CWE-426 Archives - CVE Vulnerability https://cvevulnerability.com/cwe_categories/cwe-426/ Sun, 26 Feb 2023 09:11:17 +0000 en-US hourly 1 https://wordpress.org/?v=7.0 https://cvevulnerability.com/wp-content/uploads/2023/02/cropped-Screenshot-2023-02-27-at-3.52.32-PM-32x32.png CWE-426 Archives - CVE Vulnerability https://cvevulnerability.com/cwe_categories/cwe-426/ 32 32 CVE-2008-5983 https://cvevulnerability.com/cve_vulnerabilities/cve-2008-5983/ Sun, 26 Feb 2023 09:11:17 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2008-5983/ Untrusted search path vulnerability in the PySys_SetArgv API function in Python 2.6 and earlier, and possibly later versions, prepends an empty string to sys.path when the argv[0] argument does not contain a path separator, which might allow local users to execute arbitrary code via a Trojan horse Python file in the current working directory.

The post CVE-2008-5983 appeared first on CVE Vulnerability.

]]> Untrusted search path vulnerability in the PySys_SetArgv API function in Python 2.6 and earlier, and possibly later versions, prepends an empty string to sys.path when the argv[0] argument does not contain a path separator, which might allow local users to execute arbitrary code via a Trojan horse Python file in the current working directory.

The post CVE-2008-5983 appeared first on CVE Vulnerability.

]]> CVE-2008-3485 https://cvevulnerability.com/cve_vulnerabilities/cve-2008-3485/ Sun, 26 Feb 2023 09:10:02 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2008-3485/ Untrusted search path vulnerability in Citrix MetaFrame Presentation Server allows local users to gain privileges via a malicious icabar.exe placed in the search path.

The post CVE-2008-3485 appeared first on CVE Vulnerability.

]]> Untrusted search path vulnerability in Citrix MetaFrame Presentation Server allows local users to gain privileges via a malicious icabar.exe placed in the search path.

The post CVE-2008-3485 appeared first on CVE Vulnerability.

]]> CVE-2008-3357 https://cvevulnerability.com/cve_vulnerabilities/cve-2008-3357/ Sun, 26 Feb 2023 09:09:58 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2008-3357/ Untrusted search path vulnerability in ingvalidpw in Ingres 2.6, Ingres 2006 release 1 (aka 9.0.4), and Ingres 2006 release 2 (aka 9.1.0) on Linux and HP-UX allows local users to gain privileges via a crafted shared library, related to a “pointer overwrite vulnerability.”

The post CVE-2008-3357 appeared first on CVE Vulnerability.

]]> Untrusted search path vulnerability in ingvalidpw in Ingres 2.6, Ingres 2006 release 1 (aka 9.0.4), and Ingres 2006 release 2 (aka 9.1.0) on Linux and HP-UX allows local users to gain privileges via a crafted shared library, related to a “pointer overwrite vulnerability.”

The post CVE-2008-3357 appeared first on CVE Vulnerability.

]]> CVE-2008-2613 https://cvevulnerability.com/cve_vulnerabilities/cve-2008-2613/ Sun, 26 Feb 2023 09:09:36 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2008-2613/ Unspecified vulnerability in the Database Scheduler component in Oracle Database 10.2.0.4 and 11.1.0.6 has unknown impact and local attack vectors. NOTE: the previous information was obtained from the Oracle July 2008 CPU. Oracle has not commented on reliable researcher claims that this is an untrusted search path issue that allows local users to gain privileges […]

The post CVE-2008-2613 appeared first on CVE Vulnerability.

]]> Unspecified vulnerability in the Database Scheduler component in Oracle Database 10.2.0.4 and 11.1.0.6 has unknown impact and local attack vectors. NOTE: the previous information was obtained from the Oracle July 2008 CPU. Oracle has not commented on reliable researcher claims that this is an untrusted search path issue that allows local users to gain privileges via a malicious (1) libclntsh.so or (2) libnnz10.so library.

The post CVE-2008-2613 appeared first on CVE Vulnerability.

]]> CVE-2008-1810 https://cvevulnerability.com/cve_vulnerabilities/cve-2008-1810/ Sun, 26 Feb 2023 09:09:11 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2008-1810/ Untrusted search path vulnerability in dbmsrv in SAP MaxDB 7.6.03.15 on Linux allows local users to gain privileges via a modified PATH environment variable.

The post CVE-2008-1810 appeared first on CVE Vulnerability.

