CWE-1188 Archives - CVE Vulnerability https://cvevulnerability.com/cwe_categories/cwe-1188/ Sun, 26 Feb 2023 09:09:56 +0000 en-US hourly 1 https://wordpress.org/?v=7.0 https://cvevulnerability.com/wp-content/uploads/2023/02/cropped-Screenshot-2023-02-27-at-3.52.32-PM-32x32.png CWE-1188 Archives - CVE Vulnerability https://cvevulnerability.com/cwe_categories/cwe-1188/ 32 32 CVE-2008-3278 https://cvevulnerability.com/cve_vulnerabilities/cve-2008-3278/ Sun, 26 Feb 2023 09:09:56 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2008-3278/ frysk packages through 2008-08-05 as shipped in Red Hat Enterprise Linux 5 are built with an insecure RPATH set in the ELF header of multiple binaries in /usr/bin/f* (e.g. fcore, fcatch, fstack, fstep, …) shipped in the package. A local attacker can exploit this vulnerability by running arbitrary code as another user.

The post CVE-2008-3278 appeared first on CVE Vulnerability.

]]> frysk packages through 2008-08-05 as shipped in Red Hat Enterprise Linux 5 are built with an insecure RPATH set in the ELF header of multiple binaries in /usr/bin/f* (e.g. fcore, fcatch, fstack, fstep, …) shipped in the package. A local attacker can exploit this vulnerability by running arbitrary code as another user.

The post CVE-2008-3278 appeared first on CVE Vulnerability.

]]> CVE-2018-8014 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-8014/ Sun, 26 Feb 2023 06:51:15 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-8014/ The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable ‘supportsCredentials’ for all origins. It is expected that users of the CORS filter will have configured it appropriately for their environment rather than using it in the default […]

The post CVE-2018-8014 appeared first on CVE Vulnerability.

]]> The defaults settings for the CORS filter provided in Apache Tomcat 9.0.0.M1 to 9.0.8, 8.5.0 to 8.5.31, 8.0.0.RC1 to 8.0.52, 7.0.41 to 7.0.88 are insecure and enable ‘supportsCredentials’ for all origins. It is expected that users of the CORS filter will have configured it appropriately for their environment rather than using it in the default configuration. Therefore, it is expected that most users will not be impacted by this issue.

The post CVE-2018-8014 appeared first on CVE Vulnerability.

]]> CVE-2018-5841 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-5841/ Sun, 26 Feb 2023 06:50:29 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-5841/ dcc_curr_list is initialized with a default invalid value that is expected to be programmed by the user through a sysfs node which could lead to an invalid access in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux Kernel.

The post CVE-2018-5841 appeared first on CVE Vulnerability.

]]> dcc_curr_list is initialized with a default invalid value that is expected to be programmed by the user through a sysfs node which could lead to an invalid access in all Android releases from CAF (Android for MSM, Firefox OS for MSM, QRD Android) using the Linux Kernel.

The post CVE-2018-5841 appeared first on CVE Vulnerability.

]]> CVE-2018-5770 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-5770/ Sun, 26 Feb 2023 06:50:27 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-5770/ An issue was discovered on Tenda AC15 devices. A remote, unauthenticated attacker can make a request to /goform/telnet, creating a telnetd service on the device. This service is password protected; however, several default accounts exist on the device that are root accounts, which can be used to log in.

The post CVE-2018-5770 appeared first on CVE Vulnerability.

]]> An issue was discovered on Tenda AC15 devices. A remote, unauthenticated attacker can make a request to /goform/telnet, creating a telnetd service on the device. This service is password protected; however, several default accounts exist on the device that are root accounts, which can be used to log in.

The post CVE-2018-5770 appeared first on CVE Vulnerability.

]]> CVE-2018-3667 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-3667/ Sun, 26 Feb 2023 06:49:46 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-3667/ Installation tool IPDT (Intel Processor Diagnostic Tool) 4.1.0.24 sets permissions of installed files incorrectly, allowing for execution of arbitrary code and potential privilege escalation.

The post CVE-2018-3667 appeared first on CVE Vulnerability.

]]> Installation tool IPDT (Intel Processor Diagnostic Tool) 4.1.0.24 sets permissions of installed files incorrectly, allowing for execution of arbitrary code and potential privilege escalation.

