CWE-254 Archives - CVE Vulnerability

CVE-2008-1192

Sun, 26 Feb 2023 09:08:54 +0000

Unspecified vulnerability in the Java Plug-in for Sun JDK and JRE 6 Update 4 and earlier, and 5.0 Update 14 and earlier; and SDK and JRE 1.4.2_16 and earlier, and 1.3.1_21 and earlier; allows remote attackers to bypass the same origin policy and “execute local applications” via unknown vectors.

The post CVE-2008-1192 appeared first on CVE Vulnerability.

CVE-2008-1195

Sun, 26 Feb 2023 09:08:54 +0000

Unspecified vulnerability in Sun JDK and Java Runtime Environment (JRE) 6 Update 4 and earlier and 5.0 Update 14 and earlier; and SDK and JRE 1.4.2_16 and earlier; allows remote attackers to access arbitrary network services on the local host via unspecified vectors related to JavaScript and Java APIs.

The post CVE-2008-1195 appeared first on CVE Vulnerability.

CVE-2018-4863

Sun, 26 Feb 2023 06:50:06 +0000

Sophos Endpoint Protection 10.7 allows local users to bypass an intended tamper protection mechanism by deleting the HKEY_LOCAL_MACHINESYSTEMCurrentControlSetservicesSophos Endpoint Defense registry key.

The post CVE-2018-4863 appeared first on CVE Vulnerability.

CVE-2019-5495

Sun, 26 Feb 2023 06:33:40 +0000

OnCommand Unified Manager for VMware vSphere, Linux and Windows prior to 9.5 shipped without certain HTTP Security headers configured which could allow an attacker to obtain sensitive information via unspecified vectors.

The post CVE-2019-5495 appeared first on CVE Vulnerability.

CVE-2019-15149

Sun, 26 Feb 2023 06:30:49 +0000

** DISPUTED ** core.py in Mitogen before 0.2.8 has a typo that drops the unidirectional-routing protection mechanism in the case of a child that is initiated by another child. The Ansible extension is unaffected. NOTE: the vendor disputes this issue because it is exploitable only in conjunction with hypothetical other factors, i.e., an affected use case within a library caller, and a bug in the message receiver policy code that led to reliance on this extra protection mechanism.

The post CVE-2019-15149 appeared first on CVE Vulnerability.

CVE-2019-11636

Sun, 26 Feb 2023 06:29:36 +0000

Zcash 2.x allows an inexpensive approach to “fill all transactions of all blocks” and “prevent any real transaction from occurring” via a “Sapling Wood-Chipper” attack.

The post CVE-2019-11636 appeared first on CVE Vulnerability.

CVE-2019-10741

Sun, 26 Feb 2023 06:29:18 +0000

K-9 Mail v5.600 can include the original quoted HTML code of a specially crafted, benign looking, email within (digitally signed) reply messages. The quoted part can contain conditional statements that show completely different text if opened in a different email client. This can be abused by an attacker to obtain valid S/MIME or PGP signatures for arbitrary content to be displayed to a third party. NOTE: the vendor states “We don’t plan to take any action because of this.”

The post CVE-2019-10741 appeared first on CVE Vulnerability.

CVE-2019-10059

Sun, 26 Feb 2023 06:28:58 +0000

The legacy finger service (TCP port 79) is enabled by default on various older Lexmark devices.

The post CVE-2019-10059 appeared first on CVE Vulnerability.