CWE-425 Archives - CVE Vulnerability

CVE-2018-7526

Sun, 26 Feb 2023 06:51:04 +0000

In TotalAlert Web Application in BeaconMedaes Scroll Medical Air Systems prior to v4107600010.23, by accessing a specific uniform resource locator (URL) on the webserver, a malicious user may be able to access information in the application without authenticating.

The post CVE-2018-7526 appeared first on CVE Vulnerability.

CVE-2018-6669

Sun, 26 Feb 2023 06:50:48 +0000

A whitelist bypass vulnerability in McAfee Application Control / Change Control 7.0.1 and before allows a remote or local user to execute blacklisted files through an ASP.NET form.

The post CVE-2018-6669 appeared first on CVE Vulnerability.

CVE-2018-6624

Sun, 26 Feb 2023 06:50:47 +0000

OMRON NS devices 1.1 through 1.3 allow remote attackers to bypass authentication via a direct request to the .html file for a specific screen, as demonstrated by monitor.html.

The post CVE-2018-6624 appeared first on CVE Vulnerability.

CVE-2018-19620

Sun, 26 Feb 2023 06:48:14 +0000

ShowDoc 2.4.1 allows remote attackers to edit other users’ notes by navigating with a modified page_id.

The post CVE-2018-19620 appeared first on CVE Vulnerability.

CVE-2018-19207

Sun, 26 Feb 2023 06:48:05 +0000

The Van Ons WP GDPR Compliance (aka wp-gdpr-compliance) plugin before 1.4.3 for WordPress allows remote attackers to execute arbitrary code because $wpdb->prepare() input is mishandled, as exploited in the wild in November 2018.

The post CVE-2018-19207 appeared first on CVE Vulnerability.

CVE-2018-19143

Sun, 26 Feb 2023 06:48:03 +0000

Open Ticket Request System (OTRS) 4.0.x before 4.0.33, 5.0.x before 5.0.31, and 6.0.x before 6.0.13 allows an authenticated user to delete files via a modified submission form because upload caching is mishandled.

The post CVE-2018-19143 appeared first on CVE Vulnerability.

CVE-2018-19109

Sun, 26 Feb 2023 06:48:03 +0000

tianti 2.3 allows remote authenticated users to bypass intended permission restrictions by visiting tianti-module-admin/cms/column/list directly to read the column list page or edit a column.

The post CVE-2018-19109 appeared first on CVE Vulnerability.

CVE-2018-18922

Sun, 26 Feb 2023 06:47:58 +0000

add_user in AbiSoft Ticketly 1.0 allows remote attackers to create administrator accounts via an action/add_user.php POST request.

The post CVE-2018-18922 appeared first on CVE Vulnerability.

CVE-2018-18862

Sun, 26 Feb 2023 06:47:57 +0000

BMC Remedy Mid-Tier 7.1.00 and 9.1.02.003 for BMC Remedy AR System has Incorrect Access Control in ITAM forms, as demonstrated by TLS%3APLR-Configuration+Details/Default+Admin+View/, AST%3AARServerConnection/Default+Admin+View/, and AR+System+Administration%3A+Server+Information/Default+Admin+View/.

The post CVE-2018-18862 appeared first on CVE Vulnerability.

CVE-2018-16706

Sun, 26 Feb 2023 06:47:09 +0000

LG SuperSign CMS allows TVs to be rebooted remotely without authentication via a direct HTTP request to /qsr_server/device/reboot on port 9080.

The post CVE-2018-16706 appeared first on CVE Vulnerability.