CWE-610 Archives - CVE Vulnerability https://cvevulnerability.com/cwe_categories/cwe-610/ Sun, 26 Feb 2023 06:51:51 +0000 en-US hourly 1 https://wordpress.org/?v=7.0 https://cvevulnerability.com/wp-content/uploads/2023/02/cropped-Screenshot-2023-02-27-at-3.52.32-PM-32x32.png CWE-610 Archives - CVE Vulnerability https://cvevulnerability.com/cwe_categories/cwe-610/ 32 32 CVE-2018-9582 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-9582/ Sun, 26 Feb 2023 06:51:51 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-9582/ In package installer in Android-8.0, Android-8.1 and Android-9, there is a possible bypass of the unknown source warning due to a confused deputy scenario. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Android ID: A-112031362.

The post CVE-2018-9582 appeared first on CVE Vulnerability.

]]> In package installer in Android-8.0, Android-8.1 and Android-9, there is a possible bypass of the unknown source warning due to a confused deputy scenario. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Android ID: A-112031362.

The post CVE-2018-9582 appeared first on CVE Vulnerability.

]]> CVE-2018-7824 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-7824/ Sun, 26 Feb 2023 06:51:11 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-7824/ An Externally Controlled Reference to a Resource (CWE-610) vulnerability exists in Schneider Electric Modbus Serial Driver (For 64-bit Windows OS:V3.17 IE 37 and prior , For 32-bit Windows OS:V2.17 IE 27 and prior, and as part of the Driver Suite version:V14.12 and prior) which could allow write access to system files available only to users […]

The post CVE-2018-7824 appeared first on CVE Vulnerability.

]]> An Externally Controlled Reference to a Resource (CWE-610) vulnerability exists in Schneider Electric Modbus Serial Driver (For 64-bit Windows OS:V3.17 IE 37 and prior , For 32-bit Windows OS:V2.17 IE 27 and prior, and as part of the Driver Suite version:V14.12 and prior) which could allow write access to system files available only to users with SYSTEM privilege or other important user files.

The post CVE-2018-7824 appeared first on CVE Vulnerability.

]]> CVE-2018-12475 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-12475/ Sun, 26 Feb 2023 06:45:40 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-12475/ A Externally Controlled Reference to a Resource in Another Sphere vulnerability in obs-service-download_files of openSUSE Open Build Service allows authenticated users to generate HTTP request against internal networks and potentially downloading data that is exposed there. This issue affects: openSUSE Open Build Service .

The post CVE-2018-12475 appeared first on CVE Vulnerability.

]]> A Externally Controlled Reference to a Resource in Another Sphere vulnerability in obs-service-download_files of openSUSE Open Build Service allows authenticated users to generate HTTP request against internal networks and potentially downloading data that is exposed there. This issue affects: openSUSE Open Build Service .

The post CVE-2018-12475 appeared first on CVE Vulnerability.

]]> CVE-2018-12381 https://cvevulnerability.com/cve_vulnerabilities/cve-2018-12381/ Sun, 26 Feb 2023 06:45:38 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2018-12381/ Manually dragging and dropping an Outlook email message into the browser will trigger a page navigation when the message’s mail columns are incorrectly interpreted as a URL. *Note: this issue only affects Windows operating systems with Outlook installed. Other operating systems are not affected.*. This vulnerability affects Firefox ESR < 60.2 and Firefox < 62.

The post CVE-2018-12381 appeared first on CVE Vulnerability.

]]> Manually dragging and dropping an Outlook email message into the browser will trigger a page navigation when the message’s mail columns are incorrectly interpreted as a URL. *Note: this issue only affects Windows operating systems with Outlook installed. Other operating systems are not affected.*. This vulnerability affects Firefox ESR < 60.2 and Firefox < 62.

The post CVE-2018-12381 appeared first on CVE Vulnerability.

]]> CVE-2020-9752 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-9752/ Sun, 26 Feb 2023 06:43:53 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-9752/ Naver Cloud Explorer before 2.2.2.11 allows the attacker can move a local file in any path on the filesystem as a system privilege through its named pipe.

The post CVE-2020-9752 appeared first on CVE Vulnerability.

]]> Naver Cloud Explorer before 2.2.2.11 allows the attacker can move a local file in any path on the filesystem as a system privilege through its named pipe.

