CVE-2023-22818

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Multiple DLL Search Order Hijack vulnerabilities were addressed in the SanDisk Security Installer for Windows that could allow attackers with local access to execute arbitrary code by executing the installer in the same folder as the malicious DLL. This can lead to the execution of arbitrary code with the privileges of the vulnerable application or obtain a certain level of persistence on the compromised host.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-427

Affected software

No affected versions have been published.

Timeline

Published: Nov 15, 2023
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2023

CVE-2023-228194.9An uncontrolled resource consumption vulnerability issue that could arise by sending crafted requests to a service to consume a large amount CVE-2023-22826.5Improper access control in the Web Login listener in Devolutions Remote Desktop Manager 2023.1.22 and earlier on Windows allows an authentic CVE-2023-22836.5A vulnerability was found in libssh, where the authentication check of the connecting client can be bypassed in the`pki_verify_data_signatur CVE-2023-228327.5The ExtractCCDAAttributes Processor in Apache NiFi 1.2.0 through 1.19.1 does not restrict XML External Entity references. Flow configuratio CVE-2023-228336.5Palantir Foundry deployments running Lime2 versions between 2.519.0 and 2.532.0 were vulnerable a bug that allowed authenticated users withi CVE-2023-228344.3The Contour Service was not checking that users had permission to create an analysis for a given dataset. This could allow an attacker to cl CVE-2023-228357.7A security defect was identified that enabled a user of Foundry Issues to perform a Denial of Service attack by submitting malformed data in CVE-2023-228365.4In cases where a multi-tenant stack user is operating Foundry’s Linter service, and the user changes a group name from the default value, th CVE-2023-228385.4Cross-site scripting vulnerability in Product List Screen and Product Detail Screen of EC-CUBE 4.0.0 to 4.0.6-p2, EC-CUBE 4.1.0 to 4.1.2-p1,CVE-2023-228397.5On BIG-IP versions 17.0.x before 17.0.0.2, 16.1.x before 16.1.3.3, 15.1.x before 15.1.8.1, 14.1.x before 14.1.5.3, and all version of 13.1.x CVE-2023-22844.3The WP Activity Log Premium plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the CVE-2023-228405.5Improper neutralization in software for the Intel(R) oneVPL GPU software before version 22.6.5 may allow an authenticated user to potentiall