it potentially can be executed during the application startup. This could allow the authenticated user to elevate privileges on the system. This issue affects: Exacq Technologies, Inc. exacqVision Server 9.6; 9.8. This issue does not affect: Exacq Technologies, Inc. exacqVision Server version 9.4 and prior versions; 19.03. It is not known whether this issue affects: Exacq Technologies, Inc. exacqVision Server versions prior to 8.4.Show less
CVE-2019-8459 1Checkpoint 6Capsule Docs Standalone Client Endpoint Security ClientsEndpoint Security Server Package+3 more Jun 17, 2026 Jun 20, 2019 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Check Point Endpoint Security Client for Windows, with the VPN blade, before version E80.83, starts a process without using quotes in the path. This can cause loading of a previously placed executable with a name similar...Show more Check Point Endpoint Security Client for Windows, with the VPN blade, before version E80.83, starts a process without using quotes in the path. This can cause loading of a previously placed executable with a name similar to the parts of the path, instead of the intended one.Show less
CVE-2019-11093 1Intel 1Scs Discovery Utility Jun 17, 2026 May 17, 2019 N/A· v4 6.7 MEDIUM· v3 4.6 MEDIUM· v2 Unquoted service path in the installer for the Intel(R) SCS Discovery Utility version 12.0.0.129 and earlier may allow an authenticated user to potentially enable escalation of privilege via local access.
CVE-2018-20341 1Winmagic 1Securedoc Disk Encryption Nov 21, 2024 Apr 8, 2019 N/A· v4 7.8 HIGH· v3 4.6 MEDIUM· v2 WINMAGIC SecureDoc Disk Encryption software before 8.3 has an Unquoted Service Path vulnerability, which could allow an attacker to execute arbitrary code on a target system. If the executable is enclosed in quote tags "...Show more WINMAGIC SecureDoc Disk Encryption software before 8.3 has an Unquoted Service Path vulnerability, which could allow an attacker to execute arbitrary code on a target system. If the executable is enclosed in quote tags "" then the system will know where to find it. However if the path of where the application binary is located doesn't contain any quotes then Windows will try to find it and execute it inside every folder of this path until they reach the executable.Show less
CVE-2019-6149 1Lenovo 1Dynamic Power Reduction Jun 17, 2026 Mar 18, 2019 N/A· v4 6.7 MEDIUM· v3 7.2 HIGH· v2 An unquoted search path vulnerability was identified in Lenovo Dynamic Power Reduction Utility prior to version 2.2.2.0 that could allow a malicious user with local access to execute code with administrative privileges.
CVE-2018-16098 1Lenovo 59Synaptics Thinkpad Ultranav Driver Thiankpad L430 FirmwareThiankpad L530 Firmware+56 more Nov 21, 2024 Jan 24, 2019 N/A· v4 7.8 HIGH· v3 7.2 HIGH· v2 In some Lenovo ThinkPads, an unquoted search path vulnerability was found in various versions of the Synaptics Pointing Device driver which could allow unauthorized code execution as a low privilege user.
CVE-2017-3141 1Isc 1Bind Nov 21, 2024 Jan 16, 2019 N/A· v4 7.8 HIGH· v3 7.2 HIGH· v2 The BIND installer on Windows uses an unquoted service path which can enable a local user to achieve privilege escalation if the host file system permissions allow this. Affects BIND 9.2.6-P2->9.2.9, 9.3.2-P1->9.3.6, 9.4...Show more The BIND installer on Windows uses an unquoted service path which can enable a local user to achieve privilege escalation if the host file system permissions allow this. Affects BIND 9.2.6-P2->9.2.9, 9.3.2-P1->9.3.6, 9.4.0->9.8.8, 9.9.0->9.9.10, 9.10.0->9.10.5, 9.11.0->9.11.1, 9.9.3-S1->9.9.10-S1, 9.10.5-S1.Show less
CVE-2018-16183 1Panasonic 2System Interface Device 0021 System Interface Device 0040 Nov 21, 2024 Jan 9, 2019 N/A· v4 7.8 HIGH· v3 6.8 MEDIUM· v2 An unquoted search path vulnerability in some pre-installed applications on Panasonic PC run on Windows 7 (32bit), Windows 7 (64bit), Windows 8 (64bit), Windows 8.1 (64bit), Windows 10 (64bit) delivered in or later than...Show more An unquoted search path vulnerability in some pre-installed applications on Panasonic PC run on Windows 7 (32bit), Windows 7 (64bit), Windows 8 (64bit), Windows 8.1 (64bit), Windows 10 (64bit) delivered in or later than October 2009 allow local users to gain privileges via a Trojan horse executable file and execute arbitrary code with eleveted privileges.Show less
CVE-2018-14789 1Philips 2Intellispace Cardiovascular Xcelera Nov 21, 2024 Aug 22, 2018 N/A· v4 6.7 MEDIUM· v3 4.6 MEDIUM· v2 In Philips' IntelliSpace Cardiovascular (ISCV) products (ISCV Version 3.1 or prior and Xcelera Version 4.1 or prior), an unquoted search path or element vulnerability has been identified, which may allow an attacker to e...Show more In Philips' IntelliSpace Cardiovascular (ISCV) products (ISCV Version 3.1 or prior and Xcelera Version 4.1 or prior), an unquoted search path or element vulnerability has been identified, which may allow an attacker to execute arbitrary code and escalate their level of privileges.Show less
CVE-2018-11063 1Dell 1Wyse Management Suite Nov 21, 2024 Aug 10, 2018 N/A· v4 7.8 HIGH· v3 4.6 MEDIUM· v2 Dell WMS versions 1.1 and prior are impacted by multiple unquoted service path vulnerabilities. Affected software installs multiple services incorrectly by specifying the paths to the service executables without quotes....Show more Dell WMS versions 1.1 and prior are impacted by multiple unquoted service path vulnerabilities. Affected software installs multiple services incorrectly by specifying the paths to the service executables without quotes. This could potentially allow a low-privileged local user to execute arbitrary executables with elevated privileges.Show less
CVE-2018-3688 1Intel 1Quartus Prime Programmer And Tools Nov 21, 2024 Jul 10, 2018 N/A· v4 7.8 HIGH· v3 4.6 MEDIUM· v2 Unquoted service paths in Intel Quartus Prime Programmer and Tools in versions 15.1 - 18.0 allow a local attacker to potentially execute arbitrary code.
CVE-2018-3687 1Intel 1Quartus Ii Programmer And Tools Nov 21, 2024 Jul 10, 2018 N/A· v4 7.8 HIGH· v3 4.6 MEDIUM· v2 Unquoted service paths in Intel Quartus II Programmer and Tools in versions 11.0 - 15.0 allow a local attacker to potentially execute arbitrary code.
CVE-2018-3684 1Intel 1Quartus Ii Nov 21, 2024 Jul 10, 2018 N/A· v4 7.8 HIGH· v3 4.6 MEDIUM· v2 Unquoted service paths in Intel Quartus II in versions 11.0 - 15.0 allow a local attacker to potentially execute arbitrary code.

Previous 1...19 202122 23 Next