The post CVE-2018-3667 appeared first on CVE Vulnerability.

]]> CVE-2018-3591 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-3591/ Sun, 26 Feb 2023 06:49:44 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-3591/ In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9635M, MDM9650, MDM9655, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 450, SD 615/16/SD 415, SD 625, SD 650/52, SD 820, SD 835, SD 845, SDM630, SDM636, SDM660, Snapdragon_High_Med_2016, the default build […]

The post CVE-2018-3591 appeared first on CVE Vulnerability.

]]> In Android before security patch level 2018-04-05 on Qualcomm Snapdragon Mobile and Snapdragon Wear MDM9206, MDM9607, MDM9635M, MDM9650, MDM9655, SD 210/SD 212/SD 205, SD 410/12, SD 425, SD 427, SD 430, SD 435, SD 450, SD 615/16/SD 415, SD 625, SD 650/52, SD 820, SD 835, SD 845, SDM630, SDM636, SDM660, Snapdragon_High_Med_2016, the default build configuration of deviceprogrammer in BOOT.BF.3.0 enables the flag SKIP_SECBOOT_CHECK_NOT_RECOMMENDED_BY_QUALCOMM which will open up the peek and poke commands to any memory location on the target.

The post CVE-2018-3591 appeared first on CVE Vulnerability.

]]> CVE-2018-20402 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-20402/ Sun, 26 Feb 2023 06:48:34 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-20402/ Safe Software FME Server through 2018.1 creates and enables three additional accounts in addition to the initial administrator account. The passwords to the three accounts are the same as the usernames, which are guest, user, and author. Logging in with these accounts will grant any user the default privilege roles that were also created for […]

The post CVE-2018-20402 appeared first on CVE Vulnerability.

]]> Safe Software FME Server through 2018.1 creates and enables three additional accounts in addition to the initial administrator account. The passwords to the three accounts are the same as the usernames, which are guest, user, and author. Logging in with these accounts will grant any user the default privilege roles that were also created for each of the accounts.

The post CVE-2018-20402 appeared first on CVE Vulnerability.

]]> CVE-2018-20052 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-20052/ Sun, 26 Feb 2023 06:48:26 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-20052/ An issue was discovered on Cerner Connectivity Engine (CCE) 4 devices. The user running the main CCE firmware has NOPASSWD sudo privileges to several utilities that could be used to escalate privileges to root. One example is the “sudo ln -s /tmp/script /etc/cron.hourly/script” command.

The post CVE-2018-20052 appeared first on CVE Vulnerability.

]]> An issue was discovered on Cerner Connectivity Engine (CCE) 4 devices. The user running the main CCE firmware has NOPASSWD sudo privileges to several utilities that could be used to escalate privileges to root. One example is the “sudo ln -s /tmp/script /etc/cron.hourly/script” command.

The post CVE-2018-20052 appeared first on CVE Vulnerability.

]]> CVE-2018-19275 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-19275/ Sun, 26 Feb 2023 06:48:06 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-19275/ The BluStar component in Mitel InAttend before 2.5 SP3 and CMG before 8.4 SP3 Suite Servers has a default password, which could allow remote attackers to gain unauthorized access and execute arbitrary scripts with potential impacts to the confidentiality, integrity and availability of the system.

The post CVE-2018-19275 appeared first on CVE Vulnerability.

]]> The BluStar component in Mitel InAttend before 2.5 SP3 and CMG before 8.4 SP3 Suite Servers has a default password, which could allow remote attackers to gain unauthorized access and execute arbitrary scripts with potential impacts to the confidentiality, integrity and availability of the system.

The post CVE-2018-19275 appeared first on CVE Vulnerability.

]]> CVE-2018-17906 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-17906/ Sun, 26 Feb 2023 06:47:37 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-17906/ Philips iSite and IntelliSpace PACS, iSite PACS, all versions, and IntelliSpace PACS, all versions. Default credentials and no authentication within third party software may allow an attacker to compromise a component of the system.

The post CVE-2018-17906 appeared first on CVE Vulnerability.

]]> Philips iSite and IntelliSpace PACS, iSite PACS, all versions, and IntelliSpace PACS, all versions. Default credentials and no authentication within third party software may allow an attacker to compromise a component of the system.

The post CVE-2018-17906 appeared first on CVE Vulnerability.

]]>