CWE-470 Archives - CVE Vulnerability https://cvevulnerability.com/cwe_categories/cwe-470/ Sun, 26 Feb 2023 06:50:22 +0000 en-US hourly 1 https://wordpress.org/?v=7.0 https://cvevulnerability.com/wp-content/uploads/2023/02/cropped-Screenshot-2023-02-27-at-3.52.32-PM-32x32.png CWE-470 Archives - CVE Vulnerability https://cvevulnerability.com/cwe_categories/cwe-470/ 32 32 CVE-2018-5511 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-5511/ Sun, 26 Feb 2023 06:50:22 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-5511/ On F5 BIG-IP 13.1.0-13.1.0.3 or 13.0.0, when authenticated administrative users execute commands in the Traffic Management User Interface (TMUI), also referred to as the BIG-IP Configuration utility, restrictions on allowed commands may not be enforced.

The post CVE-2018-5511 appeared first on CVE Vulnerability.

]]> On F5 BIG-IP 13.1.0-13.1.0.3 or 13.0.0, when authenticated administrative users execute commands in the Traffic Management User Interface (TMUI), also referred to as the BIG-IP Configuration utility, restrictions on allowed commands may not be enforced.

The post CVE-2018-5511 appeared first on CVE Vulnerability.

]]> CVE-2018-1000613 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-1000613/ Sun, 26 Feb 2023 06:44:38 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-1000613/ Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to but not including 1.60 contains a CWE-470: Use of Externally-Controlled Input to Select Classes or Code (‘Unsafe Reflection’) vulnerability in XMSS/XMSS^MT private key deserialization that can result in Deserializing an XMSS/XMSS^MT private key can result in the execution of […]

The post CVE-2018-1000613 appeared first on CVE Vulnerability.

]]> Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to but not including 1.60 contains a CWE-470: Use of Externally-Controlled Input to Select Classes or Code (‘Unsafe Reflection’) vulnerability in XMSS/XMSS^MT private key deserialization that can result in Deserializing an XMSS/XMSS^MT private key can result in the execution of unexpected code. This attack appear to be exploitable via A handcrafted private key can include references to unexpected classes which will be picked up from the class path for the executing application. This vulnerability appears to have been fixed in 1.60 and later.

The post CVE-2018-1000613 appeared first on CVE Vulnerability.

]]> CVE-2019-3834 https://cvevulnerability.com/cve_vulnerabilities/cve-2019-3834/ Sun, 26 Feb 2023 06:33:14 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2019-3834/ It was found that the fix for CVE-2014-0114 had been reverted in JBoss Operations Network 3 (JON). This flaw allows attackers to manipulate ClassLoader properties on a vulnerable server. Exploits that have been published rely on ClassLoader properties that are exposed such as those in JON 3. Additional information can be found in the Red […]

The post CVE-2019-3834 appeared first on CVE Vulnerability.

]]> It was found that the fix for CVE-2014-0114 had been reverted in JBoss Operations Network 3 (JON). This flaw allows attackers to manipulate ClassLoader properties on a vulnerable server. Exploits that have been published rely on ClassLoader properties that are exposed such as those in JON 3. Additional information can be found in the Red Hat Knowledgebase article: https://access.redhat.com/site/solutions/869353. Note that while multiple products released patches for the original CVE-2014-0114 flaw, the reversion described by this CVE-2019-3834 flaw only occurred in JON 3.

The post CVE-2019-3834 appeared first on CVE Vulnerability.

]]> CVE-2019-20635 https://cvevulnerability.com/cve_vulnerabilities/cve-2019-20635/ Sun, 26 Feb 2023 06:32:30 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2019-20635/ codeBeamer before 9.5.0-RC3 does not properly restrict the ability to execute custom Java code and access the Java class loader via computed fields.

The post CVE-2019-20635 appeared first on CVE Vulnerability.

]]> codeBeamer before 9.5.0-RC3 does not properly restrict the ability to execute custom Java code and access the Java class loader via computed fields.

The post CVE-2019-20635 appeared first on CVE Vulnerability.

]]> CVE-2019-10174 https://cvevulnerability.com/cve_vulnerabilities/cve-2019-10174/ Sun, 26 Feb 2023 06:29:04 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2019-10174/ A vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil allows any application class to invoke private methods in any class with Infinispan’s privileges. The attacker can use reflection to introduce new, malicious behavior into the application.

The post CVE-2019-10174 appeared first on CVE Vulnerability.

]]> A vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil allows any application class to invoke private methods in any class with Infinispan’s privileges. The attacker can use reflection to introduce new, malicious behavior into the application.

