CWE-670 Archives - CVE Vulnerability

CVE-2018-19212

Sun, 26 Feb 2023 06:48:05 +0000

In libwebm through 2018-10-03, there is an abort caused by libwebm::Webm2Pes::InitWebmParser() that will lead to a DoS attack.

The post CVE-2018-19212 appeared first on CVE Vulnerability.

CVE-2018-19058

Sun, 26 Feb 2023 06:48:01 +0000

An issue was discovered in Poppler 0.71.0. There is a reachable abort in Object.h, will lead to denial of service because EmbFile::save2 in FileSpec.cc lacks a stream check before saving an embedded file.

The post CVE-2018-19058 appeared first on CVE Vulnerability.

CVE-2018-16766

Sun, 26 Feb 2023 06:47:11 +0000

In WAVM through 2018-07-26, a crafted file sent to the WebAssembly Virtual Machine may cause a denial of service (application crash) or possibly have unspecified other impact because Errors::unreachable() is reached.

The post CVE-2018-16766 appeared first on CVE Vulnerability.

CVE-2020-9425

Sun, 26 Feb 2023 06:43:45 +0000

An issue was discovered in includes/head.inc.php in rConfig before 3.9.4. An unauthenticated attacker can retrieve saved cleartext credentials via a GET request to settings.php. Because the application was not exiting after a redirect is applied, the rest of the page still executed, resulting in the disclosure of cleartext credentials in the response.

The post CVE-2020-9425 appeared first on CVE Vulnerability.

CVE-2020-5753

Sun, 26 Feb 2023 06:42:26 +0000

Signal Private Messenger Android v4.59.0 and up and iOS v3.8.1.5 and up allows a remote non-contact to ring a victim’s Signal phone and disclose currently used DNS server due to ICE Candidate handling before call is answered or declined.

The post CVE-2020-5753 appeared first on CVE Vulnerability.

CVE-2020-3885

Sun, 26 Feb 2023 06:41:49 +0000

A logic issue was addressed with improved restrictions. This issue is fixed in iOS 13.4 and iPadOS 13.4, tvOS 13.4, Safari 13.1, iTunes for Windows 12.10.5, iCloud for Windows 10.9.3, iCloud for Windows 7.18. A file URL may be incorrectly processed.

The post CVE-2020-3885 appeared first on CVE Vulnerability.

CVE-2020-36277

Sun, 26 Feb 2023 06:41:35 +0000

Leptonica before 1.80.0 allows a denial of service (application crash) via an incorrect left shift in pixConvert2To8 in pixconv.c.

The post CVE-2020-36277 appeared first on CVE Vulnerability.

CVE-2020-3596

Sun, 26 Feb 2023 06:41:30 +0000

A vulnerability in the Session Initiation Protocol (SIP) of Cisco Expressway Series and Cisco TelePresence Video Communication Server (VCS) could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition on an affected device. The vulnerability is due to incorrect handling of incoming SIP traffic. An attacker could exploit this vulnerability by sending a series of SIP packets to an affected device. A successful exploit could allow the attacker to exhaust memory on an affected device, causing it to crash and leading to a DoS condition.

The post CVE-2020-3596 appeared first on CVE Vulnerability.

CVE-2020-35477

Sun, 26 Feb 2023 06:41:17 +0000

MediaWiki before 1.35.1 blocks legitimate attempts to hide log entries in some situations. If one sets MediaWiki:Mainpage to Special:MyLanguage/Main Page, visits a log entry on Special:Log, and toggles the “Change visibility of selected log entries” checkbox (or a tags checkbox) next to it, there is a redirection to the main page’s action=historysubmit (instead of the desired behavior in which a revision-deletion form appears).

The post CVE-2020-35477 appeared first on CVE Vulnerability.

CVE-2020-26506

Sun, 26 Feb 2023 06:40:02 +0000

An Authorization Bypass vulnerability in the Marmind web application with version 4.1.141.0 allows users with lower privileges to gain control to files uploaded by administrative users. The accessed files were not visible by the low privileged users in the web GUI.

The post CVE-2020-26506 appeared first on CVE Vulnerability.