CWE-346 Archives - CVE Vulnerability https://cvevulnerability.com/cwe_categories/cwe-346/ Sun, 26 Feb 2023 06:51:21 +0000 en-US hourly 1 https://wordpress.org/?v=7.0 https://cvevulnerability.com/wp-content/uploads/2023/02/cropped-Screenshot-2023-02-27-at-3.52.32-PM-32x32.png CWE-346 Archives - CVE Vulnerability https://cvevulnerability.com/cwe_categories/cwe-346/ 32 32 CVE-2018-8235 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-8235/ Sun, 26 Feb 2023 06:51:21 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-8235/ A security feature bypass vulnerability exists when Microsoft Edge improperly handles requests of different origins, aka “Microsoft Edge Security Feature Bypass Vulnerability.” This affects Microsoft Edge.

The post CVE-2018-8235 appeared first on CVE Vulnerability.

]]> A security feature bypass vulnerability exists when Microsoft Edge improperly handles requests of different origins, aka “Microsoft Edge Security Feature Bypass Vulnerability.” This affects Microsoft Edge.

The post CVE-2018-8235 appeared first on CVE Vulnerability.

]]> CVE-2018-8112 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-8112/ Sun, 26 Feb 2023 06:51:17 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-8112/ A security feature bypass vulnerability exists when Microsoft Edge improperly handles requests of different origins, aka “Microsoft Edge Security Feature Bypass Vulnerability.” This affects Microsoft Edge.

The post CVE-2018-8112 appeared first on CVE Vulnerability.

]]> A security feature bypass vulnerability exists when Microsoft Edge improperly handles requests of different origins, aka “Microsoft Edge Security Feature Bypass Vulnerability.” This affects Microsoft Edge.

The post CVE-2018-8112 appeared first on CVE Vulnerability.

]]> CVE-2018-6764 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-6764/ Sun, 26 Feb 2023 06:50:49 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-6764/ util/virlog.c in libvirt does not properly determine the hostname on LXC container startup, which allows local guest OS users to bypass an intended container protection mechanism and execute arbitrary commands via a crafted NSS module.

The post CVE-2018-6764 appeared first on CVE Vulnerability.

]]> util/virlog.c in libvirt does not properly determine the hostname on LXC container startup, which allows local guest OS users to bypass an intended container protection mechanism and execute arbitrary commands via a crafted NSS module.

The post CVE-2018-6764 appeared first on CVE Vulnerability.

]]> CVE-2018-6654 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-6654/ Sun, 26 Feb 2023 06:50:48 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-6654/ The Grammarly extension before 2018-02-02 for Chrome allows remote attackers to discover authentication tokens via an ‘action: “user”‘ request to iframe.gr_-ifr, because the exposure of these tokens is not restricted to any specific web site.

The post CVE-2018-6654 appeared first on CVE Vulnerability.

]]> The Grammarly extension before 2018-02-02 for Chrome allows remote attackers to discover authentication tokens via an ‘action: “user”‘ request to iframe.gr_-ifr, because the exposure of these tokens is not restricted to any specific web site.

The post CVE-2018-6654 appeared first on CVE Vulnerability.

]]> CVE-2018-6690 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-6690/ Sun, 26 Feb 2023 06:50:48 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-6690/ Accessing, modifying, or executing executable files vulnerability in Microsoft Windows client in McAfee Application and Change Control (MACC) 8.0.0 Hotfix 4 and earlier allows authenticated users to execute arbitrary code via file transfer from external system.

The post CVE-2018-6690 appeared first on CVE Vulnerability.

]]> Accessing, modifying, or executing executable files vulnerability in Microsoft Windows client in McAfee Application and Change Control (MACC) 8.0.0 Hotfix 4 and earlier allows authenticated users to execute arbitrary code via file transfer from external system.

The post CVE-2018-6690 appeared first on CVE Vulnerability.

]]> CVE-2018-5400 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-5400/ Sun, 26 Feb 2023 06:50:19 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-5400/ The Auto-Maskin products utilize an undocumented custom protocol to set up Modbus communications with other devices without validating those devices. The originating device sends a message in plaintext, 48:65:6c:6c:6f:20:57:6f:72:6c:64, “Hello World” over UDP ports 44444-44446 to the broadcast address for the LAN. Without verification devices respond to any of these broadcast messages on the LAN […]

The post CVE-2018-5400 appeared first on CVE Vulnerability.

