CWE-306 Archives - CVE Vulnerability

CVE-2008-6827

Sun, 26 Feb 2023 09:11:43 +0000

The ListView control in the Client GUI (AClient.exe) in Symantec Altiris Deployment Solution 6.x before 6.9.355 SP1 allows local users to gain SYSTEM privileges and execute arbitrary commands via a “Shatter” style attack on the “command prompt” hidden GUI button to (1) overwrite the CommandLine parameter to cmd.exe to use SYSTEM privileges and (2) modify the DLL that is loaded using the LoadLibrary API function.

The post CVE-2008-6827 appeared first on CVE Vulnerability.

CVE-2007-0956

Sun, 26 Feb 2023 09:05:40 +0000

The telnet daemon (telnetd) in MIT krb5 before 1.6.1 allows remote attackers to bypass authentication and gain system access via a username beginning with a ‘-‘ character, a similar issue to CVE-2007-0882.

The post CVE-2007-0956 appeared first on CVE Vulnerability.

CVE-2018-9162

Sun, 26 Feb 2023 06:51:45 +0000

Contec Smart Home 4.15 devices do not require authentication for new_user.php, edit_user.php, delete_user.php, and user.php, as demonstrated by changing the admin password and then obtaining control over doors.

The post CVE-2018-9162 appeared first on CVE Vulnerability.

CVE-2018-9119

Sun, 26 Feb 2023 06:51:44 +0000

An attacker with physical access to a BrilliantTS FUZE card (MCU firmware 0.1.73, BLE firmware 0.7.4) can unlock the card, extract credit card numbers, and tamper with data on the card via Bluetooth because no authentication is needed, as demonstrated by gatttool.

The post CVE-2018-9119 appeared first on CVE Vulnerability.

CVE-2018-8016

Sun, 26 Feb 2023 06:51:15 +0000

The default configuration in Apache Cassandra 3.8 through 3.11.1 binds an unauthenticated JMX/RMI interface to all network interfaces, which allows remote attackers to execute arbitrary Java code via an RMI request. This issue is a regression of CVE-2015-0225. The regression was introduced in https://issues.apache.org/jira/browse/CASSANDRA-12109. The fix for the regression is implemented in https://issues.apache.org/jira/browse/CASSANDRA-14173. This fix is contained in the 3.11.2 release of Apache Cassandra.

The post CVE-2018-8016 appeared first on CVE Vulnerability.

CVE-2018-7778

Sun, 26 Feb 2023 06:51:10 +0000

In Schneider Electric Evlink Charging Station versions prior to v3.2.0-12_v1, the Web Interface has an issue that may allow a remote attacker to gain administrative privileges without properly authenticating remote users.

The post CVE-2018-7778 appeared first on CVE Vulnerability.

CVE-2018-7357

Sun, 26 Feb 2023 06:51:01 +0000

ZTE ZXHN H168N product with versions V2.2.0_PK1.2T5, V2.2.0_PK1.2T2, V2.2.0_PK11T7 and V2.2.0_PK11T have an improper access control vulnerability, which may allow an unauthorized user to gain unauthorized access.

The post CVE-2018-7357 appeared first on CVE Vulnerability.

CVE-2018-7301

Sun, 26 Feb 2023 06:51:00 +0000

eQ-3 AG HomeMatic CCU2 2.29.22 devices have an open XML-RPC port without authentication. This can be exploited by sending arbitrary XML-RPC requests to control the attached BidCos devices.

The post CVE-2018-7301 appeared first on CVE Vulnerability.

CVE-2018-6223

Sun, 26 Feb 2023 06:50:38 +0000

A missing authentication for appliance registration vulnerability in Trend Micro Email Encryption Gateway 5.5 could allow an attacker to manipulate the registration process of the product to reset configuration parameters.

The post CVE-2018-6223 appeared first on CVE Vulnerability.

CVE-2018-5486

Sun, 26 Feb 2023 06:50:21 +0000

NetApp OnCommand Unified Manager for Linux versions 7.2 though 7.3 ship with the Java Debug Wire Protocol (JDWP) enabled which allows unauthorized local attackers to execute arbitrary code.

The post CVE-2018-5486 appeared first on CVE Vulnerability.