CWE-345 Archives - CVE Vulnerability

CVE-2018-7932

Sun, 26 Feb 2023 06:51:13 +0000

Huawei AppGallery versions before 8.0.4.301 has an arbitrary Javascript running vulnerability. An attacker may set up a malicious network environment and trick user into accessing a malicious web page to bypass the whitelist mechanism, which make the malicious Javascript loaded and run in the smart phone.

The post CVE-2018-7932 appeared first on CVE Vulnerability.

CVE-2018-7798

Sun, 26 Feb 2023 06:51:10 +0000

A Insufficient Verification of Data Authenticity (CWE-345) vulnerability exists in the Modicon M221, all versions, which could cause a change of IPv4 configuration (IP address, mask and gateway) when remotely connected to the device.

The post CVE-2018-7798 appeared first on CVE Vulnerability.

CVE-2018-6562

Sun, 26 Feb 2023 06:50:46 +0000

totemomail Encryption Gateway before 6.0_b567 allows remote attackers to obtain sensitive information about user sessions and encryption key material via a JSONP hijacking attack.

The post CVE-2018-6562 appeared first on CVE Vulnerability.

CVE-2018-2434

Sun, 26 Feb 2023 06:49:01 +0000

A content spoofing vulnerability in the following components allows to render html pages containing arbitrary plain text content, which might fool an end user: UI add-on for SAP NetWeaver (UI_Infra, 1.0), SAP UI Implementation for Decoupled Innovations (UI_700, 2.0): SAP NetWeaver 7.00 Implementation, SAP User Interface Technology (SAP_UI 7.4, 7.5, 7.51, 7.52). There is little impact as it is not possible to embed active contents such as JavaScript or hyperlinks.

The post CVE-2018-2434 appeared first on CVE Vulnerability.

CVE-2018-19971

Sun, 26 Feb 2023 06:48:23 +0000

JFrog Artifactory Pro 6.5.9 has Incorrect Access Control.

The post CVE-2018-19971 appeared first on CVE Vulnerability.

CVE-2018-17938

Sun, 26 Feb 2023 06:47:38 +0000

Zimbra Collaboration before 8.8.10 GA allows text content spoofing via a loginErrorCode value.

The post CVE-2018-17938 appeared first on CVE Vulnerability.

CVE-2018-17287

Sun, 26 Feb 2023 06:47:23 +0000

In Kofax Front Office Server Administration Console 4.1.1.11.0.5212, some fields, such as passwords, are obfuscated in the front-end, but the cleartext value can be exfiltrated by using the back-end “download” feature, as demonstrated by an mfp.password downloadsettingvalue operation.

The post CVE-2018-17287 appeared first on CVE Vulnerability.

CVE-2018-15801

Sun, 26 Feb 2023 06:46:47 +0000

Spring Security versions 5.1.x prior to 5.1.2 contain an authorization bypass vulnerability during JWT issuer validation. In order to be impacted, the same private key for an honest issuer and a malicious user must be used when signing JWTs. In that case, a malicious user could fashion signed JWTs with the malicious issuer URL that may be granted for the honest issuer.

The post CVE-2018-15801 appeared first on CVE Vulnerability.

CVE-2018-12333

Sun, 26 Feb 2023 06:45:37 +0000

Insufficient Verification of Data Authenticity vulnerability in ECOS Secure Boot Stick (aka SBS) 5.6.5 allows an attacker to manipulate security relevant configurations and execute malicious code.

The post CVE-2018-12333 appeared first on CVE Vulnerability.

CVE-2018-10626

Sun, 26 Feb 2023 06:44:56 +0000

A vulnerability was discovered in all versions of Medtronic MyCareLink 24950 and 24952 Patient Monitor. The affected product’s update service does not sufficiently verify the authenticity of the data uploaded. An attacker who obtains per-product credentials from the monitor and paired implantable cardiac device information can potentially upload invalid data to the Medtronic CareLink network.

The post CVE-2018-10626 appeared first on CVE Vulnerability.