CVEdetails.com the ultimate security vulnerability data source
(e.g.: CVE-2009-1234 or 2010-1234 or 20101234)
Log In   Register
  Take a third party risk management course for FREE
Vulnerability Feeds & WidgetsNew   

Security Vulnerabilities Related To CWE-428

CVSS Scores Greater Than: 0   1   2   3   4   5   6   7   8   9  
Press ESC to close
# CVE ID CWE ID # of Exploits Vulnerability Type(s) Publish Date Update Date Score Gained Access Level Access Complexity Authentication Conf. Integ. Avail.
1 CVE-2023-31747 428 2023-05-23 2023-05-31
0.0
 None ??? ??? ??? ??? ??? ???
Wondershare Filmora 12 (Build 12.2.1.2088) was discovered to contain an unquoted service path vulnerability via the component NativePushService. This vulnerability allows attackers to launch processes with elevated privileges.
2 CVE-2023-27386 428 2023-05-10 2023-05-19
0.0
 None ??? ??? ??? ??? ??? ???
Uncontrolled search path in some Intel(R) Pathfinder for RISC-V software may allow an authenticated user to potentially enable escalation of privilege via local access.
3 CVE-2023-27298 428 2023-05-10 2023-05-19
0.0
 None ??? ??? ??? ??? ??? ???
Uncontrolled search path in the WULT software maintained by Intel(R) before version 1.0.0 (commit id 592300b) may allow an unauthenticated user to potentially enable escalation of privilege via network access.
4 CVE-2023-24671 428 Exec Code 2023-03-16 2023-03-22
0.0
 None ??? ??? ??? ??? ??? ???
VX Search v13.8 and v14.7 was discovered to contain an unquoted service path vulnerability which allows attackers to execute arbitrary commands at elevated privileges via a crafted executable file.
5 CVE-2023-22282 428 2023-04-11 2023-04-18
0.0
 None ??? ??? ??? ??? ??? ???
WAB-MAT Ver.5.0.0.8 and earlier starts another program with an unquoted file path. Since a registered Windows service path contains spaces and are unquoted, if a malicious executable is placed on a certain path, the executable may be executed with the privilege of the Windows service.
6 CVE-2023-2644 428 2023-05-11 2023-05-23
0.0
 None ??? ??? ??? ??? ??? ???
A vulnerability, which was classified as problematic, has been found in DigitalPersona FPSensor 1.0.0.1. This issue affects some unknown processing of the file C:\Program Files (x86)\FPSensor\bin\DpHost.exe. The manipulation leads to unquoted search path. Attacking locally is a requirement. The identifier VDB-228773 was assigned to this vulnerability.
7 CVE-2023-2417 428 2023-04-29 2023-05-08
0.0
 None ??? ??? ??? ??? ??? ???
A vulnerability was found in ks-soft Advanced Host Monitor up to 12.56 and classified as problematic. Affected by this issue is some unknown functionality of the file C:\Program Files (x86)\HostMonitor\RMA-Win\rma_active.exe. The manipulation leads to unquoted search path. It is possible to launch the attack on the local host. Upgrading to version 12.60 is able to address this issue. It is recommended to upgrade the affected component. VDB-227714 is the identifier assigned to this vulnerability.
8 CVE-2023-2331 428 2023-04-27 2023-05-08
0.0
 None ??? ??? ??? ??? ??? ???
Unquoted service Path or Element vulnerability in 42Gears Surelock Windows SureLock Service (NixService.Exe) on Windows application will allows to insert arbitrary code into the service. This issue affects Surelock Windows : from 2.3.12 through 2.40.0.
9 CVE-2023-0887 428 2023-02-17 2023-03-07
0.0
 None ??? ??? ??? ??? ??? ???
A vulnerability was found in phjounin TFTPD64-SE 4.64 and classified as critical. This issue affects some unknown processing of the file tftpd64_svc.exe. The manipulation leads to unquoted search path. An attack has to be approached locally. The associated identifier of this vulnerability is VDB-221351.
10 CVE-2022-46662 428 2022-12-21 2023-01-04
0.0
 None ??? ??? ??? ??? ??? ???
Roxio Creator LJB starts another program with an unquoted file path. Since a registered Windows service path contains spaces and are unquoted, if a malicious executable is placed on a certain path, the executable may be executed with the privilege of the Windows service. The affected product and versions are as follows: Roxio Creator LJB version number 12.2 build number 106B62B, version number 12.2 build number 106B63A, version number 12.2 build number 106B69A, version number 12.2 build number 106B71A, and version number 12.2 build number 106B74A)
11 CVE-2022-44264 428 2023-01-26 2023-02-02
0.0
 None ??? ??? ??? ??? ??? ???
