CWE-123 Archives - CVE Vulnerability https://cvevulnerability.com/cwe_categories/cwe-123/ Sun, 26 Feb 2023 06:49:53 +0000 en-US hourly 1 https://wordpress.org/?v=7.0 https://cvevulnerability.com/wp-content/uploads/2023/02/cropped-Screenshot-2023-02-27-at-3.52.32-PM-32x32.png CWE-123 Archives - CVE Vulnerability https://cvevulnerability.com/cwe_categories/cwe-123/ 32 32 CVE-2018-3971 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-3971/ Sun, 26 Feb 2023 06:49:53 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-3971/ An exploitable arbitrary write vulnerability exists in the 0x2222CC IOCTL handler functionality of Sophos HitmanPro.Alert 3.7.6.744. A specially crafted IRP request can cause the driver to write data under controlled by an attacker address, resulting in memory corruption. An attacker can send IRP request to trigger this vulnerability.

The post CVE-2018-3971 appeared first on CVE Vulnerability.

]]> An exploitable arbitrary write vulnerability exists in the 0x2222CC IOCTL handler functionality of Sophos HitmanPro.Alert 3.7.6.744. A specially crafted IRP request can cause the driver to write data under controlled by an attacker address, resulting in memory corruption. An attacker can send IRP request to trigger this vulnerability.

The post CVE-2018-3971 appeared first on CVE Vulnerability.

]]> CVE-2018-16962 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-16962/ Sun, 26 Feb 2023 06:47:15 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-16962/ Webroot SecureAnywhere before 9.0.8.34 on macOS mishandles access to the driver by a process that lacks root privileges.

The post CVE-2018-16962 appeared first on CVE Vulnerability.

]]> Webroot SecureAnywhere before 9.0.8.34 on macOS mishandles access to the driver by a process that lacks root privileges.

The post CVE-2018-16962 appeared first on CVE Vulnerability.

]]> CVE-2018-15375 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-15375/ Sun, 26 Feb 2023 06:46:37 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-15375/ A vulnerability in the embedded test subsystem of Cisco IOS Software for Cisco 800 Series Industrial Integrated Services Routers could allow an authenticated, local attacker to write arbitrary values to arbitrary locations in the memory space of an affected device. The vulnerability is due to the presence of certain test commands that were intended to […]

The post CVE-2018-15375 appeared first on CVE Vulnerability.

]]> A vulnerability in the embedded test subsystem of Cisco IOS Software for Cisco 800 Series Industrial Integrated Services Routers could allow an authenticated, local attacker to write arbitrary values to arbitrary locations in the memory space of an affected device. The vulnerability is due to the presence of certain test commands that were intended to be available only in internal development builds of the affected software. An attacker could exploit this vulnerability by using these commands on an affected device. A successful exploit could allow the attacker to write arbitrary values to arbitrary locations in the memory space of the affected device.

The post CVE-2018-15375 appeared first on CVE Vulnerability.

]]> CVE-2018-15376 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-15376/ Sun, 26 Feb 2023 06:46:37 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-15376/ A vulnerability in the embedded test subsystem of Cisco IOS Software for Cisco 800 Series Industrial Integrated Services Routers could allow an authenticated, local attacker to write arbitrary values to arbitrary locations in the memory space of an affected device. The vulnerability is due to the presence of certain test commands that were intended to […]

The post CVE-2018-15376 appeared first on CVE Vulnerability.

]]> A vulnerability in the embedded test subsystem of Cisco IOS Software for Cisco 800 Series Industrial Integrated Services Routers could allow an authenticated, local attacker to write arbitrary values to arbitrary locations in the memory space of an affected device. The vulnerability is due to the presence of certain test commands that were intended to be available only in internal development builds of the affected software. An attacker could exploit this vulnerability by using these commands on an affected device. A successful exploit could allow the attacker to write arbitrary values to arbitrary locations in the memory space of the affected device.

The post CVE-2018-15376 appeared first on CVE Vulnerability.

