WaratekVRT Sign in
Reset
More filters (1)
Columns
Including CVEs outside Waratek scope✕CWE CWE-426✕
Overview 723 matches · 4 in Waratek scope · 0 protected · 6 exploited · 3 CISA KEV · 23 public PoC · 1 EPSS ≥ 0.5
723matches 4in Waratek scope0.6% 0protected0.0% 6exploited0.8% 3CISA KEV0.4% 23public PoC3.2% 1EPSS ≥ 0.50.1%
Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 4 0.6% Outside Waratek scope 1 0.1% Not applicable 718 99.3% Withdrawn CVE 0 0.0%
Critical 26 3.6% High 602 83.3% Medium 81 11.2% Low 13 1.8% None 1 0.1% Unknown 0 0.0%
blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 723 100.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 6 0.8% Working exploit published 16 2.2% Proof of concept only 72 10.0% Forecast only 0 0.0% No public exploit 629 87.0%
split by peak 140 / year
Not applicable: 718Outside Waratek scope: 1No exploit published: 4 None: 1Low: 13Medium: 81High: 602Critical: 26 not blocked: 723 No public exploit: 629Proof of concept only: 72Working exploit published: 16Exploited: 6
20081 Not applicable1 High1 not blocked1 No public exploit1 20092 Not applicable2 Medium2 not blocked2 No public exploit2 20102 Not applicable2 High1 Medium1 not blocked2 No public exploit2 20115 Not applicable5 High4 Medium1 not blocked5 No public exploit5 20124 Not applicable4 High3 Medium1 not blocked4 Exploited1 No public exploit3 20130 20141 Not applicable1 Medium1 not blocked1 No public exploit1 20153 Not applicable3 High3 not blocked3 Exploited1 Working exploit published1 No public exploit1 20168 Not applicable8 High8 not blocked8 Working exploit published2 No public exploit6 2017140 No exploit published1 Not applicable139 Critical2 High134 Medium3 Low1 not blocked140 Working exploit published4 No public exploit136 201876 Not applicable76 Critical1 High75 not blocked76 Working exploit published3 No public exploit73 201964 Not applicable64 High58 Medium6 not blocked64 Working exploit published2 No public exploit62 202055 Outside Waratek scope1 Not applicable54 Critical1 High46 Medium8 not blocked55 Working exploit published1 No public exploit54 202122 Not applicable22 Critical1 High18 Medium3 not blocked22 Proof of concept only1 No public exploit21 202222 Not applicable22 Critical3 High19 not blocked22 Exploited3 Proof of concept only2 No public exploit17 202355 Not applicable55 Critical2 High49 Medium4 not blocked55 Working exploit published1 Proof of concept only17 No public exploit37 202450 Not applicable50 Critical2 High41 Medium7 not blocked50 Exploited1 Working exploit published1 Proof of concept only6 No public exploit42 202574 No exploit published2 Not applicable72 Critical5 High46 Medium15 Low8 not blocked74 Working exploit published1 Proof of concept only19 No public exploit54 2026139 No exploit published1 Not applicable138 Critical9 High96 Medium29 Low4 None1 not blocked139 Proof of concept only27 No public exploit112
2008201020122014201620182020202220242026
723 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed. ‹ prev page 3 of 8 next ›
CVE Severity Published▾ Status Exploitation Description
CVE-2025-0733 Low 2025-01-27 Not applicable No public exploit A vulnerability, which was classified as problematic, was found in Postman up to 11.20 on Windows. This affects an unknown part in the library profapi.dll. The manipulation leads to untrusted search path. An attack has to be approached locally. The complexity of an attack is rather high. The exploitability is told to be difficult. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2025-0732 Low 2025-01-27 Not applicable No public exploit A vulnerability, which was classified as problematic, has been found in Discord up to 1.0.9177 on Windows. Affected by this issue is some unknown functionality in the library profapi.dll. The manipulation leads to untrusted search path. The attack needs to be approached locally. The complexity of an attack is rather high. The exploitation is known to be difficult. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2025-0707 High 2025-01-24 Not applicable No public exploit A vulnerability was found in Rise Group Rise Mode Temp CPU 2.1. It has been classified as critical. This affects an unknown part in the library CRYPTBASE.dll of the component Startup. The manipulation leads to untrusted search path. The attack needs to be approached locally.
