CWE-426

{
  "affected": [
    {
      "package": {
        "ecosystem": "npm",
        "name": "app-builder-lib"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "24.13.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2024-27303"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-426",
      "CWE-427"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2024-03-04T20:42:45Z",
    "nvd_published_at": "2024-03-06T19:15:08Z",
    "severity": "HIGH"
  },
  "details": "### Impact\nWindows-Only: The NSIS installer makes a system call to open cmd.exe via NSExec in the `.nsh` installer script. NSExec by default searches the current directory of where the installer is located before searching `PATH`. This means that if an attacker can place a malicious executable file named cmd.exe in the same folder as the installer, the installer will run the malicious file.\n\n### Patches\nFixed in https://github.com/electron-userland/electron-builder/pull/8059\n\n### Workarounds\nNone, it executes at the installer-level before the app is present on the system, so there\u0027s no way to check if it exists in a current installer.\n\n### References\nhttps://cwe.mitre.org/data/definitions/426.html\nhttps://cwe.mitre.org/data/definitions/427",
  "id": "GHSA-r4pf-3v7r-hh55",
  "modified": "2024-03-06T21:36:08Z",
  "published": "2024-03-04T20:42:45Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/electron-userland/electron-builder/security/advisories/GHSA-r4pf-3v7r-hh55"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-27303"
    },
    {
      "type": "WEB",
      "url": "https://github.com/electron-userland/electron-builder/pull/8059"
    },
    {
      "type": "WEB",
      "url": "https://github.com/electron-userland/electron-builder/commit/8f4acff3c2d45c1cb07779bb3fe79644408ee387"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/electron-userland/electron-builder"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "electron-builder\u0027s NSIS installer - execute arbitrary code on the target machine (Windows only)"
}

{
  "affected": [],
  "aliases": [
    "CVE-2019-5539"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-426"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-12-23T20:15:00Z",
    "severity": "MODERATE"
  },
  "details": "VMware Workstation (15.x prior to 15.5.1) and Horizon View Agent (7.10.x prior to 7.10.1 and 7.5.x prior to 7.5.4) contain a DLL hijacking vulnerability due to insecure loading of a DLL by Cortado Thinprint. Successful exploitation of this issue may allow attackers with normal user privileges to escalate their privileges to administrator on a Windows machine where Workstation or View Agent is installed.",
  "id": "GHSA-r6qv-pq43-h5wg",
  "modified": "2022-05-24T17:04:56Z",
  "published": "2022-05-24T17:04:56Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5539"
    },
    {
      "type": "WEB",
      "url": "https://www.vmware.com/security/advisories/VMSA-2019-0023.html"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2017-12480"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-426"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2017-08-06T04:29:00Z",
    "severity": "HIGH"
  },
  "details": "Sandboxie installer 5071703 has a DLL Hijacking or Unsafe DLL Loading Vulnerability via a Trojan horse dwmapi.dll or profapi.dll file in an AppData\\Local\\Temp directory.",
  "id": "GHSA-r758-hjvg-hgjc",
  "modified": "2025-04-20T03:42:08Z",
  "published": "2022-05-17T02:14:12Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-12480"
    },
    {
      "type": "WEB",
      "url": "https://medium.com/%40BaYinMin/cve-2017-12480-sandboxie-installer-dll-hijacking-or-unsafe-dll-loading-vulnerability-41ad0562f41"
    },
    {
      "type": "WEB",
      "url": "https://medium.com/@BaYinMin/cve-2017-12480-sandboxie-installer-dll-hijacking-or-unsafe-dll-loading-vulnerability-41ad0562f41"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2017-10859"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-426"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2017-09-15T17:29:00Z",
    "severity": "HIGH"
  },
  "details": "Untrusted search path vulnerability in \"i-filter 6.0 installer\" timestamp of code signing is before 23 Aug 2017 (JST) allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.",
  "id": "GHSA-r78w-fw9g-p7rw",
  "modified": "2025-04-20T03:45:22Z",
  "published": "2022-05-17T00:51:05Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-10859"
    },
    {
      "type": "WEB",
      "url": "https://jvn.jp/en/jp/JVN75929834/index.html"
    },
    {
      "type": "WEB",
      "url": "http://www.daj.jp/cs/info/2017/0912"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2021-28246"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-426"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2021-03-26T08:15:00Z",
    "severity": "HIGH"
  },
  "details": "** UNSUPPORTED WHEN ASSIGNED ** CA eHealth Performance Manager through 6.3.2.12 is affected by Privilege Escalation via a Dynamically Linked Shared Object Library. A regular user must create a malicious library in the writable RPATH, to be dynamically linked when the emtgtctl2 executable is run. The code in the library will be executed as the ehealth user. NOTE: This vulnerability only affects products that are no longer supported by the maintainer.",
  "id": "GHSA-r7r2-rwr9-c3gj",
  "modified": "2024-03-21T03:34:04Z",
  "published": "2022-05-24T17:45:34Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-28246"
    },
    {
      "type": "WEB",
      "url": "https://n4nj0.github.io/advisories/ca-ehealth-performance-manager"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2017-10825"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-426"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2017-11-02T15:29:00Z",
    "severity": "HIGH"
  },
  "details": "Untrusted search path vulnerability in Installer of Flets Easy Setup Tool Ver1.2.0 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.",
  "id": "GHSA-r7xp-5xhg-3g8w",
  "modified": "2025-04-20T03:47:58Z",
  "published": "2022-05-17T00:22:31Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2017-10825"
    },
    {
      "type": "WEB",
      "url": "https://jvn.jp/en/jp/JVN97243511/278948/index.html"
    },
    {
      "type": "WEB",
      "url": "http://flets-w.com/topics/setup_tool_vulnerability"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2010-4833"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-426"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2011-09-06T15:55:00Z",
    "severity": "HIGH"
  },
  "details": "Untrusted search path vulnerability in modules/engines/ms-windows/xp_theme.c in GTK+ before 2.24.0 allows local users to gain privileges via a Trojan horse uxtheme.dll file in the current working directory, a different vulnerability than CVE-2010-4831.",
  "id": "GHSA-r8j5-mmxc-rxw9",
  "modified": "2022-05-17T05:33:20Z",
  "published": "2022-05-17T05:33:20Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2010-4833"
    },
    {
      "type": "WEB",
      "url": "http://git.gnome.org/browse/gtk+/commit/modules/engines/ms-windows/xp_theme.c?h=gtk-2-24\u0026id=d6e11a97e318158f5d210a0476870dfe14ed95e6"
    },
    {
      "type": "WEB",
      "url": "http://secunia.com/advisories/45815"
    },
    {
      "type": "WEB",
      "url": "http://www.securityfocus.com/bid/49449"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2019-19689"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-426",
      "CWE-427"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-12-18T20:15:00Z",
    "severity": "MODERATE"
  },
  "details": "Trend Micro HouseCall for Home Networks (versions below 5.3.0.1063) could be exploited via a DLL Hijack related to a vulnerability on the packer that the program uses.",
  "id": "GHSA-r8j8-6m99-m797",
  "modified": "2022-05-24T17:04:02Z",
  "published": "2022-05-24T17:04:02Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-19689"
    },
    {
      "type": "WEB",
      "url": "https://esupport.trendmicro.com/en-us/home/pages/technical-support/1124034.aspx"
    },
    {
      "type": "WEB",
      "url": "https://helpcenter.trendmicro.com/en-us/article/TMKA-21674"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

