CVE-2017-6051

HighCVSS 7.0/10Last modified Jun 17, 2026

Description

An Uncontrolled Search Path Element issue was discovered in BLF-Tech LLC VisualView HMI Version 9.9.14.0 and prior. The uncontrolled search path element vulnerability has been identified, which may allow an attacker to run a malicious DLL file within the search path resulting in execution of arbitrary code.

Metrics

CVSS 3.0 7.0/10CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-427

Affected software

Vendor	Product	Versions
n/a	BLF-Tech LLC VisualView HMI	BLF-Tech LLC VisualView HMI

References

http://www.securityfocus.com/bid/98031Third Party Advisory, VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-17-115-01Third Party Advisory, US Government Resource
http://www.securityfocus.com/bid/98031Third Party Advisory, VDB Entry
https://ics-cert.us-cert.gov/advisories/ICSA-17-115-01Third Party Advisory, US Government Resource

Timeline

Published: May 8, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-60523.7A Man-in-the-Middle issue was discovered in Hyundai Motor America Blue Link 3.9.5 and 3.9.4. Communication channel endpoints are not verifie CVE-2017-60536.1A Cross-Site Scripting issue was discovered in Trihedral VTScada Versions prior to 11.2.26. A cross-site scripting vulnerability may allow J CVE-2017-60547.5A Use of Hard-Coded Cryptographic Key issue was discovered in Hyundai Motor America Blue Link 3.9.5 and 3.9.4. The application uses a hard-c CVE-2017-60557.8XML external entity (XXE) vulnerability in eParakstitajs 3 before 1.3.9 and eParaksts Java lib before 2.5.13 allows remote attackers to read CVE-2017-60567.5It was discovered that a programming error in the processing of HTTPS requests in the Apache Tomcat servlet and JSP engine may result in den CVE-2017-60587.5Buffer overflow in NetRxPkt::ehdr_buf in hw/net/net_rx_pkt.c in QEMU (aka Quick Emulator), when the VLANSTRIP feature is enabled on the vmxn CVE-2017-60597.5Mod_auth_openidc.c in the Ping Identity OpenID Connect authentication module for Apache (aka mod_auth_openidc) before 2.14 allows remote att CVE-2017-60607.8Stack-based buffer overflow in jstest_main.c in mujstest in Artifex Software, Inc. MuPDF 1.10a allows remote attackers to have unspecified i CVE-2017-60614.7Cross-site scripting (XSS) vulnerability in the help component of SAP BusinessObjects Financial Consolidation 10.0.0.1933 allows remote atta CVE-2017-60628.6The "OpenID Connect Relying Party and OAuth 2.0 Resource Server" (aka mod_auth_openidc) module before 2.1.5 for the Apache HTTP Server does CVE-2017-60658.8SQL injection vulnerability in inc/lib/Control/Backend/menus.control.php in GeniXCMS through 1.0.2 allows remote authenticated users to exec CVE-2017-60668.8Subrion CMS 4.0.5 has CSRF in admin/languages/edit/1/. The attacker can perform any Edit Language action, and can optionally insert XSS via