Dentsply Sirona Sidexis <= 4.3 is vulnerable to Unquoted Service Path.
12 CVE-2022-43474 428 2023-05-10 2023-05-23
0.0
 None ??? ??? ??? ??? ??? ???
Uncontrolled search path for the DSP Builder software installer before version 22.4 for Intel(R) FPGAs Pro Edition may allow an authenticated user to potentially enable escalation of privilege via local access.
13 CVE-2022-41693 428 2023-05-10 2023-05-23
0.0
 None ??? ??? ??? ??? ??? ???
Uncontrolled search path in the Intel(R) Quartus(R) Prime Pro edition software before version 22.3 may allow an authenticated user to potentially enable escalation of privilege via local access.
14 CVE-2022-39959 428 2022-10-07 2022-10-11
0.0
 None ??? ??? ??? ??? ??? ???
Panini Everest Engine 2.0.4 allows unprivileged users to create a file named Everest.exe in the %PROGRAMDATA%\Panini folder. This leads to privilege escalation because a service, running as SYSTEM, uses the unquoted path of %PROGRAMDATA%\Panini\Everest Engine\EverestEngine.exe and therefore a Trojan horse %PROGRAMDATA%\Panini\Everest.exe may be executed instead of the intended vendor-supplied EverestEngine.exe file.
15 CVE-2022-38101 428 2023-05-10 2023-05-22
0.0
 None ??? ??? ??? ??? ??? ???
Uncontrolled search path in some Intel(R) NUC Chaco Canyon BIOS update software before version iFlashV Windows 5.13.00.2105 may allow an authenticated user to potentially enable escalation of privilege via local access.
16 CVE-2022-37197 428 2022-11-18 2022-11-29
0.0
 None ??? ??? ??? ??? ??? ???
IOBit IOTransfer V4 is vulnerable to Unquoted Service Path.
17 CVE-2022-36384 428 2022-11-11 2022-11-16
0.0
 None ??? ??? ??? ??? ??? ???
Unquoted search path in the installer software for some Intel(r) NUC Kit Wireless Adapter drivers for Windows 10 before version 22.40 may allow an authenticated user to potentially enable escalation of privilege via local access.
18 CVE-2022-36344 428 2022-08-16 2022-08-23
0.0
 None ??? ??? ??? ??? ??? ???
An unquoted search path vulnerability exists in 'JustSystems JUST Online Update for J-License' bundled with multiple products for corporate users as in Ichitaro through Pro5 and others. Since the affected product starts another program with an unquoted file path, a malicious file may be executed with the privilege of the Windows service if it is placed in a certain path. Affected products are bundled with the following product series: Office and Office Integrated Software, ATOK, Hanako, JUST PDF, Shuriken, Homepage Builder, JUST School, JUST Smile Class, JUST Smile, JUST Frontier, JUST Jump, and Tri-De DetaProtect.
19 CVE-2022-35899 428 2022-07-21 2022-10-06
0.0
 None ??? ??? ??? ??? ??? ???
There is an unquoted service path in ASUSTeK Aura Ready Game SDK service (GameSDK.exe) 1.0.0.4. This might allow a local user to escalate privileges by creating a %PROGRAMFILES(X86)%\ASUS\GameSDK.exe file.
20 CVE-2022-35292 428 +Priv 2022-09-13 2022-10-01
0.0
 None ??? ??? ??? ??? ??? ???
In SAP Business One application when a service is created, the executable path contains spaces and isn’t enclosed within quotes, leading to a vulnerability known as Unquoted Service Path which allows a user to gain SYSTEM privileges. If the service is exploited by adversaries, it can be used to gain privileged permissions on a system or network leading to high impact on Confidentiality, Integrity, and Availability.
21 CVE-2022-34848 428 2023-05-10 2023-05-22
0.0
 None ??? ??? ??? ??? ??? ???
Uncontrolled search path for the Intel(R) NUC Pro Software Suite before version 2.0.0.3 may allow an authenticated user to potentially enable escalation of privilege via local access.
22 CVE-2022-33920 428 Exec Code 2022-10-12 2022-10-14
0.0
 None ??? ??? ??? ??? ??? ???
