CWE-428 · File and Path Handling
Unquoted Search Path or Element
449CVEs
0exploited
0with a public check
2likely (EPSS 10%+)
SortMost likely exploited
449 CVEs with CWE-428 as their weakness
| CVE · most likely exploited | CVSS | EPSS | Published |
|---|---|---|---|
| CVE-2023-38408The PKCS#11 feature in ssh-agent in OpenSSH before 9.3p2 has an insufficiently trustworthy search path, leading to remote code execution if an agent is forwarded to an attacker-co…Openbsd · Openssh · CVSS 9.8 · 2023-07-20 | 9.8 | 80% | 2023-07-20 |
| CVE-2020-15261Unquoted service path vulnerability on Veyonveyon · veyon · CVSS 8 · 2020-10-19 | 8.0 | 11% | 2020-10-19 |
| CVE-2018-10619An unquoted search path or element in RSLinx Classic Versions 3.90.01 and prior and FactoryTalk Linx Gateway Versions 3.90.00 and prior may allow an authorized, but non-privileged…ICS-CERT · Rockwell Automation RSLinx Classic and FactoryTalk Linx Gateway · 2018-06-07 | – | 2.7% | 2018-06-07 |
| CVE-2019-17658An unquoted service path vulnerability in the FortiClient FortiTray component of FortiClientWindows v6.2.2 and prior allow an attacker to gain elevated privileges via the FortiCli…Fortinet · Fortinet FortiClientWindows · 2020-03-12 | – | 2.2% | 2020-03-12 |
| CVE-2015-4173Unquoted Windows search path vulnerability in the autorun value in Dell SonicWall NetExtender before 7.5.227 and 8.0.x before 8.0.238, as used in the SRA firmware before 7.5.1.2-4…Sonicwall · Netextender · 2015-08-26 | – | 2.1% | 2015-08-26 |
| CVE-2023-39464Triangle MicroWorks SCADA Data Gateway GTWWebMonitorService Unquoted Search Path Remote Code Execution VulnerabilityTriangle MicroWorks · SCADA Data Gateway · CVSS 7.2 · 2024-05-03 | 7.2 | 2.0% | 2024-05-03 |
| CVE-2019-16647Unquoted Search Path in Maxthon 5.1.0 to 5.2.7 Browser for Windows.Maxthon · Maxthon Browser · 2019-10-29 | – | 2.0% | 2019-10-29 |
| CVE-2017-13993An Uncontrolled Search Path or Element issue was discovered in i-SENS SmartLog Diabetes Management Software, Version 2.4.0 and prior versions. An uncontrolled search path element…I-Sens · i-SENS, Inc. SmartLog Diabetes Management Software · 2017-10-04 | – | 1.8% | 2017-10-04 |
| CVE-2021-31553An issue was discovered in the CheckUser extension for MediaWiki through 1.35.2. MediaWiki usernames with trailing whitespace could be stored in the cu_log database table such tha…Mediawiki · Mediawiki · 2021-04-22 | – | 1.7% | 2021-04-22 |
| CVE-2020-5147SonicWall NetExtender Windows client vulnerable to unquoted service path vulnerability, this allows a local attacker to gain elevated privileges in the host operating system. This…SonicWall · SonicWall NetExtender · 2021-01-09 | – | 1.7% | 2021-01-09 |
| CVE-2020-9292An unquoted service path vulnerability in the FortiSIEM Windows Agent component may allow an attacker to gain elevated privileges via the AoWinAgt executable service path.Fortinet · Fortinet FortiSIEMWindowsAgent · 2020-06-04 | – | 1.6% | 2020-06-04 |
| CVE-2019-18915A potential security vulnerability has been identified with certain versions of HP System Event Utility prior to version 1.4.33. This vulnerability may allow a local attacker to e…Hp · HP System Event Utility · 2020-02-12 | – | 1.5% | 2020-02-12 |
| CVE-2017-3141Windows service and uninstall paths are not quoted when BIND is installedISC · BIND 9 · CVSS 7.2 · 2019-01-16 | 7.2 | 1.4% | 2019-01-16 |
| CVE-2017-9644An Unquoted Search Path or Element issue was discovered in Automated Logic Corporation (ALC) ALC WebCTRL, i-Vu, SiteScan Web 6.5 and prior; ALC WebCTRL, SiteScan Web 6.1 and prior…Automatedlogic · Automated Logic Corporation WebCTRL, i-VU, SiteScan · 2017-08-25 | – | 1.4% | 2017-08-25 |
| CVE-2018-16183An unquoted search path vulnerability in some pre-installed applications on Panasonic PC run on Windows 7 (32bit), Windows 7 (64bit), Windows 8 (64bit), Windows 8.1 (64bit), Windo…Panasonic Corporation · Some pre-installed applications on Panasonic PC · 2019-01-09 | – | 1.3% | 2019-01-09 |
| CVE-2020-14521Mitsubishi Electric Factory Automation Engineering Products Unquoted Search Path or ElementMitsubishi Electric · C Controller Interface Module Utility · CVSS 8.3 · 2022-02-11 | 8.3 | 1.3% | 2022-02-11 |