{
  "affected": [],
  "aliases": [
    "CVE-2019-17093"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-426"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2019-10-23T17:15:00Z",
    "severity": "HIGH"
  },
  "details": "An issue was discovered in Avast antivirus before 19.8 and AVG antivirus before 19.8. A DLL Preloading vulnerability allows an attacker to implant %WINDIR%\\system32\\wbemcomn.dll, which is loaded into a protected-light process (PPL) and might bypass some of the self-defense mechanisms. This affects all components that use WMI, e.g., AVGSvc.exe 19.6.4546.0 and TuneupSmartScan.dll 19.1.884.0.",
  "id": "GHSA-r8m5-8wc4-vhp3",
  "modified": "2022-05-24T16:59:44Z",
  "published": "2022-05-24T16:59:44Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-17093"
    },
    {
      "type": "WEB",
      "url": "https://safebreach.com/Post/Avast-Antivirus-AVG-Antivirus-DLL-Preloading-into-PPL-and-Potential-Abuses"
    },
    {
      "type": "WEB",
      "url": "https://safebreach.com/blog"
    }
  ],
  "schema_version": "1.4.0",
  "severity": []
}

{
  "affected": [],
  "aliases": [
    "CVE-2018-18629"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-426"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2018-12-20T23:29:00Z",
    "severity": "HIGH"
  },
  "details": "An issue was discovered in the Keybase command-line client before 2.8.0-20181023124437 for Linux. An untrusted search path vulnerability in the keybase-redirector application allows a local, unprivileged user on Linux to gain root privileges via a Trojan horse binary.",
  "id": "GHSA-r956-7c4h-fwq7",
  "modified": "2022-05-14T01:37:01Z",
  "published": "2022-05-14T01:37:01Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-18629"
    },
    {
      "type": "WEB",
      "url": "https://hackerone.com/reports/426944"
    },
    {
      "type": "WEB",
      "url": "https://blog.mirch.io/2018/12/21/cve-2018-18629-keybase-linux-privilege-escalation"
    },
    {
      "type": "WEB",
      "url": "https://keybase.io/docs/secadv/kb002"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}