Reddit NetSec

CVE Database V5

AlienVault OTX General

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

Adobe Premiere Elements version 2020v20 (and earlier) is affected by an Uncontrolled Search Path Element which could lead to Privilege Escalation. An attacker could leverage this vulnerability to obtain admin using an existing low-privileged user. Exploitation of this issue does not require user interaction.

CVE-2022-34235 is a vulnerability identified in Adobe Premiere Elements version 2020v20 and earlier, categorized as an Uncontrolled Search Path Element (CWE-427). This vulnerability arises when the software improperly handles the search path for loading executable files or libraries, allowing an attacker to influence which files are loaded by the application. Specifically, an attacker with existing low-level user privileges can exploit this flaw to escalate their privileges to administrative level without requiring any user interaction. The vulnerability is rooted in the way Adobe Premiere Elements resolves and loads resources, potentially allowing malicious code to be executed with elevated privileges if placed in a location prioritized in the search path. This type of vulnerability can lead to significant security breaches, as it undermines the integrity of the system by allowing unauthorized privilege escalation. The issue does not require user interaction, which increases the risk of automated or stealthy exploitation. Although no known exploits have been reported in the wild, the vulnerability's presence in a widely used multimedia editing product makes it a notable concern. No official patches or updates have been linked in the provided information, indicating that affected users should be vigilant and seek updates directly from Adobe or apply recommended mitigations.

Detailed information about CVE-2022-34235: Uncontrolled Search Path Element (CWE-427) in Adobe Premiere Elements affecting Adobe Premiere Elements. Get real-tim

CVE-2022-34235: Uncontrolled Search Path Element (CWE-427) in Adobe Premiere Elements - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2022-34235: Uncontrolled Search Path Element (CWE-427) in Adobe Premiere Elements

Adobe Creative Cloud Desktop version 2.7.0.13 (and earlier) is affected by an Uncontrolled Search Path Element vulnerability that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must download a malicious DLL file. The attacker has to deliver the DLL on the same folder as the installer which makes it as a high complexity attack vector.

CVE-2022-23202 is a vulnerability classified as an Uncontrolled Search Path Element (CWE-427) affecting the Adobe Creative Cloud desktop component, specifically version 2.7.0.13 and earlier. This vulnerability arises because the application improperly handles the search path for dynamic link libraries (DLLs), allowing an attacker to place a malicious DLL in the same directory as the installer. When the Creative Cloud desktop component loads DLLs, it may inadvertently load the malicious DLL instead of the legitimate one. This can lead to arbitrary code execution in the context of the current user. Exploitation requires user interaction, as the victim must download and place the malicious DLL in the targeted folder. The attack complexity is high because the attacker must deliver the malicious DLL to the same folder as the installer, which typically requires some form of social engineering or prior access to the victim's system or network. There are no known exploits in the wild reported, and no official patches or updates have been linked in the provided information. The vulnerability impacts confidentiality, integrity, and availability by potentially allowing an attacker to execute arbitrary code, which could lead to data theft, system manipulation, or disruption of services. However, the attack vector is limited by the need for user interaction and the complexity of delivering the malicious DLL to the correct location.

Detailed information about CVE-2022-23202: Uncontrolled Search Path Element (CWE-427) in Adobe Creative Cloud (desktop component) affecting Adobe Creative Cloud

CVE-2022-23202: Uncontrolled Search Path Element (CWE-427) in Adobe Creative Cloud (desktop component) - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2022-23202: Uncontrolled Search Path Element (CWE-427) in Adobe Creative Cloud (desktop component)

Adobe Dimension version 3.4 (and earlier) is affected by an Uncontrolled Search Path Element element. An unauthenticated attacker could leverage this vulnerability to achieve arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVE-2021-28595 is a vulnerability classified as an Uncontrolled Search Path Element (CWE-427) found in Adobe Dimension versions 3.4 and earlier. This vulnerability arises when the software improperly handles the search path for executable files or libraries, allowing an attacker to influence which files are loaded during the execution process. Specifically, an unauthenticated attacker can exploit this flaw by crafting a malicious file that, when opened by a victim using Adobe Dimension, causes arbitrary code execution in the context of the current user. The attack requires user interaction, meaning the victim must actively open the malicious file for the exploit to succeed. The vulnerability does not require prior authentication, increasing the risk if a malicious file is distributed via email, file sharing, or other means. However, there are no known exploits in the wild reported to date, and Adobe has not published an official patch or update addressing this issue as of the provided information. The vulnerability impacts the confidentiality, integrity, and availability of the affected system by potentially allowing attackers to execute arbitrary code, which could lead to data theft, system manipulation, or further compromise. The uncontrolled search path element issue typically involves the software loading malicious DLLs or executables from untrusted directories, which can be leveraged to escalate privileges or persist within the system. Given that Adobe Dimension is a 3D design and rendering tool primarily used by creative professionals, the attack surface is somewhat limited to users within creative industries or organizations utilizing this software for design workflows.