| CVE-2019-6008An unquoted search path vulnerability in Multiple Yokogawa products for Windows (Exaopc (R1.01.00 ? R3.77.00), Exaplog (R1.10.00 ? R3.40.00), Exaquantum (R1.10.00 ? R3.02.00 and R…Yokogawa Electric Corporation · Multiple Yokogawa products for Windows · 2019-12-26 | – | 1.3% | 2019-12-26 |
| CVE-2020-27645The Inventory module of the 1E Client 5.0.0.745 doesn't handle an unquoted path when executing %PROGRAMFILES%\1E\Client\Tachyon.Performance.Metrics.exe. This may allow remote auth…1e · Client · 2020-12-29 | – | 1.2% | 2020-12-29 |
| CVE-2019-8459Check Point Endpoint Security Client for Windows, with the VPN blade, before version E80.83, starts a process without using quotes in the path. This can cause loading of a previou…Check Point · Check Point Endpoint Security Client for Windows, VPN blade · 2019-06-20 | – | 1.2% | 2019-06-20 |
| CVE-2020-27644The Inventory module of the 1E Client 5.0.0.745 doesn't handle an unquoted path when executing %PROGRAMFILES%\1E\Client\Tachyon.Performance.Metrics.exe. This may allow remote auth…1e · Client · 2020-12-29 | – | 1.2% | 2020-12-29 |
| CVE-2026-15358Path Traversal VulnerabilityZohocorp · ManageEngine OpManager · CVSS 7.5 · 2026-09-23 | 7.5 | 1.1% | 2026-09-23 |
| CVE-2023-31747Wondershare Filmora 12 (Build 12.2.1.2088) was discovered to contain an unquoted service path vulnerability via the component NativePushService. This vulnerability allows attacker…Wondershare · Filmora · CVSS 7.8 · 2023-05-23 | 7.8 | 1.1% | 2023-05-23 |
| CVE-2022-37197IOBit IOTransfer V4 is vulnerable to Unquoted Service Path.Iobit · Iotransfer · CVSS 7.8 · 2022-11-18 | 7.8 | 1.1% | 2022-11-18 |
| CVE-2022-27905In ControlUp Real-Time Agent before 8.6, an unquoted path can result in privilege escalation. An attacker would require write permissions to the root level of the OS drive (C:\) t…Controlup · Controlup · 2022-04-27 | – | 1.1% | 2022-04-27 |
| CVE-2018-4873Adobe Creative Cloud Desktop Application versions 4.4.1.298 and earlier have an exploitable Unquoted Search Path vulnerability. Successful exploitation could lead to local privile…Adobe · Creative Cloud Desktop Application 4.4.1.298 and earlier versions · 2018-05-19 | – | 1.1% | 2018-05-19 |
| CVE-2017-7180Net Monitor for Employees Pro through 5.3.4 has an unquoted service path, which allows a Security Feature Bypass of its documented "Block applications" design goal. The local atta…Eduiq · Net Monitor For Employees · 2017-06-08 | – | 1.1% | 2017-06-08 |
| CVE-2022-23909There is an unquoted service path in Sherpa Connector Service (SherpaConnectorService.exe) 2020.2.20328.2050. This might allow a local user to escalate privileges by creating a "C…Gimmal · Sherpa Connector Service · 2022-04-05 | – | 1.0% | 2022-04-05 |
| CVE-2016-15003FileZilla Client Installer uninstall.exe unquoted search pathFileZilla · Client · CVSS 6.3 · 2022-07-18 | 6.3 | 1.0% | 2022-07-18 |
| CVE-2014-5455Unquoted Windows search path vulnerability in the ptservice service prior to PrivateTunnel version 3.0 (Windows) and OpenVPN Connect version 3.1 (Windows) allows local users to ga…Openvpn · Openvpn · CVSS 5.3 · 2014-08-25 | 5.3 | 1.0% | 2014-08-25 |
| CVE-2022-35899There is an unquoted service path in ASUSTeK Aura Ready Game SDK service (GameSDK.exe) 1.0.0.4. This might allow a local user to escalate privileges by creating a %PROGRAMFILES(X8…Asus · Aura Ready Game Software Development Kit · 2022-07-21 | – | 0.9% | 2022-07-21 |
| CVE-2017-3005Adobe Photoshop versions CC 2017 (18.0.1) and earlier, CC 2015.5.1 (17.0.1) and earlier have an unquoted search path vulnerability.Adobe · Adobe Photoshop CC 2017 (18.0.1) and earlier, CC 2015.5.1 (17.0.1) and earlier. · 2017-04-12 | – | 0.9% | 2017-04-12 |
| CVE-2022-36344An unquoted search path vulnerability exists in 'JustSystems JUST Online Update for J-License' bundled with multiple products for corporate users as in Ichitaro through Pro5 and o…JustSystems Corporation · JustSystems JUST Online Update for J-License' · 2022-08-16 | – | 0.9% | 2022-08-16 |