CVE-2024-13524 Low 2025-01-20 Not applicable No public exploit A vulnerability has been found in obsproject OBS Studio up to 30.0.2 on Windows and classified as problematic. Affected by this vulnerability is an unknown functionality. The manipulation leads to untrusted search path. The attack needs to be approached locally. The complexity of an attack is rather high. The exploitation appears to be difficult. It is recommended to apply a patch to fix this issue. The vendor disagrees that this issue is "something worth reporting, as every attack surface requires privileged access/user compromise".
CVE-2025-0567 Low 2025-01-19 Not applicable No public exploit A vulnerability classified as problematic was found in Epic Games Launcher up to 17.2.1. This vulnerability affects unknown code in the library profapi.dll of the component Installer. The manipulation leads to untrusted search path. Attacking locally is a requirement. The complexity of an attack is rather high. The exploitation appears to be difficult.
CVE-2025-21399 High 2025-01-17 Not applicable No public exploit Microsoft Edge (Chromium-based) Update Elevation of Privilege Vulnerability
CVE-2024-55503 Low 2025-01-15 Not applicable Proof of concept only An issue in termius before v.9.9.0 allows a local attacker to execute arbitrary code via a crafted script to the DYLD_INSERT_LIBRARIES component.
CVE-2024-53407 Low 2025-01-15 Not applicable Proof of concept only In Phiewer 4.1.0, a dylib injection leads to Command Execution which allow attackers to inject dylib file potentially leading to remote control and unauthorized access to sensitive user data.
CVE-2024-48123 High 2025-01-15 Not applicable Proof of concept only An issue in the USB Autorun function of HI-SCAN 6040i Hitrax HX-03-19-I allows attackers to execute arbitrary code via uploading a crafted script from a USB device.
CVE-2020-8094 High 2025-01-15 Not applicable No public exploit An untrusted search path vulnerability in testinitsigs.exe as used in Bitdefender Antivirus Free 2020 allows a low-privilege attacker to execute code as SYSTEM via a specially crafted DLL file.
CVE-2025-21365 High 2025-01-14 Not applicable No public exploit Microsoft Office Remote Code Execution Vulnerability
CVE-2025-0459 Medium 2025-01-14 Not applicable No public exploit A vulnerability, which was classified as problematic, has been found in libretro RetroArch up to 1.19.1 on Windows. Affected by this issue is some unknown functionality in the library profapi.dll of the component Startup. The manipulation leads to untrusted search path. An attack has to be approached locally. The vendor was contacted early about this disclosure but did not respond in any way.
CVE-2024-13158 High 2025-01-14 Not applicable No public exploit An unbounded resource search path in Ivanti EPM before the 2024 January-2025 Security Update and 2022 SU6 January-2025 Security Update allows a remote authenticated attacker with admin privileges to achieve remote code execution.
CVE-2024-53866 Medium 2024-12-10 Not applicable Proof of concept only The package manager pnpm prior to version 9.15.0 seems to mishandle overrides and global cache: Overrides from one workspace leak into npm metadata saved in global cache; npm metadata from global cache affects other workspaces; and installs by default don't revalidate the data (including on first lockfile generation). This can make workspace A (even running with `ignore-scripts=true`) posion global cache and execute scripts in workspace B. Users generally expect `ignore-scripts` to be sufficient to prevent immediate code execution on install (e.g. when the tree is just repacked/bundled without executing it). Here, that expectation is broken. Global state integrity is lost via operations that one would expect to be secure, enabling subsequently running arbitrary code execution on installs. Version 9.15.0 fixes the issue. As a work-around, use separate cache and store dirs in each workspace.
CVE-2024-11454 High 2024-12-09 Not applicable No public exploit A maliciously crafted DLL file, when placed in the same directory as an RVT file could be loaded by Autodesk Revit, and execute arbitrary code in the context of the current process due to an untrusted search patch being utilized.
CVE-2024-45207 High 2024-12-04 Not applicable No public exploit DLL injection in Veeam Agent for Windows can occur if the system's PATH variable includes insecure locations. When the agent runs, it searches these directories for necessary DLLs. If an attacker places a malicious DLL in one of these directories, the Veeam Agent might load it inadvertently, allowing the attacker to execute harmful code. This could lead to unauthorized access, data theft, or disruption of services
CVE-2023-1521 High 2024-11-26 Not applicable No public exploit On Linux the sccache client can execute arbitrary code with the privileges of a local sccache server, by preloading the code in a shared library passed to LD_PRELOAD. If the server is run as root (which is the default when installing the snap package https://snapcraft.io/sccache ), this means a user running the sccache client can get root privileges.
