CVE-2018-20341

WINMAGIC SecureDoc Disk Encryption software before 8.3 has an Unquoted Service Path vulnerability, which could allow an attacker to execute arbitrary code on a target system. If the executable is enclosed in quote tags "" then the system will know where to find it. However if the path of where th...

CVE-2019-9960

LimeSurvey up to version 3.16.1+190225 is affected by CVE-2019-9960 via the downloadZip function in application/controllers/admin/export.php, which improperly handles relative paths and enables arbitrary file download. This is described as a path-traversal vulnerability with high to critical impa...

The vulnerability of the Visual Studio C++ Redistributable installation program allows a perpetrator to execute arbitrary code.

The vulnerability of the Visual Studio C++ Redistributable software installation program is related to incorrect handling of the search path. Exploiting this vulnerability could allow an attacker to execute arbitrary code using the malicious DLL library...

CVE-2019-5921

CVE-2019-5921 affects Windows 7 and describes an untrusted search path vulnerability where a Trojan horse DLL could be loaded from the application directory, enabling arbitrary code execution when a program loads a DLL from the same directory. Root cause: DLL planting in the application directory...

Design/Logic Flaw

Untrusted search path vulnerability in Self-Extracting Archives created by UNLHA32.DLL prior to Ver 3.00 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory...

CVE-2019-5912

CVE-2019-5912 concerns the UNARJ32.DLL installer for Win32, affected in version 1.10.1.25 and earlier. The vulnerability is an untrusted/search-path issue that can allow privilege escalation via a Trojan horse DLL loaded from an unspecified directory during installation. The linked JVN entry note...

CVE-2018-16190

CVE-2018-16190 affects Micco-provided DLLs UNARJ32.DLL (Win32) ≤ v1.10.1.25, LHMelting (Win32) ≤ v1.65.3.6, and LMLzh32.DLL ≤ v2.67.1.2, with an untrusted DLL search path that allows a Trojan horse DLL to be loaded from an unspecified directory. This CWE-427/insecure DLL loading issue can permit ...

CVE-2018-16098

In some Lenovo ThinkPads, an unquoted search path vulnerability was found in various versions of the Synaptics Pointing Device driver which could allow unauthorized code execution as a low privilege user...

Design/Logic Flaw

Untrusted search path vulnerability in The installer of Windows 10 Fall Creators Update Modify module for Security Measures tool allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory...

CVE-2018-16176

The CVE-2018-16176 entry concerns the Japan Atomic Energy Agency’s Mapping Tool installer (versions 2.0.1.6 and 2.0.1.7). The root cause is an insecure DLL search path in the installer, enabling a Trojan horse DLL to be loaded from an unspecified directory. This may allow arbitrary code execution...

CVE-2018-16177

The CVE-2018-16177 issue affects the Windows 10 Fall Creators Update: Modify module for Security Measures tool, where the installer may load an attacker-controlled DLL due to a insecure DLL search path (CWE-427). This can allow arbitrary code execution with the privileges of the user invoking the...

CVE-2018-16182

CVE-2018-16182 concerns an untrusted DLL search path in the installer for MARKET SPEED, affecting Ver.16.4 and earlier. The root cause is insecure DLL loading (CWE-427) that can allow arbitrary code execution with the invoking user’s privileges. Public sources in the connected documents confirm t...

CVE-2018-1888

IBM i Access for Windows (IBM) vulnerable to CVE-2018-1888 on Windows versions 7.1 and earlier due to an untrusted search path that allows arbitrary code execution via a Trojan horse DLL in the current working directory, related to LoadLibrary. Connected IBM bulletin confirms affected release 7.1...

CVE-2018-18629

An issue was discovered in the Keybase command-line client before 2.8.0-20181023124437 for Linux. An untrusted search path vulnerability in the keybase-redirector application allows a local, unprivileged user on Linux to gain root privileges via a Trojan horse binary...

CVE-2018-7365

CVE-2018-7365 affects ZTE uSmartView prior to and including v5.01.05. The root cause is an untrusted search path, which may allow an unauthorized user to perform unauthorized operations. Public documents provided do not specify exploit details or confirmed in-the-wild use. Depending on the source...

CVE-2018-0692

CVE-2018-0692 concerns an untrusted search path vulnerability in Baidu Browser, where Baidu Browser 43.23.1000.500 and earlier can be exploited via a Trojan horse DLL located in an unspecified directory, enabling privilege escalation and arbitrary code execution with the caller’s privileges. Conn...

WUZHI CMS Cross-Site Scripting Vulnerability (CNVD-2019-09134)

WUZHI CMS is five fingers WUZHI company based on PHP and MySQL open source content management system CMS. A stored cross-site scripting vulnerability exists in index.php?m=core&f=index in WUZHI CMS 4.1.0, which can be exploited by remote attackers to inject arbitrary web script or HTML...

CVE-2018-0623

CVE-2018-0623 corresponds to a DLL search path (CWE-427) vulnerability in multiple Yayoi 17 Series products from Yayoi Co., Ltd. The flaw arises from insecure handling of DLL loading (msjet49.dll) in the affected applications, allowing an attacker to gain privileges via a Trojan horse DLL placed ...

CVE-2018-0656

The CVE-2018-0656 entry concerns the Digital Paper App installer (v1.4.0.16050 and earlier). A DLL search-path vulnerability (untrusted search path) exists in the installer, allowing privilege elevation by placing a Trojan horse DLL in an unspecified directory. Affected component: the installer f...

CVE-2018-0619

Untrusted search path vulnerability in the installer of Glarysoft Glary Utilities Glary Utilities 5.99 and earlier and Glary Utilities Pro 5.99 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory...