CWE-290 Archives - CVE Vulnerability

CVE-2018-8425

Sun, 26 Feb 2023 06:51:27 +0000

A spoofing vulnerability exists when Microsoft Edge improperly handles specific HTML content, aka “Microsoft Edge Spoofing Vulnerability.” This affects Microsoft Edge.

The post CVE-2018-8425 appeared first on CVE Vulnerability.

CVE-2018-8388

Sun, 26 Feb 2023 06:51:26 +0000

A spoofing vulnerability exists when Microsoft Edge improperly handles specific HTML content, aka “Microsoft Edge Spoofing Vulnerability.” This affects Microsoft Edge. This CVE ID is unique from CVE-2018-8383.

The post CVE-2018-8388 appeared first on CVE Vulnerability.

CVE-2018-8383

Sun, 26 Feb 2023 06:51:25 +0000

A spoofing vulnerability exists when Microsoft Edge does not properly parse HTTP content, aka “Microsoft Edge Spoofing Vulnerability.” This affects Microsoft Edge. This CVE ID is unique from CVE-2018-8388.

The post CVE-2018-8383 appeared first on CVE Vulnerability.

CVE-2018-8278

Sun, 26 Feb 2023 06:51:22 +0000

A spoofing vulnerability exists when Microsoft Edge improperly handles specific HTML content, aka “Microsoft Edge Spoofing Vulnerability.” This affects Microsoft Edge.

The post CVE-2018-8278 appeared first on CVE Vulnerability.

CVE-2018-8153

Sun, 26 Feb 2023 06:51:19 +0000

A spoofing vulnerability exists in Microsoft Exchange Server when Outlook Web Access (OWA) fails to properly handle web requests, aka “Microsoft Exchange Spoofing Vulnerability.” This affects Microsoft Exchange Server.

The post CVE-2018-8153 appeared first on CVE Vulnerability.

CVE-2018-7842

Sun, 26 Feb 2023 06:51:11 +0000

A CWE-290: Authentication Bypass by Spoofing vulnerability exists in all versions of the Modicon M580, Modicon M340, Modicon Quantum, and Modicon Premium which could cause an elevation of privilege by conducting a brute force attack on Modbus parameters sent to the controller.

The post CVE-2018-7842 appeared first on CVE Vulnerability.

CVE-2018-7160

Sun, 26 Feb 2023 06:50:57 +0000

The Node.js inspector, in 6.x and later is vulnerable to a DNS rebinding attack which could be exploited to perform remote code execution. An attack is possible from malicious websites open in a web browser on the same computer, or another computer with network access to the computer running the Node.js process. A malicious website could use a DNS rebinding attack to trick the web browser to bypass same-origin-policy checks and to allow HTTP connections to localhost or to hosts on the local network. If a Node.js process with the debug port active is running on localhost or on a host on the local network, the malicious website could connect to it as a debugger, and get full code execution access.

The post CVE-2018-7160 appeared first on CVE Vulnerability.

CVE-2018-5353

Sun, 26 Feb 2023 06:50:18 +0000

The custom GINA/CP module in Zoho ManageEngine ADSelfService Plus before 5.5 build 5517 allows remote attackers to execute code and escalate privileges via spoofing. It does not authenticate the intended server before opening a browser window. An unauthenticated attacker capable of conducting a spoofing attack can redirect the browser to gain execution in the context of the WinLogon.exe process. If Network Level Authentication is not enforced, the vulnerability can be exploited via RDP. Additionally, if the web server has a misconfigured certificate then no spoofing attack is required

The post CVE-2018-5353 appeared first on CVE Vulnerability.

CVE-2018-5354

Sun, 26 Feb 2023 06:50:18 +0000

The custom GINA/CP module in ANIXIS Password Reset Client before version 3.22 allows remote attackers to execute code and escalate privileges via spoofing. When the client is configured to use HTTP, it does not authenticate the intended server before opening a browser window. An unauthenticated attacker capable of conducting a spoofing attack can redirect the browser to gain execution in the context of the WinLogon.exe process. If Network Level Authentication is not enforced, the vulnerability can be exploited via RDP.

The post CVE-2018-5354 appeared first on CVE Vulnerability.

CVE-2018-3829

Sun, 26 Feb 2023 06:49:50 +0000

In Elastic Cloud Enterprise (ECE) versions prior to 1.1.4 it was discovered that a user could scale out allocators on new hosts with an invalid roles token. An attacker with access to the previous runner ID and IP address of the coordinator-host could add a allocator to an existing ECE install to gain access to other clusters data.

The post CVE-2018-3829 appeared first on CVE Vulnerability.