CVE-2024-50986 High 2024-11-15 Not applicable Proof of concept only An issue in Clementine v.1.3.1 allows a local attacker to execute arbitrary code via a crafted DLL file.
CVE-2024-49515 High 2024-11-12 Not applicable No public exploit Substance3D - Painter versions 10.1.0 and earlier are affected by an Untrusted Search Path vulnerability that might allow attackers to execute arbitrary code. If the application uses a search path to locate critical resources such as programs, then an attacker could modify that search path to point to a malicious program, which the targeted application would then execute. The problem extends to any type of critical resource that the application trusts. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2024-49043 High 2024-11-12 Not applicable No public exploit Microsoft.SqlServer.XEvent.Configuration.dll Remote Code Execution Vulnerability
CVE-2024-47906 High 2024-11-12 Not applicable No public exploit Excessive binary privileges in Ivanti Connect Secure before version 22.7R2.3 (Not Applicable to 9.1Rx) and Ivanti Policy Secure before version 22.7R1.2 (Not Applicable to 9.1Rx) allows a local authenticated attacker to escalate privileges.
CVE-2024-36507 High 2024-11-12 Not applicable No public exploit A untrusted search path in Fortinet FortiClientWindows versions 7.4.0, versions 7.2.4 through 7.2.0, versions 7.0.12 through 7.0.0 allows an attacker to run arbitrary code via DLL hijacking and social engineering.
CVE-2024-7995 High 2024-11-05 Not applicable No public exploit A maliciously crafted binary file when downloaded could lead to escalation of privileges to NT AUTHORITY/SYSTEM due to an untrusted search path being utilized in the VRED Design application. Exploitation of this vulnerability may lead to code execution.
CVE-2023-32266 Medium 2024-10-16 Not applicable No public exploit Untrusted Search Path vulnerability in OpenText™ Application Lifecycle Management (ALM),Quality Center allows Code Inclusion. The vulnerability allows a user to archive a malicious DLLs on the system prior to the installation.   This issue affects Application Lifecycle Management (ALM),Quality Center: 15.00, 15.01, 15.01 P1, 15.01 P2, 15.01 P3, 15.01 P4, 15.01 P5, 15.51, 15.51 P1, 15.51 P2, 15.51 P3, 16.00, 16.01 P1.
CVE-2024-47422 High 2024-10-09 Not applicable No public exploit Adobe Framemaker versions 2020.6, 2022.4 and earlier are affected by an Untrusted Search Path vulnerability that could lead to arbitrary code execution. An attacker could exploit this vulnerability by inserting a malicious path into the search directories, which the application could unknowingly execute. This could allow the attacker to execute arbitrary code in the context of the current user. Exploitation of this issue requires user interaction.
CVE-2024-43616 High 2024-10-08 Not applicable No public exploit Microsoft Office Remote Code Execution Vulnerability
CVE-2024-43576 High 2024-10-08 Not applicable No public exploit Microsoft Office Remote Code Execution Vulnerability
CVE-2024-8733 High 2024-10-02 Not applicable No public exploit A potential security vulnerability has been identified in the HP One Agent for certain HP PC products, which might allow for escalation of privilege. HP is releasing software updates to mitigate this potential vulnerability.
CVE-2024-9325 High 2024-09-29 Not applicable No public exploit A vulnerability classified as critical has been found in Intelbras InControl up to 2.21.56. This affects an unknown part of the file C:\Program Files (x86)\Intelbras\Incontrol Cliente\incontrol_webcam\incontrol-service-watchdog.exe. The manipulation leads to unquoted search path. It is possible to launch the attack on the local host. Upgrading to version 2.21.58 is able to address this issue. It is recommended to upgrade the affected component. The vendor was informed early on 2024-08-05 about this issue. The release of a fixed version 2.21.58 was announced for the end of August 2024 but then was postponed until 2024-09-20.
CVE-2024-6769 High 2024-09-26 Not applicable Proof of concept only A DLL Hijacking caused by drive remapping combined with a poisoning of the activation cache in Microsoft Windows 10, Windows 11, Windows Server 2016, Windows Server 2019, and Windows Server 2022 allows a malicious authenticated attacker to elevate from a medium integrity process to a high integrity process without the intervention of a UAC prompt.
