CWE-426 不可信的搜索路径 类弱点 249 条 CVE 漏洞汇总，含 AI 中文分析。
CWE-426 属于不信任搜索路径漏洞，指程序使用外部提供的路径查找关键资源，导致可能访问不受控的文件。攻击者常通过操纵环境变量或配置，将恶意程序或数据注入搜索路径，从而执行任意代码或窃取敏感信息。开发者应避免使用动态搜索路径，改用硬编码的绝对路径，或严格验证路径来源及权限，确保仅加载受信任目录下的资源，以阻断攻击链。
#define DIR "/restricted/directory" char cmd[500]; sprintf(cmd, "ls -l %480s", DIR); /* Raise privileges to those needed for accessing DIR. */ RaisePrivileges(...); system(cmd); DropPrivileges(...); ...The user sets the PATH to reference a directory under the attacker's control, such as "/my/dir/". The attacker creates a malicious program called "ls", and puts that program in /my/dir The user executes the program. When system() is executed, the shell consults the PATH to find the ls program The program finds the attacker's malicious program, "/my/dir/ls". It doesn't find "/bin/ls" because PATH does not contain "/bin/". The program executes the attacker's malicious program with the raised privileges.... String home = System.getProperty("APPHOME"); String cmd = home + INITCMD; java.lang.Runtime.getRuntime().exec(cmd); ...| CVE ID | 标题 | CVSS | 风险等级 | Published |
|---|---|---|---|---|
| CVE-2024-44103 | Ivanti Workspace Control 安全漏洞 — Workspace Control | 8.8 | High | 2024-09-10 |
| CVE-2024-45281 | SAP BusinessObjects Business Intelligence Platform 代码问题漏洞 — SAP BusinessObjects Business Intelligence Platform | 5.8 | Medium | 2024-09-10 |
| CVE-2024-6473 | Yandex Browser 安全漏洞 — Browser | 7.8AI | High AI | 2024-09-03 |
| CVE-2024-38305 | Dell SupportAssist for Home PCs 代码问题漏洞 — SupportAssist for Home PCs | 7.3 | High | 2024-08-21 |
| CVE-2024-42439 | Zoom Meeting SDK和Zoom Workplace 安全漏洞 — Zoom Workplace Desktop App for macOS and Zoom Meeting SDK for macOS | 6.5 | Medium | 2024-08-14 |
| CVE-2024-41865 | Adobe Dimension 代码问题漏洞 — Dimension | 7.8 | High | 2024-08-14 |
| CVE-2024-6975 | Cato Networks Windows SDP Client 安全漏洞 — SDP Client | 8.8 | High | 2024-07-31 |
| CVE-2024-6974 | Cato Networks Windows SDP Client 安全漏洞 — SDP Client | 8.8 | High | 2024-07-31 |
| CVE-2024-34123 | Adobe Premiere Pro 代码问题漏洞 — Premiere Pro | 7.0 | High | 2024-07-09 |
| CVE-2024-35260 | Microsoft Power Platform 安全漏洞 — Microsoft Power Platform | 8.0 | High | 2024-06-27 |
| CVE-2024-30100 | Microsoft SharePoint 代码问题漏洞 — Microsoft SharePoint Enterprise Server 2016 | 7.8 | High | 2024-06-11 |
| CVE-2024-28133 | PHOENIX CONTACT CHARX SEC-3000 1.5.1及 代码问题漏洞 — CHARX SEC-3000 | 7.8 | High | 2024-05-14 |
| CVE-2024-32019 | Netdata 安全漏洞 — netdata | 8.8 | High | 2024-04-12 |
| CVE-2024-20693 | Microsoft Windows Kernel 安全漏洞 — Windows 10 Version 1809 | 7.8 | High | 2024-04-09 |
| CVE-2024-20754 | Adobe Lightroom Desktop 代码问题漏洞 — Lightroom Desktop | 7.8 | High | 2024-03-18 |
| CVE-2024-21435 | Microsoft OLE 安全漏洞 — Windows 11 version 22H2 | 8.8 | High | 2024-03-12 |
| CVE-2024-26198 | Microsoft Exchange Server 安全漏洞 — Microsoft Exchange Server 2019 Cumulative Update 14 | 8.8 | High | 2024-03-12 |
| CVE-2024-27303 | electron-builder 安全漏洞 — electron-builder | 7.3 | High | 2024-03-06 |
| CVE-2024-25103 | AppSamvid 安全漏洞 — AppSamvid Software | 6.3 | Medium | 2024-03-06 |
| CVE-2024-24697 | Zoom Client 安全漏洞 — Zoom Clients | 7.2 | High | 2024-02-13 |
| CVE-2024-24810 | WiX Toolset 代码问题漏洞 — issues | 8.3 | High | 2024-02-07 |
| CVE-2021-4435 | Yarn 安全漏洞 — yarn | 7.7 | High | 2024-02-04 |
| CVE-2024-22410 | Creditcoin 代码问题漏洞 — creditcoin | 3.3 | Low | 2024-01-17 |
| CVE-2024-22190 | GitPython 代码问题漏洞 — GitPython | 7.8 | High | 2024-01-11 |
| CVE-2024-21325 | Microsoft Devices 安全漏洞 — Microsoft Printer Metadata Troubleshooter Tool | 7.8 | High | 2024-01-09 |
| CVE-2023-48670 | Dell SupportAssist for Home PCs 安全漏洞 — SupportAssist Client Consumer | 7.3 | High | 2023-12-22 |
| CVE-2023-43586 | Zoom VDI Client 安全漏洞 — Zoom Desktop Client for Windows, Zoom VDI Client for Windows and Zoom SDKs for Windows | 7.3 | High | 2023-12-13 |
| CVE-2023-36003 | Microsoft XAML Diagnostics 安全漏洞 — Windows 10 Version 1809 | 6.7 | Medium | 2023-12-12 |
| CVE-2023-26031 | Apache Hadoop 安全漏洞 — Apache Hadoop | 7.8 | - | 2023-11-16 |
| CVE-2023-39202 | Zoom Rooms和Zoom VDI Client 代码问题漏洞 — Zoom Rooms Client for Windows and Zoom VDI Client | 3.1 | Low | 2023-11-14 |
CWE-426（不可信的搜索路径） 是常见的弱点类别，本平台收录该类弱点关联的 249 条 CVE 漏洞。