CWE-347 Archives - CVE Vulnerability https://cvevulnerability.com/cwe_categories/cwe-347/ Sun, 26 Feb 2023 06:51:40 +0000 en-US hourly 1 https://wordpress.org/?v=7.0 https://cvevulnerability.com/wp-content/uploads/2023/02/cropped-Screenshot-2023-02-27-at-3.52.32-PM-32x32.png CWE-347 Archives - CVE Vulnerability https://cvevulnerability.com/cwe_categories/cwe-347/ 32 32 CVE-2018-8955 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-8955/ Sun, 26 Feb 2023 06:51:40 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-8955/ The installer for BitDefender GravityZone relies on an encoded string in a filename to determine the URL for installation metadata, which allows remote attackers to execute arbitrary code by changing the filename while leaving the file’s digital signature unchanged.

The post CVE-2018-8955 appeared first on CVE Vulnerability.

]]> The installer for BitDefender GravityZone relies on an encoded string in a filename to determine the URL for installation metadata, which allows remote attackers to execute arbitrary code by changing the filename while leaving the file’s digital signature unchanged.

The post CVE-2018-8955 appeared first on CVE Vulnerability.

]]> CVE-2018-7711 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-7711/ Sun, 26 Feb 2023 06:51:08 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-7711/ HTTPRedirect.php in the saml2 library in SimpleSAMLphp before 1.15.4 has an incorrect check of return values in the signature validation utilities, allowing an attacker to get invalid signatures accepted as valid by forcing an error during validation. This occurs because of a dependency on PHP functionality that interprets a -1 error code as a true […]

The post CVE-2018-7711 appeared first on CVE Vulnerability.

]]> HTTPRedirect.php in the saml2 library in SimpleSAMLphp before 1.15.4 has an incorrect check of return values in the signature validation utilities, allowing an attacker to get invalid signatures accepted as valid by forcing an error during validation. This occurs because of a dependency on PHP functionality that interprets a -1 error code as a true boolean value.

The post CVE-2018-7711 appeared first on CVE Vulnerability.

]]> CVE-2018-7685 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-7685/ Sun, 26 Feb 2023 06:51:07 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-7685/ The decoupled download and installation steps in libzypp before 17.5.0 could lead to a corrupted RPM being left in the cache, where a later call would not display the corrupted RPM warning and allow installation, a problem caused by malicious warnings only displayed during download.

The post CVE-2018-7685 appeared first on CVE Vulnerability.

]]> The decoupled download and installation steps in libzypp before 17.5.0 could lead to a corrupted RPM being left in the cache, where a later call would not display the corrupted RPM warning and allow installation, a problem caused by malicious warnings only displayed during download.

The post CVE-2018-7685 appeared first on CVE Vulnerability.

]]> CVE-2018-7644 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-7644/ Sun, 26 Feb 2023 06:51:06 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-7644/ The XmlSecLibs library as used in the saml2 library in SimpleSAMLphp before 1.15.3 incorrectly verifies signatures on SAML assertions, allowing a remote attacker to construct a crafted SAML assertion on behalf of an Identity Provider that would pass as cryptographically valid, thereby allowing them to impersonate a user from that Identity Provider, aka a key […]

The post CVE-2018-7644 appeared first on CVE Vulnerability.

]]> The XmlSecLibs library as used in the saml2 library in SimpleSAMLphp before 1.15.3 incorrectly verifies signatures on SAML assertions, allowing a remote attacker to construct a crafted SAML assertion on behalf of an Identity Provider that would pass as cryptographically valid, thereby allowing them to impersonate a user from that Identity Provider, aka a key confusion issue.

The post CVE-2018-7644 appeared first on CVE Vulnerability.

]]> CVE-2018-7340 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-7340/ Sun, 26 Feb 2023 06:51:01 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-7340/ Duo Network Gateway 1.2.9 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to SAML service providers.

The post CVE-2018-7340 appeared first on CVE Vulnerability.

]]> Duo Network Gateway 1.2.9 and earlier may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to SAML service providers.

The post CVE-2018-7340 appeared first on CVE Vulnerability.

]]> CVE-2018-6664 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-6664/ Sun, 26 Feb 2023 06:50:48 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-6664/ Application Protections Bypass vulnerability in Microsoft Windows in McAfee Data Loss Prevention (DLP) Endpoint before 10.0.500 and DLP Endpoint before 11.0.400 allows authenticated users to bypass the product block action via a command-line utility.

The post CVE-2018-6664 appeared first on CVE Vulnerability.

]]> Application Protections Bypass vulnerability in Microsoft Windows in McAfee Data Loss Prevention (DLP) Endpoint before 10.0.500 and DLP Endpoint before 11.0.400 allows authenticated users to bypass the product block action via a command-line utility.

The post CVE-2018-6664 appeared first on CVE Vulnerability.

]]> CVE-2018-6459 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-6459/ Sun, 26 Feb 2023 06:50:43 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-6459/ The rsa_pss_params_parse function in libstrongswan/credentials/keys/signature_params.c in strongSwan 5.6.1 allows remote attackers to cause a denial of service via a crafted RSASSA-PSS signature that lacks a mask generation function parameter.

The post CVE-2018-6459 appeared first on CVE Vulnerability.

]]> The rsa_pss_params_parse function in libstrongswan/credentials/keys/signature_params.c in strongSwan 5.6.1 allows remote attackers to cause a denial of service via a crafted RSASSA-PSS signature that lacks a mask generation function parameter.

The post CVE-2018-6459 appeared first on CVE Vulnerability.

]]> CVE-2018-5923 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-5923/ Sun, 26 Feb 2023 06:50:30 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-5923/ In HP LaserJet Enterprise, HP PageWide Enterprise, HP LaserJet Managed, and HP OfficeJet Enterprise Printers, solution application signature checking may allow potential execution of arbitrary code.

The post CVE-2018-5923 appeared first on CVE Vulnerability.

]]> In HP LaserJet Enterprise, HP PageWide Enterprise, HP LaserJet Managed, and HP OfficeJet Enterprise Printers, solution application signature checking may allow potential execution of arbitrary code.

The post CVE-2018-5923 appeared first on CVE Vulnerability.

]]> CVE-2018-5383 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-5383/ Sun, 26 Feb 2023 06:50:19 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-5383/ Bluetooth firmware or operating system software drivers in macOS versions before 10.13, High Sierra and iOS versions before 11.4, and Android versions before the 2018-06-05 patch may not sufficiently validate elliptic curve parameters used to generate public keys during a Diffie-Hellman key exchange, which may allow a remote attacker to obtain the encryption key used […]

The post CVE-2018-5383 appeared first on CVE Vulnerability.

]]> Bluetooth firmware or operating system software drivers in macOS versions before 10.13, High Sierra and iOS versions before 11.4, and Android versions before the 2018-06-05 patch may not sufficiently validate elliptic curve parameters used to generate public keys during a Diffie-Hellman key exchange, which may allow a remote attacker to obtain the encryption key used by the device.

The post CVE-2018-5383 appeared first on CVE Vulnerability.

]]> CVE-2018-5387 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-5387/ Sun, 26 Feb 2023 06:50:19 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-5387/ Wizkunde SAMLBase may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to SAML service providers.

The post CVE-2018-5387 appeared first on CVE Vulnerability.

]]> Wizkunde SAMLBase may incorrectly utilize the results of XML DOM traversal and canonicalization APIs in such a way that an attacker may be able to manipulate the SAML data without invalidating the cryptographic signature, allowing the attack to potentially bypass authentication to SAML service providers.

The post CVE-2018-5387 appeared first on CVE Vulnerability.

]]>