Dell GeoDrive, versions prior to 2.2, contains an Unquoted File Path vulnerability. A low privilege attacker could potentially exploit this vulnerability, leading to the execution of arbitrary code in the SYSTEM security context.
23 CVE-2022-31591 428 +Priv 2022-07-12 2022-07-16
4.6
 None Local Low Not required Partial Partial Partial
SAP BusinessObjects BW Publisher Service - versions 420, 430, uses a search path that contains an unquoted element. A local attacker can gain elevated privileges by inserting an executable file in the path of the affected service
24 CVE-2022-29320 428 2022-05-20 2022-05-26
7.2
 None Local Low Not required Complete Complete Complete
MiniTool Partition Wizard v12.0 contains an unquoted service path which allows attackers to escalate privileges to the system level.
25 CVE-2022-27966 428 Exec Code 2022-03-31 2022-04-08
6.9
 None Local Medium Not required Complete Complete Complete
Xshell v7.0.0099 and below contains a binary hijack vulnerability which allows attackers to execute arbitrary code via a crafted .exe file.
26 CVE-2022-27965 428 Exec Code 2022-03-31 2022-04-08
6.9
 None Local Medium Not required Complete Complete Complete
Xlpd v7.0.0094 and below contains a binary hijack vulnerability which allows attackers to execute arbitrary code via a crafted .exe file.
27 CVE-2022-27964 428 Exec Code 2022-03-31 2022-04-08
6.9
 None Local Medium Not required Complete Complete Complete
Xmanager v7.0.0096 and below contains a binary hijack vulnerability which allows attackers to execute arbitrary code via a crafted .exe file.
28 CVE-2022-27963 428 Exec Code 2022-03-31 2022-04-08
6.9
 None Local Medium Not required Complete Complete Complete
Xftp 7.0.0088p and below contains a binary hijack vulnerability which allows attackers to execute arbitrary code via a crafted .exe file.
29 CVE-2022-27905 428 2022-04-27 2022-05-09
9.0
 None Remote Low ??? Complete Complete Complete
In ControlUp Real-Time Agent before 8.6, an unquoted path can result in privilege escalation. An attacker would require write permissions to the root level of the OS drive (C:\) to exploit this.
30 CVE-2022-27095 428 2022-05-20 2022-05-26
7.2
 None Local Low Not required Complete Complete Complete
BattlEye v0.9 contains an unquoted service path which allows attackers to escalate privileges to the system level.
31 CVE-2022-27094 428 2022-05-20 2022-05-26
7.2
 None Local Low Not required Complete Complete Complete
Sony PlayMemories Home v6.0 contains an unquoted service path which allows attackers to escalate privileges to the system level.
32 CVE-2022-27092 428 2022-05-20 2022-05-26
7.2
 None Local Low Not required Complete Complete Complete
Private Internet Access v3.3 contains an unquoted service path which allows attackers to escalate privileges to the system level.
33 CVE-2022-27089 428 2022-04-11 2022-04-15
7.2
 None Local Low Not required Complete Complete Complete
In Fujitsu PlugFree Network <= 7.3.0.3, an Unquoted service path in PFNService.exe software allows a local attacker to potentially escalate privileges to system level.
34 CVE-2022-27088 428 2022-04-11 2022-04-15
4.6
 None Local Low Not required Partial Partial Partial
Ivanti DSM Remote <= 6.3.1.1862 is vulnerable to an unquoted service path allowing local users to launch processes with elevated privileges.
35 CVE-2022-27052 428 2022-03-31 2022-04-08
7.2
 None Local Low Not required Complete Complete Complete
FreeFtpd version 1.0.13 and below contains an unquoted service path vulnerability which allows local users to launch processes with elevated privileges.
36 CVE-2022-27050 428 2022-03-31 2022-04-08
7.2
 None Local Low Not required Complete Complete Complete
BitComet Service for Windows before version 1.8.6 contains an unquoted service path vulnerability which allows attackers to escalate privileges to the system level.
37 CVE-2022-26634 428 2022-05-20 2022-06-01
7.2
 None Local Low Not required Complete Complete Complete
HMA VPN v5.3.5913.0 contains an unquoted service path which allows attackers to escalate privileges to the system level.
38 CVE-2022-25031 428 2022-03-03 2022-03-09
6.9
 None Local Medium Not required Complete Complete Complete
Remote Desktop Commander Suite Agent before v4.8 contains an unquoted service path which allows attackers to escalate privileges to the system level.
39 CVE-2022-23909 428 2022-04-05 2022-04-12
7.2
 None Local Low Not required Complete Complete Complete
There is an unquoted service path in Sherpa Connector Service (SherpaConnectorService.exe) 2020.2.20328.2050. This might allow a local user to escalate privileges by creating a "C:\Program Files\Sherpa Software\Sherpa.exe" file.
40 CVE-2022-4429 428 DoS 2023-01-10 2023-01-13
0.0
 None ??? ??? ??? ??? ??? ???
Avira Security for Windows contains an unquoted service path which allows attackers with local administrative privileges to cause a Denial of Service. The issue was fixed with Avira Security version 1.1.78
41 CVE-2022-4258 428 +Priv 2023-01-16 2023-01-24
0.0
 None ??? ??? ??? ??? ??? ???
In multiple versions of HIMA PC based Software an unquoted Windows search path vulnerability might allow local users to gain privileges via a malicious .exe file and gain full access to the system.
42 CVE-2022-2147 428 Exec Code 2022-06-23 2022-07-01
4.6
 None Local Low Not required Partial Partial Partial
Cloudflare Warp for Windows from version 2022.2.95.0 contained an unquoted service path which enables arbitrary code execution leading to privilege escalation. The fix was released in version 2022.3.186.0.
43 CVE-2022-1697 428 2022-09-06 2022-09-16
0.0
 None ??? ??? ??? ??? ??? ???
Okta Active Directory Agent versions 3.8.0 through 3.11.0 installed the Okta AD Agent Update Service using an unquoted path. Note: To remediate this vulnerability, you must uninstall Okta Active Directory Agent and reinstall Okta Active Directory Agent 3.12.0 or greater per the documentation.
44 CVE-2022-0883 428 2022-05-18 2022-06-01
4.6
 None Local Low Not required Partial Partial Partial
SLM has an issue with Windows Unquoted/Trusted Service Paths Security Issue. All installations version 9.x.x prior to 9.20.1 should be patched.
45 CVE-2022-0357 428 2023-05-24 2023-05-31
0.0
 None ??? ??? ??? ??? ??? ???
Unquoted Search Path or Element vulnerability in the Vulnerability Scan component of Bitdefender Total Security, Bitdefender Internet Security, and Bitdefender Antivirus Plus allows an attacker to elevate privileges to SYSTEM. This issue affects: Bitdefender Total Security versions prior to 26.0.10.45. Bitdefender Internet Security versions prior to 26.0.10.45. Bitdefender Antivirus Plus versions prior to 26.0.10.45.
46 CVE-2022-0237 428 Exec Code 2022-03-17 2022-03-24
7.2
 None Local Low Not required Complete Complete Complete
Rapid7 Insight Agent versions 3.1.2.38 and earlier suffer from a privilege escalation vulnerability, whereby an attacker can hijack the flow of execution due to an unquoted argument to the runas.exe command used by the ir_agent.exe component, resulting in elevated rights and persistent access to the machine. This issue was fixed in Rapid7 Insight Agent version 3.1.3.80.
47 CVE-2021-46368 428 2022-02-17 2022-02-25
4.6
 None Local Low Not required Partial Partial Partial
TRIGONE Remote System Monitor 3.61 is vulnerable to an unquoted path service allowing local users to launch processes with elevated privileges.
48 CVE-2021-45819 428 2022-03-03 2022-03-09
7.2
 None Local Low Not required Complete Complete Complete
Wordline HIDCCEMonitorSVC before v5.2.4.3 contains an unquoted service path which allows attackers to escalate privileges to the system level.
49 CVE-2021-45460 428 DoS 2022-01-11 2022-01-18
5.5
 None Remote Low ??? None Partial Partial
A vulnerability has been identified in SICAM PQ Analyzer (All versions < V3.18). A service is started by an unquoted registry entry. As there are spaces in this path, attackers with write privilege to those directories might be able to plant executables that will run in place of the legitimate process. Attackers might achieve persistence on the system ("backdoors") or cause a denial of service.
50 CVE-2021-43463 428 2022-04-04 2022-04-11
7.2
 None Local Low Not required Complete Complete Complete
An Unquoted Service Path vulnerability exists in Ext2Fsd v0.68 via a specially crafted file in the Ext2Srv Service executable service path.
Total number of vulnerabilities : 151   Page : 1 (This Page)2 3 4
CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site. OVAL is a registered trademark of The MITRE Corporation and the authoritative source of OVAL content is MITRE's OVAL web site.
Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.