CWE-441 Archives - CVE Vulnerability

CVE-2018-1999038

Sun, 26 Feb 2023 06:48:24 +0000

A confused deputy vulnerability exists in Jenkins Publisher Over CIFS Plugin 0.10 and earlier in CifsPublisherPluginDescriptor.java that allows attackers to have Jenkins connect to an attacker specified CIFS server with attacker specified credentials.

The post CVE-2018-1999038 appeared first on CVE Vulnerability.

CVE-2018-16598

Sun, 26 Feb 2023 06:47:07 +0000

An issue was discovered in Amazon Web Services (AWS) FreeRTOS through 1.3.1, FreeRTOS up to V10.0.1 (with FreeRTOS+TCP), and WITTENSTEIN WHIS Connect middleware TCP/IP component. In xProcessReceivedUDPPacket and prvParseDNSReply, any received DNS response is accepted, without confirming it matches a sent DNS request.

The post CVE-2018-16598 appeared first on CVE Vulnerability.

CVE-2018-12182

Sun, 26 Feb 2023 06:45:33 +0000

Insufficient memory write check in SMM service for EDK II may allow an authenticated user to potentially enable escalation of privilege, information disclosure and/or denial of service via local access.

The post CVE-2018-12182 appeared first on CVE Vulnerability.

CVE-2020-26262

Sun, 26 Feb 2023 06:39:59 +0000

Coturn is free open source implementation of TURN and STUN Server. Coturn before version 4.5.2 by default does not allow peers to connect and relay packets to loopback addresses in the range of `127.x.x.x`. However, it was observed that when sending a `CONNECT` request with the `XOR-PEER-ADDRESS` value of `0.0.0.0`, a successful response was received and subsequently, `CONNECTIONBIND` also received a successful response. Coturn then is able to relay packets to the loopback interface. Additionally, when coturn is listening on IPv6, which is default, the loopback interface can also be reached by making use of either `[::1]` or `[::]` as the peer address. By using the address `0.0.0.0` as the peer address, a malicious user will be able to relay packets to the loopback interface, unless `–denied-peer-ip=0.0.0.0` (or similar) has been specified. Since the default configuration implies that loopback peers are not allowed, coturn administrators may choose to not set the `denied-peer-ip` setting. The issue patched in version 4.5.2. As a workaround the addresses in the address block `0.0.0.0/8`, `[::1]` and `[::]` should be denied by default unless `–allow-loopback-peers` has been specified.

The post CVE-2020-26262 appeared first on CVE Vulnerability.

CVE-2019-3924

Sun, 26 Feb 2023 06:33:16 +0000

MikroTik RouterOS before 6.43.12 (stable) and 6.42.12 (long-term) is vulnerable to an intermediary vulnerability. The software will execute user defined network requests to both WAN and LAN clients. A remote unauthenticated attacker can use this vulnerability to bypass the router’s firewall or for general network scanning activities.

The post CVE-2019-3924 appeared first on CVE Vulnerability.