]]> The Auto-Maskin products utilize an undocumented custom protocol to set up Modbus communications with other devices without validating those devices. The originating device sends a message in plaintext, 48:65:6c:6c:6f:20:57:6f:72:6c:64, “Hello World” over UDP ports 44444-44446 to the broadcast address for the LAN. Without verification devices respond to any of these broadcast messages on the LAN with a plaintext reply over UDP containing the device model and firmware version. Following this exchange the devices allow Modbus transmissions between the two devices on the standard Modbus port 502 TCP. Impact: An attacker can exploit this vulnerability to send arbitrary messages to any DCU or RP device through spoofing or replay attacks as long as they have access to the network. Affected releases are Auto-Maskin DCU-210E RP-210E: Versions prior to 3.7 on ARMv7.

The post CVE-2018-5400 appeared first on CVE Vulnerability.

]]> CVE-2018-5409 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-5409/ Sun, 26 Feb 2023 06:50:19 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-5409/ The PrinterLogic Print Management software, versions up to and including 18.3.1.96, updates and executes the code without sufficiently verifying the origin and integrity of the code. An attacker can execute malicious code by compromising the host server, performing DNS spoofing, or modifying the code in transit.

The post CVE-2018-5409 appeared first on CVE Vulnerability.

]]> The PrinterLogic Print Management software, versions up to and including 18.3.1.96, updates and executes the code without sufficiently verifying the origin and integrity of the code. An attacker can execute malicious code by compromising the host server, performing DNS spoofing, or modifying the code in transit.

The post CVE-2018-5409 appeared first on CVE Vulnerability.

]]> CVE-2018-5157 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-5157/ Sun, 26 Feb 2023 06:50:13 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-5157/ Same-origin protections for the PDF viewer can be bypassed, allowing a malicious site to intercept messages meant for the viewer. This could allow the site to retrieve PDF files restricted to viewing by an authenticated user on a third-party website. This vulnerability affects Firefox ESR < 52.8 and Firefox < 60.

The post CVE-2018-5157 appeared first on CVE Vulnerability.

]]> Same-origin protections for the PDF viewer can be bypassed, allowing a malicious site to intercept messages meant for the viewer. This could allow the site to retrieve PDF files restricted to viewing by an authenticated user on a third-party website. This vulnerability affects Firefox ESR < 52.8 and Firefox < 60.

The post CVE-2018-5157 appeared first on CVE Vulnerability.

]]> CVE-2018-5109 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-5109/ Sun, 26 Feb 2023 06:50:12 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-5109/ An audio capture session can started under an incorrect origin from the site making the capture request. Users are still prompted to allow the request but the prompt can display the wrong origin, leading to user confusion about which site is making the request to capture an audio stream. This vulnerability affects Firefox < 58.

The post CVE-2018-5109 appeared first on CVE Vulnerability.

]]> An audio capture session can started under an incorrect origin from the site making the capture request. Users are still prompted to allow the request but the prompt can display the wrong origin, leading to user confusion about which site is making the request to capture an audio stream. This vulnerability affects Firefox < 58.

The post CVE-2018-5109 appeared first on CVE Vulnerability.

]]> CVE-2018-5116 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-5116/ Sun, 26 Feb 2023 06:50:12 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-5116/ WebExtensions with the “ActiveTab” permission are able to access frames hosted within the active tab even if the frames are cross-origin. Malicious extensions can inject frames from arbitrary origins into the loaded page and then interact with them, bypassing same-origin user expectations with this permission. This vulnerability affects Firefox < 58.

The post CVE-2018-5116 appeared first on CVE Vulnerability.

]]> WebExtensions with the “ActiveTab” permission are able to access frames hosted within the active tab even if the frames are cross-origin. Malicious extensions can inject frames from arbitrary origins into the loaded page and then interact with them, bypassing same-origin user expectations with this permission. This vulnerability affects Firefox < 58.

The post CVE-2018-5116 appeared first on CVE Vulnerability.

]]>