The post CVE-2020-9752 appeared first on CVE Vulnerability.

]]> CVE-2020-8553 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-8553/ Sun, 26 Feb 2023 06:43:26 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-8553/ The Kubernetes ingress-nginx component prior to version 0.28.0 allows a user with the ability to create namespaces and to read and create ingress objects to overwrite the password file of another ingress which uses nginx.ingress.kubernetes.io/auth-type: basic and which has a hyphenated namespace or secret name.

The post CVE-2020-8553 appeared first on CVE Vulnerability.

]]> The Kubernetes ingress-nginx component prior to version 0.28.0 allows a user with the ability to create namespaces and to read and create ingress objects to overwrite the password file of another ingress which uses nginx.ingress.kubernetes.io/auth-type: basic and which has a hyphenated namespace or secret name.

The post CVE-2020-8553 appeared first on CVE Vulnerability.

]]> CVE-2020-8561 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-8561/ Sun, 26 Feb 2023 06:43:26 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-8561/ A security issue was discovered in Kubernetes where actors that control the responses of MutatingWebhookConfiguration or ValidatingWebhookConfiguration requests are able to redirect kube-apiserver requests to private networks of the apiserver. If that user can view kube-apiserver logs when the log level is set to 10, they can view the redirected responses and headers in the […]

The post CVE-2020-8561 appeared first on CVE Vulnerability.

]]> A security issue was discovered in Kubernetes where actors that control the responses of MutatingWebhookConfiguration or ValidatingWebhookConfiguration requests are able to redirect kube-apiserver requests to private networks of the apiserver. If that user can view kube-apiserver logs when the log level is set to 10, they can view the redirected responses and headers in the logs.

The post CVE-2020-8561 appeared first on CVE Vulnerability.

]]> CVE-2020-6105 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-6105/ Sun, 26 Feb 2023 06:42:35 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-6105/ An exploitable code execution vulnerability exists in the multiple devices functionality of F2fs-Tools F2fs.Fsck 1.13. A specially crafted f2fs filesystem can cause Information overwrite resulting in a code execution. An attacker can provide a malicious file to trigger this vulnerability.

The post CVE-2020-6105 appeared first on CVE Vulnerability.

]]> An exploitable code execution vulnerability exists in the multiple devices functionality of F2fs-Tools F2fs.Fsck 1.13. A specially crafted f2fs filesystem can cause Information overwrite resulting in a code execution. An attacker can provide a malicious file to trigger this vulnerability.

The post CVE-2020-6105 appeared first on CVE Vulnerability.

]]> CVE-2020-5412 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-5412/ Sun, 26 Feb 2023 06:42:19 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-5412/ Spring Cloud Netflix, versions 2.2.x prior to 2.2.4, versions 2.1.x prior to 2.1.6, and older unsupported versions allow applications to use the Hystrix Dashboard proxy.stream endpoint to make requests to any server reachable by the server hosting the dashboard. A malicious user, or attacker, can send a request to other servers that should not be […]

The post CVE-2020-5412 appeared first on CVE Vulnerability.

]]> Spring Cloud Netflix, versions 2.2.x prior to 2.2.4, versions 2.1.x prior to 2.1.6, and older unsupported versions allow applications to use the Hystrix Dashboard proxy.stream endpoint to make requests to any server reachable by the server hosting the dashboard. A malicious user, or attacker, can send a request to other servers that should not be exposed publicly.

The post CVE-2020-5412 appeared first on CVE Vulnerability.

]]> CVE-2020-5296 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-5296/ Sun, 26 Feb 2023 06:42:16 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-5296/ In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, an attacker can exploit this vulnerability to delete arbitrary local files of an October CMS server. The vulnerability is only exploitable by an authenticated backend user with the `cms.manage_assets` permission. Issue has been patched in Build 466 (v1.0.466).

The post CVE-2020-5296 appeared first on CVE Vulnerability.

]]> In OctoberCMS (october/october composer package) versions from 1.0.319 and before 1.0.466, an attacker can exploit this vulnerability to delete arbitrary local files of an October CMS server. The vulnerability is only exploitable by an authenticated backend user with the `cms.manage_assets` permission. Issue has been patched in Build 466 (v1.0.466).

The post CVE-2020-5296 appeared first on CVE Vulnerability.

]]>