CVE-2024-45281 Medium 2024-09-10 Not applicable No public exploit SAP BusinessObjects Business Intelligence Platform allows a high privilege user to run client desktop applications even if some of the DLLs are not digitally signed or if the signature is broken. The attacker needs to have local access to the vulnerable system to perform DLL related tasks. This could result in a high impact on confidentiality and integrity of the application.
CVE-2024-44103 High 2024-09-10 Not applicable No public exploit DLL hijacking in the management console of Ivanti Workspace Control before version 2025.2 (10.19.0.0) allows a local authenticated attacker to escalate their privileges.
CVE-2024-6473 High 2024-09-03 Not applicable Exploited Yandex Browser for Desktop before 24.7.1.380 has a DLL Hijacking Vulnerability because an untrusted search path is used.
CVE-2024-5623 Medium 2024-08-29 Not applicable No public exploit An untrusted search path vulnerability in B&R APROL <= R 4.4-00P3 may be used by an authenticated local attacker to get other users to execute arbitrary code under their privileges.
CVE-2024-5622 High 2024-08-29 Not applicable No public exploit An untrusted search path vulnerability in the AprolConfigureCCServices of B&R APROL <= R 4.2.-07P3 and <= R 4.4-00P3 may allow an authenticated local attacker to execute arbitrary code with elevated privileges.
CVE-2024-38305 High 2024-08-21 Not applicable No public exploit Dell SupportAssist for Home PCs Installer exe version 4.0.3 contains a privilege escalation vulnerability in the installer. A local low-privileged authenticated attacker could potentially exploit this vulnerability, leading to the execution of arbitrary executables on the operating system with elevated privileges.
CVE-2024-7886 High 2024-08-16 Not applicable No public exploit A vulnerability has been found in Scooter Software Beyond Compare up to 3.3.5.15075 and classified as critical. Affected by this vulnerability is an unknown functionality in the library 7zxa.dll. The manipulation leads to uncontrolled search path. Attacking locally is a requirement. The real existence of this vulnerability is still doubted at the moment. The vendor explains that a system must be breached before exploiting this issue. They are not planning on making any changes to address it.
CVE-2024-42439 Medium 2024-08-14 Not applicable No public exploit Untrusted search path in the installer for Zoom Workplace Desktop App for macOS and Zoom Meeting SDK for macOS before 6.1.0 may allow a privileged user to conduct an escalation of privilege via local access.
CVE-2024-41865 High 2024-08-14 Not applicable No public exploit Dimension versions 3.4.11 and earlier are affected by an Untrusted Search Path vulnerability that could lead to arbitrary code execution. An attacker could exploit this vulnerability by inserting a malicious file into the search path, which the application might execute instead of the legitimate file. This could occur if the application uses a search path to locate executables or libraries. Exploitation of this issue requires user interaction.
CVE-2024-6975 High 2024-07-31 Not applicable No public exploit Cato Networks Windows SDP Client Local Privilege Escalation via openssl configuration file. This issue affects SDP Client before 5.10.34.
CVE-2024-6974 High 2024-07-31 Not applicable No public exploit Cato Networks Windows SDP Client Local Privilege Escalation via self-upgradeThis issue affects SDP Client: before 5.10.34.
CVE-2024-34123 High 2024-07-09 Not applicable No public exploit Premiere Pro versions 23.6.5, 24.4.1 and earlier are affected by an Untrusted Search Path vulnerability that could lead to arbitrary code execution. An attacker could exploit this vulnerability by inserting a malicious file into the search path, which the application might execute instead of the legitimate file. This could occur when the application uses a search path to locate executables or libraries. Exploitation of this issue requires user interaction, attack complexity is high.
CVE-2024-35260 Critical 2024-06-27 Not applicable No public exploit An authenticated attacker can exploit an untrusted search path vulnerability in Microsoft Dataverse to execute code over a network.
CVE-2024-36071 Medium 2024-06-20 Not applicable No public exploit Samsung Magician 8.0.0 on Windows allows an admin to escalate privileges by tampering with the directory and DLL files used during the installation process. This occurs because of an Untrusted Search Path.
CVE-2024-6080 High 2024-06-17 Not applicable Proof of concept only A vulnerability classified as critical was found in Intelbras InControl 2.21.56. This vulnerability affects unknown code of the component incontrolWebcam Service. The manipulation leads to unquoted search path. Local access is required to approach this attack. The exploit has been disclosed to the public and may be used. Upgrading to version 2.21.58 is able to address this issue. It is recommended to upgrade the affected component. The vendor was contacted early about this disclosure and plans to provide a solution within the next few weeks.