]]> CVE-2018-12036 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-12036/ Sun, 26 Feb 2023 06:45:30 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-12036/ OWASP Dependency-Check before 3.2.0 allows attackers to write to arbitrary files via a crafted archive that holds directory traversal filenames.

The post CVE-2018-12036 appeared first on CVE Vulnerability.

]]> OWASP Dependency-Check before 3.2.0 allows attackers to write to arbitrary files via a crafted archive that holds directory traversal filenames.

The post CVE-2018-12036 appeared first on CVE Vulnerability.

]]> CVE-2020-7560 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-7560/ Sun, 26 Feb 2023 06:43:05 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-7560/ A CWE-123: Write-what-where Condition vulnerability exists in EcoStruxure™ Control Expert (all versions) and Unity Pro (former name of EcoStruxure™ Control Expert) (all versions), that could cause a crash of the software or unexpected code execution when opening a malicious file in EcoStruxure™ Control Expert software.

The post CVE-2020-7560 appeared first on CVE Vulnerability.

]]> A CWE-123: Write-what-where Condition vulnerability exists in EcoStruxure™ Control Expert (all versions) and Unity Pro (former name of EcoStruxure™ Control Expert) (all versions), that could cause a crash of the software or unexpected code execution when opening a malicious file in EcoStruxure™ Control Expert software.

The post CVE-2020-7560 appeared first on CVE Vulnerability.

]]> CVE-2021-42540 https://cvevulnerability.com/cve_vulnerabilities/cve-2021-42540/ Thu, 23 Feb 2023 14:12:16 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2021-42540/ The affected product is vulnerable to a unsanitized extract folder for system configuration. A low-privileged user can leverage this logic to overwrite the settings and other key functionality.

The post CVE-2021-42540 appeared first on CVE Vulnerability.

]]> The affected product is vulnerable to a unsanitized extract folder for system configuration. A low-privileged user can leverage this logic to overwrite the settings and other key functionality.

The post CVE-2021-42540 appeared first on CVE Vulnerability.

]]> CVE-2021-38441 https://cvevulnerability.com/cve_vulnerabilities/cve-2021-38441/ Thu, 23 Feb 2023 14:11:12 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2021-38441/ Eclipse CycloneDDS versions prior to 0.8.0 are vulnerable to a write-what-where condition, which may allow an attacker to write arbitrary values in the XML parser.

The post CVE-2021-38441 appeared first on CVE Vulnerability.

]]> Eclipse CycloneDDS versions prior to 0.8.0 are vulnerable to a write-what-where condition, which may allow an attacker to write arbitrary values in the XML parser.

The post CVE-2021-38441 appeared first on CVE Vulnerability.

]]> CVE-2021-38449 https://cvevulnerability.com/cve_vulnerabilities/cve-2021-38449/ Thu, 23 Feb 2023 14:11:12 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2021-38449/ Some API functions permit by-design writing or copying data into a given buffer. Since the client controls these parameters, an attacker could rewrite the memory in any location of the affected product.

The post CVE-2021-38449 appeared first on CVE Vulnerability.

]]> Some API functions permit by-design writing or copying data into a given buffer. Since the client controls these parameters, an attacker could rewrite the memory in any location of the affected product.

The post CVE-2021-38449 appeared first on CVE Vulnerability.

]]> CVE-2021-36057 https://cvevulnerability.com/cve_vulnerabilities/cve-2021-36057/ Thu, 23 Feb 2023 14:10:36 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2021-36057/ XMP Toolkit SDK version 2020.1 (and earlier) is affected by a write-what-where condition vulnerability caused during the application’s memory allocation process. This may cause the memory management functions to become mismatched resulting in local application denial of service in the context of the current user.

The post CVE-2021-36057 appeared first on CVE Vulnerability.

]]> XMP Toolkit SDK version 2020.1 (and earlier) is affected by a write-what-where condition vulnerability caused during the application’s memory allocation process. This may cause the memory management functions to become mismatched resulting in local application denial of service in the context of the current user.

The post CVE-2021-36057 appeared first on CVE Vulnerability.

]]>