The post CVE-2019-10174 appeared first on CVE Vulnerability.

]]> CVE-2019-1003040 https://cvevulnerability.com/cve_vulnerabilities/cve-2019-1003040/ Sun, 26 Feb 2023 06:28:57 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2019-1003040/ A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.55 and earlier allows attackers to invoke arbitrary constructors in sandboxed scripts.

The post CVE-2019-1003040 appeared first on CVE Vulnerability.

]]> A sandbox bypass vulnerability in Jenkins Script Security Plugin 1.55 and earlier allows attackers to invoke arbitrary constructors in sandboxed scripts.

The post CVE-2019-1003040 appeared first on CVE Vulnerability.

]]> CVE-2019-1003041 https://cvevulnerability.com/cve_vulnerabilities/cve-2019-1003041/ Sun, 26 Feb 2023 06:28:57 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2019-1003041/ A sandbox bypass vulnerability in Jenkins Pipeline: Groovy Plugin 2.64 and earlier allows attackers to invoke arbitrary constructors in sandboxed scripts.

The post CVE-2019-1003041 appeared first on CVE Vulnerability.

]]> A sandbox bypass vulnerability in Jenkins Pipeline: Groovy Plugin 2.64 and earlier allows attackers to invoke arbitrary constructors in sandboxed scripts.

The post CVE-2019-1003041 appeared first on CVE Vulnerability.

]]> CVE-2021-32647 https://cvevulnerability.com/cve_vulnerabilities/cve-2021-32647/ Thu, 23 Feb 2023 14:09:49 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2021-32647/ Emissary is a P2P based data-driven workflow engine. Affected versions of Emissary are vulnerable to post-authentication Remote Code Execution (RCE). The [`CreatePlace`](https://github.com/NationalSecurityAgency/emissary/blob/30c54ef16c6eb6ed09604a929939fb9f66868382/src/main/java/emissary/server/mvc/internal/CreatePlaceAction.java#L36) REST endpoint accepts an `sppClassName` parameter which is used to load an arbitrary class. This class is later instantiated using a constructor with the following signature: `(String, String, String)`. An attacker may find […]

The post CVE-2021-32647 appeared first on CVE Vulnerability.

]]> Emissary is a P2P based data-driven workflow engine. Affected versions of Emissary are vulnerable to post-authentication Remote Code Execution (RCE). The [`CreatePlace`](https://github.com/NationalSecurityAgency/emissary/blob/30c54ef16c6eb6ed09604a929939fb9f66868382/src/main/java/emissary/server/mvc/internal/CreatePlaceAction.java#L36) REST endpoint accepts an `sppClassName` parameter which is used to load an arbitrary class. This class is later instantiated using a constructor with the following signature: `(String, String, String)`. An attacker may find a gadget (class) in the application classpath that could be used to achieve Remote Code Execution (RCE) or disrupt the application. Even though the chances to find a gadget (class) that allow arbitrary code execution are low, an attacker can still find gadgets that could potentially crash the application or leak sensitive data. As a work around disable network access to Emissary from untrusted sources.

The post CVE-2021-32647 appeared first on CVE Vulnerability.

]]> CVE-2021-31522 https://cvevulnerability.com/cve_vulnerabilities/cve-2021-31522/ Thu, 23 Feb 2023 14:09:36 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2021-31522/ Kylin can receive user input and load any class through Class.forName(…). This issue affects Apache Kylin 2 version 2.6.6 and prior versions; Apache Kylin 3 version 3.1.2 and prior versions; Apache Kylin 4 version 4.0.0 and prior versions.

The post CVE-2021-31522 appeared first on CVE Vulnerability.

]]> Kylin can receive user input and load any class through Class.forName(…). This issue affects Apache Kylin 2 version 2.6.6 and prior versions; Apache Kylin 3 version 3.1.2 and prior versions; Apache Kylin 4 version 4.0.0 and prior versions.

The post CVE-2021-31522 appeared first on CVE Vulnerability.

]]> CVE-2022-26469 https://cvevulnerability.com/cve_vulnerabilities/cve-2022-26469/ Thu, 23 Feb 2023 05:17:51 +0000 http://www.cvevulnerability.com/cve_vulnerabilities/cve-2022-26469/ In MtkEmail, there is a possible escalation of privilege due to fragment injection. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07216598; Issue ID: ALPS07216598.

The post CVE-2022-26469 appeared first on CVE Vulnerability.

]]> In MtkEmail, there is a possible escalation of privilege due to fragment injection. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: ALPS07216598; Issue ID: ALPS07216598.

The post CVE-2022-26469 appeared first on CVE Vulnerability.

]]>