]]> Untrusted search path vulnerability in dbmsrv in SAP MaxDB 7.6.03.15 on Linux allows local users to gain privileges via a modified PATH environment variable.

The post CVE-2008-1810 appeared first on CVE Vulnerability.

]]> CVE-2007-2027 https://cvevulnerability.com/cve_vulnerabilities/cve-2007-2027/ Sun, 26 Feb 2023 09:06:07 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2007-2027/ Untrusted search path vulnerability in the add_filename_to_string function in intl/gettext/loadmsgcat.c for Elinks 0.11.1 allows local users to cause Elinks to use an untrusted gettext message catalog (.po file) in a “../po” directory, which can be leveraged to conduct format string attacks.

The post CVE-2007-2027 appeared first on CVE Vulnerability.

]]> Untrusted search path vulnerability in the add_filename_to_string function in intl/gettext/loadmsgcat.c for Elinks 0.11.1 allows local users to cause Elinks to use an untrusted gettext message catalog (.po file) in a “../po” directory, which can be leveraged to conduct format string attacks.

The post CVE-2007-2027 appeared first on CVE Vulnerability.

]]> CVE-2018-7884 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-7884/ Sun, 26 Feb 2023 06:51:12 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-7884/ An issue was discovered in DisplayLink Core Software Cleaner Application 8.2.1956. When the drivers are updated to a newer version, the product launches a process as SYSTEM to uninstall the old version: cl_1956.exe is run as SYSTEM on the %systemroot%Temp folder, where any user can write a DLL (e.g., version.dll) to perform DLL Hijacking and […]

The post CVE-2018-7884 appeared first on CVE Vulnerability.

]]> An issue was discovered in DisplayLink Core Software Cleaner Application 8.2.1956. When the drivers are updated to a newer version, the product launches a process as SYSTEM to uninstall the old version: cl_1956.exe is run as SYSTEM on the %systemroot%Temp folder, where any user can write a DLL (e.g., version.dll) to perform DLL Hijacking and elevate privileges to SYSTEM.

The post CVE-2018-7884 appeared first on CVE Vulnerability.

]]> CVE-2018-7484 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-7484/ Sun, 26 Feb 2023 06:51:03 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-7484/ An issue was discovered in PureVPN through 5.19.4.0 on Windows. The client installation grants the Everyone group Full Control permission to the installation directory. In addition, the PureVPNService.exe service, which runs under NT AuthoritySYSTEM privileges, tries to load several dynamic-link libraries using relative paths instead of the absolute path. When not using a fully qualified […]

The post CVE-2018-7484 appeared first on CVE Vulnerability.

]]> An issue was discovered in PureVPN through 5.19.4.0 on Windows. The client installation grants the Everyone group Full Control permission to the installation directory. In addition, the PureVPNService.exe service, which runs under NT AuthoritySYSTEM privileges, tries to load several dynamic-link libraries using relative paths instead of the absolute path. When not using a fully qualified path, the application will first try to load the library from the directory from which the application is started. As the residing directory of PureVPNService.exe is writable to all users, this makes the application susceptible to privilege escalation through DLL hijacking.

The post CVE-2018-7484 appeared first on CVE Vulnerability.

]]> CVE-2018-7365 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-7365/ Sun, 26 Feb 2023 06:51:02 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-7365/ All versions up to ZXCLOUD iRAI V5.01.05 of the ZTE uSmartView product are impacted by untrusted search path vulnerability, which may allow an unauthorized user to perform unauthorized operations.

The post CVE-2018-7365 appeared first on CVE Vulnerability.

]]> All versions up to ZXCLOUD iRAI V5.01.05 of the ZTE uSmartView product are impacted by untrusted search path vulnerability, which may allow an unauthorized user to perform unauthorized operations.

The post CVE-2018-7365 appeared first on CVE Vulnerability.

]]> CVE-2018-7239 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-7239/ Sun, 26 Feb 2023 06:50:59 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-7239/ A DLL hijacking vulnerability exists in Schneider Electric’s SoMove Software and associated DTM software components in all versions prior to 2.6.2 which could allow an attacker to execute arbitrary code.

The post CVE-2018-7239 appeared first on CVE Vulnerability.

]]> A DLL hijacking vulnerability exists in Schneider Electric’s SoMove Software and associated DTM software components in all versions prior to 2.6.2 which could allow an attacker to execute arbitrary code.

The post CVE-2018-7239 appeared first on CVE Vulnerability.

]]>