CWE-281 Archives - CVE Vulnerability

CVE-2018-5163

Sun, 26 Feb 2023 06:50:13 +0000

If a malicious attacker has used another vulnerability to gain full control over a content process, they may be able to replace the alternate data resources stored in the JavaScript Start-up Bytecode Cache (JSBC) for other JavaScript code. If the parent process then runs this replaced code, the executed script would be run with the parent process’ privileges, escaping the sandbox on content processes. This vulnerability affects Firefox < 60.

The post CVE-2018-5163 appeared first on CVE Vulnerability.

CVE-2018-4115

Sun, 26 Feb 2023 06:49:56 +0000

An issue was discovered in certain Apple products. iOS before 11.3 is affected. macOS before 10.13.4 is affected. tvOS before 11.3 is affected. watchOS before 4.3 is affected. The issue involves CFPreferences in the “System Preferences” component. It allows attackers to bypass intended access restrictions by leveraging incorrect configuration-profile persistence.

The post CVE-2018-4115 appeared first on CVE Vulnerability.

CVE-2018-3762

Sun, 26 Feb 2023 06:49:48 +0000

Nextcloud Server before 12.0.8 and 13.0.3 suffers from improper checks of dropped permissions for incoming shares allowing a user to still request previews for files it should not have access to.

The post CVE-2018-3762 appeared first on CVE Vulnerability.

CVE-2018-12989

Sun, 26 Feb 2023 06:45:51 +0000

The report-viewing feature in Pearson VUE Certiport Console 8 and IQSystem 7 before 2018-06-26 mishandles child processes and consequently launches Internet Explorer or Microsoft Edge as Administrator, which allows local users to gain privileges.

The post CVE-2018-12989 appeared first on CVE Vulnerability.

CVE-2020-9781

Sun, 26 Feb 2023 06:43:53 +0000

The issue was addressed by clearing website permission prompts after navigation. This issue is fixed in iOS 13.4 and iPadOS 13.4. A user may grant website permissions to a site they didn’t intend to.

The post CVE-2020-9781 appeared first on CVE Vulnerability.

CVE-2020-9442

Sun, 26 Feb 2023 06:43:45 +0000

OpenVPN Connect 3.1.0.361 on Windows has Insecure Permissions for %PROGRAMDATA%OpenVPN Connectdriverstapamd64win10, which allows local users to gain privileges by copying a malicious drvstore.dll there.

The post CVE-2020-9442 appeared first on CVE Vulnerability.

CVE-2020-8633

Sun, 26 Feb 2023 06:43:28 +0000

An issue was discovered in Zimbra Collaboration Suite (ZCS) before 8.8.15 Patch 7. When grantors revoked a shared calendar in Outlook, the calendar stayed mounted and accessible.

The post CVE-2020-8633 appeared first on CVE Vulnerability.

CVE-2020-8634

Sun, 26 Feb 2023 06:43:28 +0000

Wing FTP Server v6.2.3 for Linux, macOS, and Solaris sets insecure permissions on files modified within the HTTP file management interface, resulting in files being saved with world-readable and world-writable permissions. If a sensitive system file were edited this way, a low-privilege user may escalate privileges to root.

The post CVE-2020-8634 appeared first on CVE Vulnerability.

CVE-2020-8182

Sun, 26 Feb 2023 06:43:18 +0000

Improper access control in Nextcloud Deck 0.8.0 allowed an attacker to reshare boards shared with them with more permissions than they had themselves.

The post CVE-2020-8182 appeared first on CVE Vulnerability.

CVE-2020-8190

Sun, 26 Feb 2023 06:43:18 +0000

Incorrect file permissions in Citrix ADC and Citrix Gateway before versions 13.0-58.30, 12.1-57.18, 12.0-63.21, 11.1-64.14 and 10.5-70.18 allows privilege escalation.

The post CVE-2020-8190 appeared first on CVE Vulnerability.