CWE-284 Archives - CVE Vulnerability

CVE-2008-2947

Sun, 26 Feb 2023 09:09:46 +0000

Cross-domain vulnerability in Microsoft Internet Explorer 5.01 SP4, 6, and 7 allows remote attackers to access restricted information from other domains via JavaScript that uses the Object data type for the value of a (1) location or (2) location.href property, related to incorrect determination of the origin of web script, aka “Window Location Property Cross-Domain Vulnerability.” NOTE: according to Microsoft, CVE-2008-2948 and CVE-2008-2949 are duplicates of this issue, probably different attack vectors.

The post CVE-2008-2947 appeared first on CVE Vulnerability.

CVE-2018-7362

Sun, 26 Feb 2023 06:51:02 +0000

All versions up to V1.1.10P3T18 of ZTE ZXHN F670 product are impacted by improper access control vulnerability, which may allows an unauthorized user to perform unauthorized operations on the router.

The post CVE-2018-7362 appeared first on CVE Vulnerability.

CVE-2018-7364

Sun, 26 Feb 2023 06:51:02 +0000

All versions up to ZXINOS-RESV1.01.43 of the ZTE ZXIN10 product European region are impacted by improper access control vulnerability. Due to improper access control to devcomm process, an unauthorized remote attacker can exploit this vulnerability to execute arbitrary code with root privileges.

The post CVE-2018-7364 appeared first on CVE Vulnerability.

CVE-2018-5264

Sun, 26 Feb 2023 06:50:16 +0000

Ubiquiti UniFi 52 devices, when Hotspot mode is used, allow remote attackers to bypass intended restrictions on “free time” Wi-Fi usage by sending a /guest/s/default/ request to obtain a cookie, and then using this cookie in a /guest/s/default/login request with the byfree parameter.

The post CVE-2018-5264 appeared first on CVE Vulnerability.

CVE-2018-21007

Sun, 26 Feb 2023 06:48:50 +0000

The woo-confirmation-email plugin before 3.2.0 for WordPress has no blocking of direct access to supportive xl folders inside uploads.

The post CVE-2018-21007 appeared first on CVE Vulnerability.

CVE-2018-20930

Sun, 26 Feb 2023 06:48:48 +0000

cPanel before 70.0.23 allows .htaccess restrictions bypass when Htaccess Optimization is enabled (SEC-401).

The post CVE-2018-20930 appeared first on CVE Vulnerability.

CVE-2018-20938

Sun, 26 Feb 2023 06:48:48 +0000

cPanel before 68.0.27 does not enforce ownership during addpkgext and delpkgext WHM API calls (SEC-324).

The post CVE-2018-20938 appeared first on CVE Vulnerability.

CVE-2018-20957

Sun, 26 Feb 2023 06:48:48 +0000

The Bluetooth Low Energy (BLE) subsystem on Tapplock devices before 2018-06-12 allows replay attacks.

The post CVE-2018-20957 appeared first on CVE Vulnerability.

CVE-2018-20890

Sun, 26 Feb 2023 06:48:46 +0000

cPanel before 74.0.0 allows arbitrary zone file modifications during record edits (SEC-426).

The post CVE-2018-20890 appeared first on CVE Vulnerability.

CVE-2018-19576

Sun, 26 Feb 2023 06:48:13 +0000

GitLab CE/EE, versions 8.6 up to 11.x before 11.3.11, 11.4 before 11.4.8, and 11.5 before 11.5.1, are vulnerable to an access control issue that allows a Guest user to make changes to or delete their own comments on an issue, after the issue was made Confidential.

The post CVE-2018-19576 appeared first on CVE Vulnerability.