CVE-2018-7365

CVE-2018-7365 affects ZTE uSmartView prior to and including v5.01.05. The root cause is an untrusted search path, which may allow an unauthorized user to perform unauthorized operations. Public documents provided do not specify exploit details or confirmed in-the-wild use. Depending on the source...

CVE-2018-0692

CVE-2018-0692 concerns an untrusted search path vulnerability in Baidu Browser, where Baidu Browser 43.23.1000.500 and earlier can be exploited via a Trojan horse DLL located in an unspecified directory, enabling privilege escalation and arbitrary code execution with the caller’s privileges. Conn...

WUZHI CMS Cross-Site Scripting Vulnerability (CNVD-2019-09134)

WUZHI CMS is five fingers WUZHI company based on PHP and MySQL open source content management system CMS. A stored cross-site scripting vulnerability exists in index.php?m=core&f=index in WUZHI CMS 4.1.0, which can be exploited by remote attackers to inject arbitrary web script or HTML...

CVE-2018-0623

CVE-2018-0623 corresponds to a DLL search path (CWE-427) vulnerability in multiple Yayoi 17 Series products from Yayoi Co., Ltd. The flaw arises from insecure handling of DLL loading (msjet49.dll) in the affected applications, allowing an attacker to gain privileges via a Trojan horse DLL placed ...

CVE-2018-0656

The CVE-2018-0656 entry concerns the Digital Paper App installer (v1.4.0.16050 and earlier). A DLL search-path vulnerability (untrusted search path) exists in the installer, allowing privilege elevation by placing a Trojan horse DLL in an unspecified directory. Affected component: the installer f...

CVE-2018-0619

Untrusted search path vulnerability in the installer of Glarysoft Glary Utilities Glary Utilities 5.99 and earlier and Glary Utilities Pro 5.99 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory...

CVE-2018-0621

CVE-2018-0621 affects LOGICOOL CONNECTION UTILITY SOFTWARE prior to 2.30.9. The issue is an untrusted search path (CWE-427) that can enable privilege escalation via a malicious DLL in an unspecified directory. CNVD-2019-19054 confirms the vulnerable versions and impact; JVN entries corroborate th...

beep External Control Filename Path Vulnerability Vulnerability

beep is a command line tool for controlling the sound of speakers on Linux. A security vulnerability exists in the --device option in beep 1.3 and later versions. A local attacker can exploit this vulnerability to prohibit other users from executing arbitrary programs...

Microsoft OneDrive untrustworthy search path vulnerability

Microsoft OneDrive is a cloud backup application from Microsoft USA. The program features automatic backup of photo albums, online office and file sharing. An untrustworthy search path vulnerability exists in Microsoft OneDrive. An attacker can exploit this vulnerability with a malicious DLL in t...

CVE-2018-1000532

beep version 1.3 and up contains a External Control of File Name or Path vulnerability in --device option that can result in Local unprivileged user can inhibit execution of arbitrary programs by other users, allowing DoS. This attack appear to be exploitable via The system must allow local users...

Design/Logic Flaw

Untrusted search path vulnerability in the installer of Visual Studio Code allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory...

Design/Logic Flaw

Untrusted search path vulnerability in the installer of Visual Studio Community allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory...

CVE-2018-0594

CVE-2018-0594 describes an untrusted search path (DLL planting) vulnerability in Skype for Windows. The issue allows privilege escalation via a Trojan horse DLL placed in the same directory as the Skype executable. Affected product: Skype for Windows. Root cause: insecure DLL search path (CWE-427...

CVE-2018-0593

The CVE-2018-0593 entry affects the Microsoft OneDrive installer, which has an untrusted search path vulnerability (DLL planting) that can allow privilege escalation by placing a Trojan DLL in the installer’s directory. Root cause: insecure DLL search order in the installer. Impact described: arb...

CVE-2018-0598

The CVE-2018-0598 issue concerns self-extracting archive files created by IExpress bundled with Microsoft Windows. Affected component is the IExpress self-extracting archive mechanism, where an untrusted search path can lead to DLL planting and privilege escalation by loading a Trojan horse DLL f...

CVE-2018-12533

JBoss RichFaces 3.1.0 through 3.3.4 allows unauthenticated remote attackers to inject expression language EL expressions and execute arbitrary Java code via a /DATA/ substring in a path with an org.richfaces.renderkit.html.Paint2DResource$ImageData object, aka RF-14310...

CVE-2018-7495

In Advantech WebAccess versions V8.220170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard versions V.2.0.15 and prior, WebAccess Scada Node versions prior to 8.3.1, and WebAccess/NMS 2.0.3 and prior, an external control of file name or path vulnerability has been identified...

CVE-2018-0561

CVE-2018-0561 affects the SecureBrain PhishWall Client Internet Explorer edition installer (version 3.7.15 and earlier). The issue is an untrusted search path (CWE-427) in the installer that can be exploited to gain privileges via a Trojan horse DLL placed in an unsafe directory. Exploitation wou...

CVE-2018-2406

CVE-2018-2406 affects SAP Crystal Reports Server OEM Edition (CRSE) startup path: unquoted Windows search path leads to local directory/path traversal. Versions 4.0, 4.10, 4.20, 4.30 are affected; local privilege elevation is indicated in connected CNVD entry. The vulnerability’s CVSS notes local...

idreamsoft iCMS Physical Path Disclosure Vulnerability

iCMS is an efficient and simple content management system built with PHP and MySQL. A physical path leak vulnerability exists in idreamsoft iCMS version 7.0.7 and lower. An attacker can obtain the physical path by displaying an invalid nickname field in the core/library/weixin.class.php pathname...