Detailed information about CVE-2021-28595: Uncontrolled Search Path Element (CWE-427) in Adobe Dimension affecting Adobe Dimension. Get real-time updates, techn

CVE-2021-28595: Uncontrolled Search Path Element (CWE-427) in Adobe Dimension - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2021-28595: Uncontrolled Search Path Element (CWE-427) in Adobe Dimension

Adobe After Effects version 18.1 (and earlier) is affected by an Uncontrolled Search Path element vulnerability. An unauthenticated attacker could exploit this to to plant custom binaries and execute them with System permissions. Exploitation of this issue requires user interaction.

CVE-2021-28570 is a vulnerability classified under CWE-427 (Uncontrolled Search Path Element) affecting Adobe After Effects version 18.1 and earlier. This vulnerability arises when the application improperly handles the search path for executable binaries, allowing an attacker to influence which binaries are loaded and executed by the system. Specifically, an unauthenticated attacker can exploit this flaw by planting malicious binaries in locations that are searched by After Effects during its execution. When the application subsequently loads these binaries, the malicious code is executed with SYSTEM-level privileges, which is the highest level of privilege on Windows systems. However, exploitation requires user interaction, meaning the victim must perform some action such as opening a crafted project or file that triggers the vulnerable code path. No known public exploits have been reported in the wild, and Adobe has not published an official patch or mitigation guidance at the time of this report. The vulnerability poses a significant risk because it can lead to full system compromise, allowing attackers to execute arbitrary code, install persistent malware, or manipulate system configurations. The uncontrolled search path element issue typically stems from the application searching for DLLs or executables in directories that are writable or influenced by untrusted users, enabling DLL hijacking or binary planting attacks. Given that After Effects is widely used in creative industries, media production, and advertising, the vulnerability could be leveraged to target high-value organizations or individuals involved in these sectors.

Detailed information about CVE-2021-28570: Uncontrolled Search Path Element (CWE-427) in Adobe After Effects affecting Adobe After Effects. Get real-time update

CVE-2021-28570: Uncontrolled Search Path Element (CWE-427) in Adobe After Effects - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2021-28570: Uncontrolled Search Path Element (CWE-427) in Adobe After Effects

Adobe Robohelp version 2020.0.3 (and earlier) is affected by an uncontrolled search path element vulnerability that could lead to privilege escalation. An attacker with admin permissions to write to the file system could leverage this vulnerability to escalate privileges.

CVE-2021-21070 is a vulnerability classified under CWE-427 (Uncontrolled Search Path Element) affecting Adobe RoboHelp versions 2020.0.3 and earlier. This vulnerability arises when the software improperly handles the search path for executable files or libraries, allowing an attacker with administrative permissions to write to the file system to influence the path from which executable code or libraries are loaded. By placing malicious files in a location that is searched before the legitimate ones, the attacker can cause the system to execute their code with elevated privileges, effectively escalating their privileges beyond their original access level. This type of vulnerability is particularly dangerous because it leverages the trust the system places in the search path order and can lead to unauthorized code execution with high privileges. The vulnerability requires that the attacker already has administrative permissions to write to the file system, which limits the initial attack vector but still poses a significant risk if such access is obtained. No public exploits are known in the wild, and Adobe has not provided a patch link, indicating that remediation may require manual mitigation or updates from Adobe. The vulnerability was publicly disclosed in April 2021 and has been enriched by CISA, highlighting its relevance for cybersecurity monitoring.

Detailed information about CVE-2021-21070: Uncontrolled Search Path Element (CWE-427) in Adobe RoboHelp affecting Adobe RoboHelp. Get real-time updates, technic

CVE-2021-21070: Uncontrolled Search Path Element (CWE-427) in Adobe RoboHelp - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2021-21070: Uncontrolled Search Path Element (CWE-427) in Adobe RoboHelp

Adobe Captivate 2019 version 11.5.1.499 (and earlier) is affected by an uncontrolled search path element vulnerability that could lead to privilege escalation. An attacker with permissions to write to the file system could leverage this vulnerability to escalate privileges.

