CWE-494 Archives - CVE Vulnerability

CVE-2008-3438

Sun, 26 Feb 2023 09:10:01 +0000

Apple Mac OS X does not properly verify the authenticity of updates, which allows man-in-the-middle attackers to execute arbitrary code via a Trojan horse update, as demonstrated by evilgrade and DNS cache poisoning.

The post CVE-2008-3438 appeared first on CVE Vulnerability.

CVE-2008-3324

Sun, 26 Feb 2023 09:09:57 +0000

The PartyGaming PartyPoker client program 121/120 does not properly verify the authenticity of updates, which allows remote man-in-the-middle attackers to execute arbitrary code via a Trojan horse update.

The post CVE-2008-3324 appeared first on CVE Vulnerability.

CVE-2018-4009

Sun, 26 Feb 2023 06:49:54 +0000

An exploitable privilege escalation vulnerability exists in the Shimo VPN helper service due to improper validation of code signing. A user with local access can use this vulnerability to raise their privileges to root. An attacker would need local access to the machine to successfully exploit this bug.

The post CVE-2018-4009 appeared first on CVE Vulnerability.

CVE-2018-19234

Sun, 26 Feb 2023 06:48:06 +0000

The Miss Marple Updater Service in COMPAREX Miss Marple Enterprise Edition before 2.0 allows remote attackers to execute arbitrary code with SYSTEM privileges via vectors related to missing update validation.

The post CVE-2018-19234 appeared first on CVE Vulnerability.

CVE-2018-13012

Sun, 26 Feb 2023 06:45:52 +0000

Download of code with improper integrity check in snsupd.exe and upd.exe in SAFE’N’SEC SoftControl/SafenSoft SysWatch, SoftControl/SafenSoft TPSecure, and SoftControl/SafenSoft Enterprise Suite before 4.4.12 allows the remote attacker to execute unauthorized code by substituting a forged update server.

The post CVE-2018-13012 appeared first on CVE Vulnerability.

CVE-2020-9759

Sun, 26 Feb 2023 06:43:53 +0000

A Vulnerability of LG Electronic web OS TV Emulator could allow an attacker to escalate privileges and overwrite certain files. This vulnerability is due to wrong environment setting. An attacker could exploit this vulnerability through crafted configuration files and executable files.

The post CVE-2020-9759 appeared first on CVE Vulnerability.

CVE-2020-9751

Sun, 26 Feb 2023 06:43:53 +0000

Naver Cloud Explorer before 2.2.2.11 allows the system to download an arbitrary file from the attacker’s server and execute it during the upgrade.

The post CVE-2020-9751 appeared first on CVE Vulnerability.

CVE-2020-9474

Sun, 26 Feb 2023 06:43:46 +0000

The S. Siedle & Soehne SG 150-0 Smart Gateway before 1.2.4 allows remote code execution via the backup functionality in the web frontend. By using an exploit chain, an attacker with access to the network can get root access on the gateway.

The post CVE-2020-9474 appeared first on CVE Vulnerability.

CVE-2020-8809

Sun, 26 Feb 2023 06:43:32 +0000

Gurux GXDLMS Director prior to 8.5.1905.1301 downloads updates to add-ins and OBIS code over an unencrypted HTTP connection. A man-in-the-middle attacker can prompt the user to download updates by modifying the contents of gurux.fi/obis/files.xml and gurux.fi/updates/updates.xml. Then, the attacker can modify the contents of downloaded files. In the case of add-ins (if the user is using those), this will lead to code execution. In case of OBIS codes (which the user is always using as they are needed to communicate with the energy meters), this can lead to code execution when combined with CVE-2020-8810.

The post CVE-2020-8809 appeared first on CVE Vulnerability.

CVE-2020-7883

Sun, 26 Feb 2023 06:43:12 +0000

Printchaser v2.2021.804.1 and earlier versions contain a vulnerability, which could allow remote attacker to download and execute remote file by setting the argument, variable in the activeX module. This can be leveraged for code execution.

The post CVE-2020-7883 appeared first on CVE Vulnerability.