CVE-2024-38462 Critical 2024-06-16 Not applicable No public exploit iRODS before 4.3.2 provides an msiSendMail function with a problematic dependency on the mail binary, such as in the mailMS.cpp#L94-L106 reference.
CVE-2024-30100 High 2024-06-11 Not applicable No public exploit Microsoft SharePoint Server Remote Code Execution Vulnerability
CVE-2024-28060 High 2024-05-28 Not applicable No public exploit An issue was discovered in Apiris Kafeo 6.4.4. It permits DLL hijacking, allowing a user to trigger the execution of arbitrary code every time the product is executed.
CVE-2024-28133 High 2024-05-14 Not applicable No public exploit A local low privileged attacker can use an untrusted search path in a CHARX system utility to gain root privileges. 
CVE-2024-32019 High 2024-04-12 Not applicable Working exploit published Netdata is an open source observability tool. In affected versions the `ndsudo` tool shipped with affected versions of the Netdata Agent allows an attacker to run arbitrary programs with root permissions. The `ndsudo` tool is packaged as a `root`-owned executable with the SUID bit set. It only runs a restricted set of external commands, but its search paths are supplied by the `PATH` environment variable. This allows an attacker to control where `ndsudo` looks for these commands, which may be a path the attacker has write access to. This may lead to local privilege escalation. This vulnerability has been addressed in versions 1.45.3 and 1.45.2-169. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVE-2024-20693 High 2024-04-09 Not applicable No public exploit Windows Kernel Elevation of Privilege Vulnerability
CVE-2024-20754 High 2024-03-18 Not applicable No public exploit Lightroom Desktop versions 7.1.2 and earlier are affected by an Untrusted Search Path vulnerability that could result in arbitrary code execution in the context of the current user. If the application uses a search path to locate critical resources such as programs, then an attacker could modify that search path to point to a malicious program, which the targeted application would then execute. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2024-26198 High 2024-03-12 Not applicable No public exploit Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2024-21435 High 2024-03-12 Not applicable No public exploit Windows OLE Remote Code Execution Vulnerability
CVE-2024-27303 High 2024-03-06 Not applicable No public exploit electron-builder is a solution to package and build a ready for distribution Electron, Proton Native app for macOS, Windows and Linux. A vulnerability that only affects eletron-builder prior to 24.13.2 in Windows, the NSIS installer makes a system call to open cmd.exe via NSExec in the `.nsh` installer script. NSExec by default searches the current directory of where the installer is located before searching `PATH`. This means that if an attacker can place a malicious executable file named cmd.exe in the same folder as the installer, the installer will run the malicious file. Version 24.13.2 fixes this issue. No known workaround exists. The code executes at the installer-level before the app is present on the system, so there's no way to check if it exists in a current installer.
CVE-2024-25103 Medium 2024-03-06 Not applicable No public exploit This vulnerability exists in AppSamvid software due to the usage of vulnerable and outdated components. An attacker with local administrative privileges could exploit this by placing malicious DLLs on the targeted system. Successful exploitation of this vulnerability could allow the attacker to execute arbitrary code on the targeted system.
CVE-2024-24697 High 2024-02-14 Not applicable No public exploit Untrusted search path in some Zoom 32 bit Windows clients may allow an authenticated user to conduct an escalation of privilege via local access.
CVE-2024-24810 High 2024-02-07 Not applicable Proof of concept only WiX toolset lets developers create installers for Windows Installer, the Windows installation engine. The .be TEMP folder is vulnerable to DLL redirection attacks that allow the attacker to escalate privileges. This impacts any installer built with the WiX installer framework. This issue has been patched in version 4.0.4.
CVE-2024-23304 High 2024-02-06 Not applicable No public exploit Cybozu KUNAI for Android 3.0.20 to 3.0.21 allows a remote unauthenticated attacker to cause a denial-of-service (DoS) condition by performing certain operations.
CVE-2021-4435 High 2024-02-04 Not applicable No public exploit An untrusted search path vulnerability was found in Yarn. When a victim runs certain Yarn commands in a directory with attacker-controlled content, malicious commands could be executed in unexpected ways.
