Emerson ValveLink code-related vulnerabilities

Emerson ValveLink is a suite of digital valve configuration and diagnostic software from Emerson Electric USA. A code issue vulnerability exists in Emerson ValveLink that stems from an improperly controlled resource search path that could lead to unintended behavior...

CVE-2025-48496: Uncontrolled Search Path Element

Emerson ValveLink products use a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors...

CVE-2025-48496 Emerson ValveLink Products Uncontrolled Search Path Element

Emerson ValveLink products use a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors...

CVE-2025-48496

CVE-2025-48496 affects Emerson ValveLink products and describes an improper handling of resource search paths: fixed or controlled search paths may include locations under attacker control. Public documents confirm ValveLink as the affected software and cite the underlying issue as an uncontrolle...

CVE-2025-48496 Emerson ValveLink Products Uncontrolled Search Path Element

Emerson ValveLink products use a fixed or controlled search path to find resources, but one or more locations in that path can be under the control of unintended actors...

CVE-2025-46334

Git GUI allows you to use the Git source control management tools via a GUI. A malicious repository can ship versions of sh.exe or typical textconv filter programs such as astextplain. Due to the unfortunate design of Tcl on Windows, the search path when looking for an executable always includes...

PT-2025-29181 · Emerson · Valvelink

Name of the Vulnerable Software and Affected Versions: Emerson ValveLink products affected versions not specified Description: Emerson ValveLink products utilize a fixed or controlled search path for resource location. However, one or more locations within this path may be controllable by...

CVE-2025-46334: Improper Neutralization of Special Elements used in an OS Command

Git GUI allows you to use the Git source control management tools via a GUI. A malicious repository can ship versions of sh.exe or typical textconv filter programs such as astextplain. Due to the unfortunate design of Tcl on Windows, the search path when looking for an executable always includes...

Apache Tomcat Insecure Search Path

The vulnerability of the Apache Tomcat software is related to the use of an insecure path search mechanism. Exploiting this vulnerability allows an attacker to execute arbitrary code...

CVE-2025-47422: Incorrect Privilege Assignment

Advanced Installer before 22.6 has an uncontrolled search path element local privilege escalation vulnerability. When running as SYSTEM in certain configurations, Advanced Installer looks in standard-user writable locations for non-existent binaries and executes them as SYSTEM. A low-privileged...

Advanced Installer security vulnerabilities

Advanced Installer is a packaged software from Advanced Installer open source. A security vulnerability exists in versions of Advanced Installer prior to 22.6, which stems from improper control of the search path element and may result in local elevation of privilege...

GLSA-202506-05 : GTK+ 3: Search path vulnerability

The remote host is affected by the vulnerability described in GLSA-202506-05 GTK+ 3: Search path vulnerability A vulnerability has been discovered in GTK+ 3. Please review the CVE identifiers referenced below for details. Tenable has extracted the preceding description block directly from the...

CVE-2025-49144 Notepad++ Privilege Escalation in Installer via Uncontrolled Executable Search Path

Notepad++ is a free and open-source source code editor. In versions 8.8.1 and prior, a privilege escalation vulnerability exists in the Notepad++ v8.8.1 installer that allows unprivileged users to gain SYSTEM-level privileges through insecure executable search paths. An attacker could use social...

CVE-2025-49144 Notepad++ Privilege Escalation in Installer via Uncontrolled Executable Search Path

Notepad++ is a free and open-source source code editor. In versions 8.8.1 and prior, a privilege escalation vulnerability exists in the Notepad++ v8.8.1 installer that allows unprivileged users to gain SYSTEM-level privileges through insecure executable search paths. An attacker could use social...

CVE-2025-49487

An uncontrolled search path vulnerability in the Trend Micro Worry-Free Business Security Services WFBSS agent could have allowed an attacker with physical access to a machine to execute arbitrary code on affected installations. An attacker must have had physical access to the target system in...

CVE-2025-49158

An uncontrolled search path vulnerability in the Trend Micro Apex One security agent could allow a local attacker to escalation privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this...

BIT-TOMCAT-2025-49124 Apache Tomcat: exe side-loading via icalcs.exe in Tomcat installer for Windows

Untrusted Search Path vulnerability in Apache Tomcat installer for Windows. During installation, the Tomcat installer for Windows used icacls.exe without specifying a full path. This issue affects Apache Tomcat: from 11.0.0 through 11.0.7, from 10.1.0 through 10.1.41, from 9.0.23 through 9.0.105...

Microsoft .NET Visual Studio Code Execution

The vulnerability of the Microsoft .NET software platform and the Microsoft Visual Studio development environment is related to the use of an insecure search path. Exploiting this vulnerability allows a malicious actor to execute arbitrary code...

CVE-2024-24916: Uncontrolled Search Path Element

Untrusted DLLs in the installer's directory may be loaded and executed, leading to potentially arbitrary code execution with the installer's privileges admin...

CVE-2025-49124

Untrusted Search Path vulnerability in Apache Tomcat installer for Windows. During installation, the Tomcat installer for Windows used icacls.exe without specifying a full path. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.7, from 10.1.0 through 10.1.41, from 9.0.23 through...