CWE-669 Archives - CVE Vulnerability

CVE-2018-17791

Sun, 26 Feb 2023 06:47:34 +0000

Newgen OmniFlow Intelligent Business Process Suite (iBPS) 7.0 has an “improper server side validation” vulnerability where client-side validations are tampered, and inappropriate information is stored on the server side and fetched from the server every time the user visits the D, creating business confusion. In the worst case, all available resources are consumed while processing the data, resulting in unavailability of the service to legitimate users. This occurs because non-editable parameters can be modified by manually editing a disabled form field within the developer options.

The post CVE-2018-17791 appeared first on CVE Vulnerability.

CVE-2020-6862

Sun, 26 Feb 2023 06:42:53 +0000

V6.0.10P2T2 and V6.0.10P2T5 of F6x2W product are impacted by Information leak vulnerability. Unauthorized users could log in directly to obtain page information without entering a verification code.

The post CVE-2020-6862 appeared first on CVE Vulnerability.

CVE-2020-5800

Sun, 26 Feb 2023 06:42:27 +0000

The Eat Spray Love mobile app for both iOS and Android contains logic that allows users to bypass authentication and retrieve or modify information that they would not normally have access to.

The post CVE-2020-5800 appeared first on CVE Vulnerability.

CVE-2020-5188

Sun, 26 Feb 2023 06:42:14 +0000

DNN (formerly DotNetNuke) through 9.4.4 has Insecure Permissions.

The post CVE-2020-5188 appeared first on CVE Vulnerability.

CVE-2020-27268

Sun, 26 Feb 2023 06:40:18 +0000

In SOOIL Developments Co., Ltd Diabecare RS, AnyDana-i and AnyDana-A, a client-side control vulnerability in the insulin pump and its AnyDana-i and AnyDana-A mobile applications allows physically proximate attackers to bypass checks for default PINs via Bluetooth Low Energy.

The post CVE-2020-27268 appeared first on CVE Vulnerability.

CVE-2020-26177

Sun, 26 Feb 2023 06:39:57 +0000

In tangro Business Workflow before 1.18.1, a user’s profile contains some items that are greyed out and thus are not intended to be edited by regular users. However, this restriction is only applied client-side. Manipulating any of the greyed-out values in requests to /api/profile is not prohibited server-side.

The post CVE-2020-26177 appeared first on CVE Vulnerability.

CVE-2020-25917

Sun, 26 Feb 2023 06:39:53 +0000

Stratodesk NoTouch Center before 4.4.68 is affected by: Incorrect Access Control. A low privileged user on the platform, for example a user with “helpdesk” privileges, can perform privileged operations including adding a new administrator to the platform via the easyadmin/user/submitCreateTCUser.do page.

The post CVE-2020-25917 appeared first on CVE Vulnerability.

CVE-2020-24683

Sun, 26 Feb 2023 06:39:31 +0000

The affected versions of S+ Operations (version 2.1 SP1 and earlier) used an approach for user authentication which relies on validation at the client node (client-side authentication). This is not as secure as having the server validate a client application before allowing a connection. Therefore, if the network communication or endpoints for these applications are not protected, unauthorized actors can bypass authentication and make unauthorized connections to the server application.

The post CVE-2020-24683 appeared first on CVE Vulnerability.

CVE-2020-15892

Sun, 26 Feb 2023 06:38:01 +0000

An issue was discovered in apply.cgi on D-Link DAP-1520 devices before 1.10b04Beta02. Whenever a user performs a login action from the web interface, the request values are being forwarded to the ssi binary. On the login page, the web interface restricts the password input field to a fixed length of 15 characters. The problem is that validation is being done on the client side, hence it can be bypassed. When an attacker manages to intercept the login request (POST based) and tampers with the vulnerable parameter (log_pass), to a larger length, the request will be forwarded to the webserver. This results in a stack-based buffer overflow. A few other POST variables, (transferred as part of the login request) are also vulnerable: html_response_page and log_user.

The post CVE-2020-15892 appeared first on CVE Vulnerability.

CVE-2020-15257

Sun, 26 Feb 2023 06:37:46 +0000

containerd is an industry-standard container runtime and is available as a daemon for Linux and Windows. In containerd before versions 1.3.9 and 1.4.3, the containerd-shim API is improperly exposed to host network containers. Access controls for the shim’s API socket verified that the connecting process had an effective UID of 0, but did not otherwise restrict access to the abstract Unix domain socket. This would allow malicious containers running in the same network namespace as the shim, with an effective UID of 0 but otherwise reduced privileges, to cause new processes to be run with elevated privileges. This vulnerability has been fixed in containerd 1.3.9 and 1.4.3. Users should update to these versions as soon as they are released. It should be noted that containers started with an old version of containerd-shim should be stopped and restarted, as running containers will continue to be vulnerable even after an upgrade. If you are not providing the ability for untrusted users to start containers in the same network namespace as the shim (typically the “host” network namespace, for example with docker run –net=host or hostNetwork: true in a Kubernetes pod) and run with an effective UID of 0, you are not vulnerable to this issue. If you are running containers with a vulnerable configuration, you can deny access to all abstract sockets with AppArmor by adding a line similar to deny unix addr=@**, to your policy. It is best practice to run containers with a reduced set of privileges, with a non-zero UID, and with isolated namespaces. The containerd maintainers strongly advise against sharing namespaces with the host. Reducing the set of isolation mechanisms used for a container necessarily increases that container’s privilege, regardless of what container runtime is used for running that container.

The post CVE-2020-15257 appeared first on CVE Vulnerability.