CVE-2024-22410 High 2024-01-17 Not applicable No public exploit Creditcoin is a network that enables cross-blockchain credit transactions. The Windows binary of the Creditcoin node loads a suite of DLLs provided by Microsoft at startup. If a malicious user has access to overwrite the program files directory it is possible to replace these DLLs and execute arbitrary code. It is the view of the blockchain development team that the threat posed by a hypothetical binary planting attack is minimal and represents a low-security risk. The vulnerable DLL files are from the Windows networking subsystem, the Visual C++ runtime, and low-level cryptographic primitives. Collectively these dependencies are required for a large ecosystem of applications, ranging from enterprise-level security applications to game engines, and don’t represent a fundamental lack of security or oversight in the design and implementation of Creditcoin. The blockchain team takes the stance that running Creditcoin on Windows is officially unsupported and at best should be thought of as experimental.
CVE-2024-22190 High 2024-01-11 Not applicable Proof of concept only GitPython is a python library used to interact with Git repositories. There is an incomplete fix for CVE-2023-40590. On Windows, GitPython uses an untrusted search path if it uses a shell to run `git`, as well as when it runs `bash.exe` to interpret hooks. If either of those features are used on Windows, a malicious `git.exe` or `bash.exe` may be run from an untrusted repository. This issue has been patched in version 3.1.41.
CVE-2024-21325 High 2024-01-09 Not applicable No public exploit Microsoft Printer Metadata Troubleshooter Tool Remote Code Execution Vulnerability
CVE-2023-48670 High 2023-12-22 Not applicable No public exploit Dell SupportAssist for Home PCs version 3.14.1 and prior versions contain a privilege escalation vulnerability in the installer. A local low privileged authenticated attacker may potentially exploit this vulnerability, leading to the execution of arbitrary executable on the operating system with elevated privileges.
CVE-2023-43586 High 2023-12-13 Not applicable No public exploit Path traversal in Zoom Desktop Client for Windows, Zoom VDI Client for Windows, and Zoom SDKs for Windows may allow an authenticated user to conduct an escalation of privilege via network access.
CVE-2023-36003 High 2023-12-12 Not applicable Proof of concept only XAML Diagnostics Elevation of Privilege Vulnerability
CVE-2023-26031 High 2023-11-16 Not applicable No public exploit Relative library resolution in linux container-executor binary in Apache Hadoop 3.3.1-3.3.4 on Linux allows local user to gain root privileges. If the YARN cluster is accepting work from remote (authenticated) users, this MAY permit remote users to gain root privileges. Hadoop 3.3.0 updated the " YARN Secure Containers https://hadoop.apache.org/docs/stable/hadoop-yarn/hadoop-yarn-site/SecureContainer.html " to add a feature for executing user-submitted applications in isolated linux containers. The native binary HADOOP_HOME/bin/container-executor is used to launch these containers; it must be owned by root and have the suid bit set in order for the YARN processes to run the containers as the specific users submitting the jobs. The patch " YARN-10495 https://issues.apache.org/jira/browse/YARN-10495 . make the rpath of container-executor configurable" modified the library loading path for loading .so files from "$ORIGIN/" to ""$ORIGIN/:../lib/native/". This is the a path through which libcrypto.so is located. Thus it is is possible for a user with reduced privileges to install a malicious libcrypto library into a path to which they have write access, invoke the container-executor command, and have their modified library executed as root. If the YARN cluster is accepting work from remote (authenticated) users, and these users' submitted job are executed in the physical host, rather than a container, then the CVE permits remote users to gain root privileges. The fix for the vulnerability is to revert the change, which is done in YARN-11441 https://issues.apache.org/jira/browse/YARN-11441 , "Revert YARN-10495". This patch is in hadoop-3.3.5. To determine whether a version of container-executor is vulnerable, use the readelf command. If the RUNPATH or RPATH value contains the relative path "./lib/native/" then it is at risk $ readelf -d container-executor|grep 'RUNPATH\|RPATH' 0x000000000000001d (RUNPATH)           Library runpath: [$ORIGIN/:../lib/native/] If it does not, then it is safe: $ readelf -d container-executor|grep 'RUNPATH\|RPATH' 0x000000000000001d (RUNPATH)           Library runpath: [$ORIGIN/] For an at-risk version of container-executor to enable privilege escalation, the owner must be root and the suid bit must be set $ ls -laF /opt/hadoop/bin/container-executor ---Sr-s---. 1 root hadoop 802968 May 9 20:21 /opt/hadoop/bin/container-executor A safe installation lacks the suid bit; ideally is also not owned by root. $ ls -laF /opt/hadoop/bin/container-executor -rwxr-xr-x. 1 yarn hadoop 802968 May 9 20:21 /opt/hadoop/bin/container-executor This configuration does not support Yarn Secure Containers, but all other hadoop services, including YARN job execution outside secure containers continue to work.
CVE-2023-41840 High 2023-11-14 Not applicable No public exploit A untrusted search path vulnerability in Fortinet FortiClientWindows 7.0.9 allows an attacker to perform a DLL Hijack attack via a malicious OpenSSL engine library in the search path.
CVE-2023-39202 Medium 2023-11-14 Not applicable No public exploit Untrusted search path in Zoom Rooms Client for Windows and Zoom VDI Client may allow a privileged user to conduct a denial of service via local access.
CVE-2023-36422 High 2023-11-14 Not applicable No public exploit Microsoft Windows Defender Elevation of Privilege Vulnerability
CVE-2023-36393 High 2023-11-14 Not applicable No public exploit Windows User Interface Application Core Remote Code Execution Vulnerability
CVE-2021-26738 High 2023-10-23 Not applicable No public exploit Zscaler Client Connector for macOS prior to 3.7 had an unquoted search path vulnerability via the PATH variable. A local adversary may be able to execute code with root privileges.
CVE-2023-41766 High 2023-10-10 Not applicable No public exploit Windows Client Server Run-time Subsystem (CSRSS) Elevation of Privilege Vulnerability
CVE-2023-36780 High 2023-10-10 Not applicable No public exploit Skype for Business Remote Code Execution Vulnerability
CVE-2023-36778 High 2023-10-10 Not applicable No public exploit Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2023-39201 High 2023-09-12 Not applicable No public exploit Untrusted search path in CleanZoom before file date 07/24/2023 may allow a privileged user to conduct an escalation of privilege via local access.
CVE-2023-4736 High 2023-09-02 Not applicable Proof of concept only Untrusted Search Path in GitHub repository vim/vim prior to 9.0.1833.
CVE-2023-40590 High 2023-08-28 Not applicable Proof of concept only GitPython is a python library used to interact with Git repositories. When resolving a program, Python/Windows look for the current working directory, and after that the PATH environment. GitPython defaults to use the `git` command, if a user runs GitPython from a repo has a `git.exe` or `git` executable, that program will be run instead of the one in the user's `PATH`. This is more of a problem on how Python interacts with Windows systems, Linux and any other OS aren't affected by this. But probably people using GitPython usually run it from the CWD of a repo. An attacker can trick a user to download a repository with a malicious `git` executable, if the user runs/imports GitPython from that directory, it allows the attacker to run any arbitrary commands. There is no fix currently available for windows users, however there are a few mitigations. 1: Default to an absolute path for the git program on Windows, like `C:\\Program Files\\Git\\cmd\\git.EXE` (default git path installation). 2: Require users to set the `GIT_PYTHON_GIT_EXECUTABLE` environment variable on Windows systems. 3: Make this problem prominent in the documentation and advise users to never run GitPython from an untrusted repo, or set the `GIT_PYTHON_GIT_EXECUTABLE` env var to an absolute path. 4: Resolve the executable manually by only looking into the `PATH` environment variable.
CVE-2023-41105 High 2023-08-23 Not applicable No public exploit An issue was discovered in Python 3.11 through 3.11.4. If a path containing '\0' bytes is passed to os.path.normpath(), the path will be truncated unexpectedly at the first '\0' byte. There are plausible cases in which an application would have rejected a filename for security reasons in Python 3.10.x or earlier, but that filename is no longer rejected in Python 3.11.x.
CVE-2022-43456 High 2023-08-11 Not applicable No public exploit Uncontrolled search path in some Intel(R) RST software before versions 16.8.5.1014.5, 17.11.3.1010.2, 18.7.6.1011.2 and 19.5.2.1049.5 may allow an authenticated user to potentially enable escalation of privilege via local access.
CVE-2023-29299 Medium 2023-08-10 Not applicable No public exploit Adobe Acrobat Reader versions 23.003.20244 (and earlier) and 20.005.30467 (and earlier) are affected by an Untrusted Search Path vulnerability that could lead to Application denial-of-service. An attacker could leverage this vulnerability if the default PowerShell Set-ExecutionPolicy is set to Unrestricted, making the attack complexity high. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
CVE-2023-39212 High 2023-08-08 Not applicable No public exploit Untrusted search path in Zoom Rooms for Windows before version 5.15.5 may allow an authenticated user to enable a denial of service via local access.
CVE-2023-36898 High 2023-08-08 Not applicable No public exploit Tablet Windows User Interface Application Core Remote Code Execution Vulnerability
CVE-2023-36540 High 2023-08-08 Not applicable No public exploit Untrusted search path in the installer for Zoom Desktop Client for Windows before 5.14.5 may allow an authenticated user to enable an escalation of privilege via local access.
CVE-2023-36538 High 2023-07-11 Not applicable No public exploit Improper access control in Zoom Rooms for Windows before version 5.15.0 may allow an authenticated user to enable an escalation of privilege via local access.
CVE-2023-36536 High 2023-07-11 Not applicable No public exploit Untrusted search path in the installer for Zoom Rooms for Windows before version 5.15.0 may allow an authenticated user to enable an escalation of privilege via local access.
CVE-2023-35343 High 2023-07-11 Not applicable No public exploit Windows Geolocation Service Remote Code Execution Vulnerability
CVE-2023-34119 High 2023-07-11 Not applicable No public exploit Insecure temporary file in the installer for Zoom Rooms for Windows before version 5.15.0 may allow an authenticated user to enable an escalation of privilege via local access.
CVE-2023-34145 High 2023-06-26 Not applicable No public exploit An untrusted search path vulnerability in the Trend Micro Apex One and Apex One as a Service security agent could allow a local attacker to escalate their privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. This is a similar, but not identical vulnerability as CVE-2023-34144.
CVE-2023-34144 High 2023-06-26 Not applicable No public exploit An untrusted search path vulnerability in the Trend Micro Apex One and Apex One as a Service security agent could allow a local attacker to escalate their privileges on affected installations. Please note: an attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. This is a similar, but not identical vulnerability as CVE-2023-34145.
CVE-2023-30330 Critical 2023-05-12 Not applicable Working exploit published SoftExpert (SE) Excellence Suite 2.x versions before 2.1.3 is vulnerable to Local File Inclusion in the function /se/v42300/generic/gn_defaultframe/2.0/defaultframe_filter.php.
CVE-2023-29790 High 2023-05-12 Not applicable No public exploit kodbox 1.2.x through 1.3.7 has a Sensitive Information Leakage issue.
CVE-2023-28143 High 2023-04-18 Not applicable No public exploit Qualys Cloud Agent for macOS (versions 2.5.1-75 before 3.7) installer allows a local escalation of privilege bounded only to the time of installation and only on older macOSX (macOS 10.15 and older) versions. Attackers may exploit incorrect file permissions to give them ROOT command execution privileges on the host. During the install of the PKG, a step in the process involves extracting the package and copying files to several directories. Attackers may gain writable access to files during the install of PKG when extraction of the package and copying files to several directories, enabling a local escalation of privilege.
CVE-2023-27771 High 2023-04-04 Not applicable Proof of concept only An issue found in Wondershare Technology Co.,Ltd Creative Centerr v.1.0.8 allows a remote attacker to execute arbitrary commands via the wondershareCC_setup_full10819.exe file.
CVE-2023-27770 High 2023-04-04 Not applicable No public exploit An issue found in Wondershare Technology Co.,Ltd Edraw-max v.12.0.4 allows a remote attacker to execute arbitrary commands via the edraw-max_setup_full5371.exe file.
CVE-2023-27769 High 2023-04-04 Not applicable Proof of concept only An issue found in Wondershare Technology Co.,Ltd PDF Reader v.1.0.1 allows a remote attacker to execute arbitrary commands via the pdfreader_setup_full13143.exe file.
CVE-2023-27768 High 2023-04-04 Not applicable Proof of concept only An issue found in Wondershare Technology Co.,Ltd PDFelement v9.1.1 allows a remote attacker to execute arbitrary commands via the pdfelement-pro_setup_full5239.exe file.
CVE-2023-27767 High 2023-04-04 Not applicable Proof of concept only An issue found in Wondershare Technology Co.,Ltd Dr.Fone v.12.4.9 allows a remote attacker to execute arbitrary commands via the drfone_setup_full3360.exe file.
CVE-2023-27766 High 2023-04-04 Not applicable Proof of concept only An issue found in Wondershare Technology Co.,Ltd Anireel 1.5.4 allows a remote attacker to execute arbitrary commands via the anireel_setup_full9589.exe file.
CVE-2023-27765 High 2023-04-04 Not applicable Proof of concept only An issue found in Wondershare Technology Co.,Ltd Recoverit v.10.6.3 allows a remote attacker to execute arbitrary commands via the recoverit_setup_full4134.exe file.
‹ prev page 3 of 8 next ›