| CVE-2021-45460A vulnerability has been identified in SICAM PQ Analyzer (All versions < V3.18). A service is started by an unquoted registry entry. As there are spaces in this path, attackers wi…Siemens · SICAM PQ Analyzer · 2022-01-11 | – | 0.9% | 2022-01-11 |
| CVE-2019-7590exacqVision Server Unquoted Service PathExacq Technologies, Inc. · exacqVision Server · CVSS 6.7 · 2019-07-19 | 6.7 | 0.8% | 2019-07-19 |
| CVE-2018-6384Unquoted Windows search path vulnerability in NSClient++ before 0.4.1.73 allows non-privileged local users to execute arbitrary code with elevated privileges on the system via a m…Nsclient · Nsclient++ · 2018-01-31 | – | 0.8% | 2018-01-31 |
| CVE-2016-6935Unquoted Windows search path vulnerability in Adobe Creative Cloud Desktop Application before 3.8.0.310 on Windows allows local users to gain privileges via a Trojan horse executa…Adobe · Creative Cloud · 2016-10-13 | – | 0.8% | 2016-10-13 |
| CVE-2017-12730An Unquoted Search Path issue was discovered in mySCADA myPRO Versions 7.0.26 and prior. Application services utilize unquoted search path elements, which could allow an attacker…Myscada · mySCADA myPRO · 2017-10-06 | – | 0.7% | 2017-10-06 |
| CVE-2019-20357A Persistent Arbitrary Code Execution vulnerability exists in the Trend Micro Security 2020 (v160 and 2019 (v15) consumer familiy of products which could potentially allow an atta…Trend Micro · Trend Micro Security (Consumer) · 2020-01-17 | – | 0.7% | 2020-01-17 |
| CVE-2016-20058Netgate AMITI Antivirus build 23.0.305 Unquoted Service Path Privilege EscalationNetgate · NETGATE AMITI Antivirus · CVSS 7.8 · 2026-04-04 | 7.8 | 0.7% | 2026-04-04 |
| CVE-2016-20057NETGATE Registry Cleaner build 16.0.205 Unquoted Service Path Privilege EscalationNetgate · NETGATE Registry Cleaner · CVSS 7.8 · 2026-04-04 | 7.8 | 0.7% | 2026-04-04 |
| CVE-2012-0945whoopsie-daisy before 0.1.26: Root user can remove arbitrary fileswhoopsie-daisy · whoopsie-daisy · 2020-01-15 | – | 0.7% | 2020-01-15 |
| CVE-2017-6015Without quotation marks, any whitespace in the file path for Rockwell Automation FactoryTalk Activation version 4.00.02 remains ambiguous, which may allow an attacker to link to o…Rockwell Automation · FactoryTalk Activation · 2018-05-11 | – | 0.7% | 2018-05-11 |
| CVE-2024-31804An unquoted service path vulnerability in Terratec DMX_6Fire USB v.1.23.0.02 allows a local attacker to escalate privileges via the Program.exe component.No vendor recorded · CVSS 6.7 · 2024-04-23 | 6.7 | 0.7% | 2024-04-23 |
| CVE-2019-6145Forcepoint VPN Client for Windows versions lower than 6.6.1 have an unquoted search path vulnerability. This enables local privilege escalation to SYSTEM user. By default, only lo…Forcepoint · Forcepoint VPN Client for Windows · 2019-09-20 | – | 0.7% | 2019-09-20 |
| CVE-2019-20362In Teradici PCoIP Agent before 19.08.1 and PCoIP Client before 19.08.3, an unquoted service path can cause execution of %PROGRAMFILES(X86)%\Teradici\PCoIP.exe instead of the inten…Teradici · Pcoip Client · 2020-01-08 | – | 0.7% | 2020-01-08 |
| CVE-2024-9287Virtual environment (venv) activation scripts don't quote pathsPython Software Foundation · CPython · CVSS 5.3 · 2024-10-22 | 5.3 | 0.6% | 2024-10-22 |
| CVE-2024-43457Windows Setup and Deployment Elevation of Privilege VulnerabilityMicrosoft · Windows 11 Version 24H2 · CVSS 7.8 · 2024-09-10 | 7.8 | 0.6% | 2024-09-10 |
| CVE-2022-27088Ivanti DSM Remote <= 6.3.1.1862 is vulnerable to an unquoted service path allowing local users to launch processes with elevated privileges.Ivanti · Dsm Remote · 2022-04-11 | – | 0.6% | 2022-04-11 |
| CVE-2017-1000475FreeSSHd 1.3.1 version is vulnerable to an Unquoted Path Service allowing local users to launch processes with elevated privileges.Freesshd · Freesshd · 2018-01-24 | – | 0.6% | 2018-01-24 |
| CVE-2024-24722An unquoted service path vulnerability in the 12d Synergy Server and File Replication Server components may allow an attacker to gain elevated privileges via the 12d Synergy Serve…12dsynergy · File Replication Server · CVSS 9.1 · 2024-02-19 | 9.1 | 0.6% | 2024-02-19 |
EPSS is the probability of exploitation in the next 30 days (FIRST). Data as of 2026-11-14.