CVE-2021-21011 is a vulnerability classified as an uncontrolled search path element (CWE-427) found in Adobe Captivate 2019, specifically version 11.5.1.499 and earlier. This vulnerability arises when the software improperly handles the search path for executable files or libraries, allowing an attacker to influence which files are loaded during execution. In this case, an attacker who already has permissions to write to the file system can place malicious executables or libraries in a location that Adobe Captivate will prioritize when searching for dependencies or executables. This can lead to privilege escalation, where the attacker can execute code with higher privileges than initially granted. The vulnerability does not require user interaction beyond the attacker having write access to the file system, and it does not require authentication beyond that. No known exploits have been reported in the wild, and no official patches or updates have been linked in the provided information. The vulnerability was publicly disclosed in January 2021, with Adobe as the vendor and Captivate as the affected product. The uncontrolled search path element vulnerability is a common security weakness that can be exploited to escalate privileges by hijacking the execution flow of an application through malicious path manipulation.

Detailed information about CVE-2021-21011: Uncontrolled Search Path Element (CWE-427) in Adobe Captivate affecting Adobe Captivate. Get real-time updates, techn

CVE-2021-21011: Uncontrolled Search Path Element (CWE-427) in Adobe Captivate - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2021-21011: Uncontrolled Search Path Element (CWE-427) in Adobe Captivate

Adobe Animate version 21.0 (and earlier) is affected by an uncontrolled search path element that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVE-2021-21008 is a vulnerability classified under CWE-427 (Uncontrolled Search Path Element) affecting Adobe Animate versions 21.0 and earlier. This vulnerability arises because Adobe Animate improperly controls the search path used to locate executable files or libraries during its operation. An attacker can exploit this weakness by tricking a user into opening a maliciously crafted Animate file. When the file is opened, the application may load and execute malicious code from an attacker-controlled location instead of the intended legitimate resources. This leads to arbitrary code execution within the context of the current user, meaning the attacker gains the same privileges as the user running Adobe Animate. Exploitation requires user interaction, specifically opening a malicious file, and there are no known exploits in the wild as of the publication date. The vulnerability does not have an official CVSS score but is rated as medium severity by the vendor. The lack of a patch link suggests that remediation may require updating to a later version of Adobe Animate beyond 21.0 or applying vendor-provided mitigations. The vulnerability's root cause is the failure to securely handle the search path, allowing an attacker to influence which executable or library is loaded during the application's runtime.

Detailed information about CVE-2021-21008: Uncontrolled Search Path Element (CWE-427) in Adobe Animate affecting Adobe Animate. Get real-time updates, technical

CVE-2021-21008: Uncontrolled Search Path Element (CWE-427) in Adobe Animate - Live Threat Intelligence - Threat Radar | OffSeq.com

CVE-2021-21008: Uncontrolled Search Path Element (CWE-427) in Adobe Animate

Adobe Illustrator version 25.0 (and earlier) is affected by an uncontrolled search path element that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.

CVE-2021-21007 is a vulnerability identified in Adobe Illustrator versions 25.0 and earlier, classified under CWE-427: Uncontrolled Search Path Element. This vulnerability arises when the application improperly handles the search path for loading resources or executables, allowing an attacker to influence the path from which code or libraries are loaded. Specifically, an attacker can craft a malicious Illustrator file that, when opened by a user, causes Illustrator to load and execute arbitrary code in the context of the current user. The exploitation requires user interaction, as the victim must open a maliciously crafted file. The vulnerability does not require elevated privileges or prior authentication, but the attack surface is limited to users who open such files. No known exploits have been reported in the wild as of the publication date. The impact is primarily on the confidentiality and integrity of the affected system, as arbitrary code execution could lead to data theft, manipulation, or further compromise. Availability impact is possible but less likely unless the payload specifically targets system stability. The vulnerability is medium severity, reflecting the need for user interaction and the scope limited to the current user's privileges. Since Adobe Illustrator is widely used in creative industries, the vulnerability could be leveraged in targeted attacks involving malicious files distributed via email, file sharing, or compromised websites.

Detailed information about CVE-2021-21007: Uncontrolled Search Path Element (CWE-427) in Adobe Illustrator affecting Adobe Illustrator. Get real-time updates, t

Title	Severity	Type	Source	Date

Threats Tagged 'uncontrolled-search-path-element-cwe-427'

Filter Threats

Threats Tagged 'uncontrolled-search-path-element-cwe-427'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility