Weaknesses of type CWE-427

922 results

Caminho de busca ou elemento não controlado

A aplicação procura por bibliotecas, configurações ou outros recursos em diretórios sem validar adequadamente quais caminhos ela está usando, permitindo que um atacante injete uma versão maliciosa em um local que será encontrado primeiro. Isso acontece porque a ordem ou composição do caminho de busca não é explicitamente controlada.

Example

Um programa Java com classpath que inclui o diretório atual (.) antes de caminhos do sistema; um atacante coloca uma classe maliciosa no diretório de trabalho e ela é carregada em vez da legítima. Ou um script que procura por um arquivo de configuração em múltiplas pastas sem especificar o caminho absoluto, sendo enganado por um arquivo plantado em /tmp.

How to mitigate

Use caminhos absolutos explícitos em vez de relativos; remova diretórios inseguros (como o atual) do caminho de busca; valide a origem e integridade de recursos carregados (checksums, assinaturas); implemente listas de permitidos para diretórios confiáveis.

CVE-2021-1240MEDIUMCisco Proximity Desktop for Windows DLL Hijacking VulnerabilityEPSS 1.0%CVE-2024-41817HIGHArbitrary Code Execution in `AppImage` version `ImageMagick`EPSS 0.9%CVE-2019-5629HIGHRapid7 Insight Agent, version 2.6.3 and prior, suffers from a local privilege escalation due to an uncontrolled DLL search path. SpecificallEPSS 0.9%CVE-2023-23554HIGHUncontrolled search path element vulnerability exists in pg_ivm versions prior to 1.5.1. When refreshing an IMMV, pg_ivm executes functions EPSS 0.9%CVE-2025-29817MEDIUMMicrosoft Power Automate Desktop Information Disclosure VulnerabilityEPSS 0.9%CVE-2017-14029—An Uncontrolled Search Path Element issue was discovered in Trihedral VTScada 11.3.03 and prior. The program will execute specially crafted EPSS 0.9%CVE-2025-49155HIGHAn uncontrolled search path vulnerability in the Trend Micro Apex One Data Loss Prevention module could allow an attacker to inject maliciouEPSS 0.9%CVE-2024-20338HIGHA vulnerability in the ISE Posture (System Scan) module of Cisco Secure Client for Linux could allow an authenticated, local attacker to eleEPSS 0.9%CVE-2021-20047—SonicWall Global VPN client version 4.10.6 (32-bit and 64-bit) and earlier have a DLL Search Order Hijacking vulnerability. Successful exploEPSS 0.9%CVE-2022-38745HIGHApache OpenOffice: Empty entry in Java class pathEPSS 0.9%CVE-2021-28581HIGHAdobe Creative Cloud Desktop uncontrolled search path element vulnerability could lead to local privilege escalationEPSS 0.9%CVE-2023-53959HIGHFileZilla Client 3.63.1 DLL Hijacking via Missing TextShaping.dllEPSS 0.9%CVE-2019-6546—GE Communicator, all versions prior to 4.0.517, allows an attacker to place malicious files within the working directory of the program, whiEPSS 0.8%CVE-2023-44438HIGHAshlar-Vellum Argon Uncontrolled Search Path Element Remote Code Execution VulnerabilityEPSS 0.8%CVE-2022-25969—The installer of WPS Office Version 10.8.0.6186 insecurely load VERSION.DLL (or some other DLLs), allowing an attacker to execute arbitrary EPSS 0.8%CVE-2023-44439HIGHAshlar-Vellum Xenon Uncontrolled Search Path Element Remote Code Execution VulnerabilityEPSS 0.8%CVE-2023-44440HIGHAshlar-Vellum Lithium Uncontrolled Search Path Element Remote Code Execution VulnerabilityEPSS 0.8%CVE-2022-26081—The installer of WPS Office Version 10.8.0.5745 insecurely load shcore.dll, allowing an attacker to execute arbitrary code with the privilegEPSS 0.8%CVE-2026-65093CRITICALNVIDIA OpenShell for Linux contains a vulnerability where an attacker could cause a sandbox escape. A successful exploit of this vulnerabiliEPSS 0.8%CVE-2023-3252MEDIUMArbitrary File WriteEPSS 0.8%