Untrusted search path vulnerability in Fenrir Sleipnir before 2.9.5 and Grani before 4.4 allows local users to gain privileges via a Trojan horse DLL in the current working directory.
http://www.fenrir.co.jp/grani/note.html
http://www.fenrir.co.jp/blog/2010/10/sleipnirsleipnir_295.html