CWE-697 Archives - CVE Vulnerability https://cvevulnerability.com/cwe_categories/cwe-697/ Sun, 26 Feb 2023 06:43:33 +0000 en-US hourly 1 https://wordpress.org/?v=7.0 https://cvevulnerability.com/wp-content/uploads/2023/02/cropped-Screenshot-2023-02-27-at-3.52.32-PM-32x32.png CWE-697 Archives - CVE Vulnerability https://cvevulnerability.com/cwe_categories/cwe-697/ 32 32 CVE-2020-8864 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-8864/ Sun, 26 Feb 2023 06:43:33 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-8864/ This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-867, DIR-878, and DIR-882 routers with firmware 1.10B04. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of HNAP login requests. The issue results from the lack of proper handling of empty passwords. An attacker can […]

The post CVE-2020-8864 appeared first on CVE Vulnerability.

]]> This vulnerability allows network-adjacent attackers to bypass authentication on affected installations of D-Link DIR-867, DIR-878, and DIR-882 routers with firmware 1.10B04. Authentication is not required to exploit this vulnerability. The specific flaw exists within the handling of HNAP login requests. The issue results from the lack of proper handling of empty passwords. An attacker can leverage this vulnerability to execute arbitrary code on the router. Was ZDI-CAN-9471.

The post CVE-2020-8864 appeared first on CVE Vulnerability.

]]> CVE-2020-5849 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-5849/ Sun, 26 Feb 2023 06:42:28 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-5849/ Unraid 6.8.0 allows authentication bypass.

The post CVE-2020-5849 appeared first on CVE Vulnerability.

]]> Unraid 6.8.0 allows authentication bypass.

The post CVE-2020-5849 appeared first on CVE Vulnerability.

]]> CVE-2020-25580 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-25580/ Sun, 26 Feb 2023 06:39:45 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-25580/ In FreeBSD 12.2-STABLE before r369346, 11.4-STABLE before r369345, 12.2-RELEASE before p4 and 11.4-RELEASE before p8 a regression in the login.access(5) rule processor has the effect of causing rules to fail to match even when they should not. This means that rules denying access may be ignored.

The post CVE-2020-25580 appeared first on CVE Vulnerability.

]]> In FreeBSD 12.2-STABLE before r369346, 11.4-STABLE before r369345, 12.2-RELEASE before p4 and 11.4-RELEASE before p8 a regression in the login.access(5) rule processor has the effect of causing rules to fail to match even when they should not. This means that rules denying access may be ignored.

The post CVE-2020-25580 appeared first on CVE Vulnerability.

]]> CVE-2020-23478 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-23478/ Sun, 26 Feb 2023 06:39:16 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-23478/ Leo Editor v6.2.1 was discovered to contain a regular expression denial of service (ReDoS) vulnerability in the component plugins/importers/dart.py.

The post CVE-2020-23478 appeared first on CVE Vulnerability.

]]> Leo Editor v6.2.1 was discovered to contain a regular expression denial of service (ReDoS) vulnerability in the component plugins/importers/dart.py.

The post CVE-2020-23478 appeared first on CVE Vulnerability.

]]> CVE-2020-23360 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-23360/ Sun, 26 Feb 2023 06:39:16 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-23360/ oscommerce v2.3.4.1 has a functional problem in user registration and password rechecking, where a non-identical password can bypass the checks in /catalog/admin/administrators.php and /catalog/password_reset.php

The post CVE-2020-23360 appeared first on CVE Vulnerability.

]]> oscommerce v2.3.4.1 has a functional problem in user registration and password rechecking, where a non-identical password can bypass the checks in /catalog/admin/administrators.php and /catalog/password_reset.php

The post CVE-2020-23360 appeared first on CVE Vulnerability.

]]> CVE-2020-23359 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-23359/ Sun, 26 Feb 2023 06:39:16 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-23359/ WeBid 1.2.2 admin/newuser.php has an issue with password rechecking during registration because it uses a loose comparison to check the identicalness of two passwords. Two non-identical passwords can still bypass the check.

The post CVE-2020-23359 appeared first on CVE Vulnerability.

]]> WeBid 1.2.2 admin/newuser.php has an issue with password rechecking during registration because it uses a loose comparison to check the identicalness of two passwords. Two non-identical passwords can still bypass the check.

The post CVE-2020-23359 appeared first on CVE Vulnerability.

]]> CVE-2020-22784 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-22784/ Sun, 26 Feb 2023 06:39:11 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-22784/ In Etherpad UeberDB < 0.4.4, due to MySQL omitting trailing spaces on char / varchar columns during comparisons, retrieving database records using UeberDB's MySQL connector could allow bypassing access controls enforced on key names.

The post CVE-2020-22784 appeared first on CVE Vulnerability.

]]> In Etherpad UeberDB < 0.4.4, due to MySQL omitting trailing spaces on char / varchar columns during comparisons, retrieving database records using UeberDB's MySQL connector could allow bypassing access controls enforced on key names.

The post CVE-2020-22784 appeared first on CVE Vulnerability.

]]> CVE-2020-1920 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-1920/ Sun, 26 Feb 2023 06:38:43 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-1920/ A regular expression denial of service (ReDoS) vulnerability in the validateBaseUrl function can cause the application to use excessive resources, become unresponsive, or crash. This was introduced in react-native version 0.59.0 and fixed in version 0.64.1.

The post CVE-2020-1920 appeared first on CVE Vulnerability.

]]> A regular expression denial of service (ReDoS) vulnerability in the validateBaseUrl function can cause the application to use excessive resources, become unresponsive, or crash. This was introduced in react-native version 0.59.0 and fixed in version 0.64.1.

The post CVE-2020-1920 appeared first on CVE Vulnerability.

]]> CVE-2020-15811 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-15811/ Sun, 26 Feb 2023 06:37:59 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-15811/ An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. Due to incorrect data validation, HTTP Request Splitting attacks may succeed against HTTP and HTTPS traffic. This leads to cache poisoning. This allows any client, including browser scripts, to bypass local security and poison the browser cache and any downstream caches with content […]

The post CVE-2020-15811 appeared first on CVE Vulnerability.

]]> An issue was discovered in Squid before 4.13 and 5.x before 5.0.4. Due to incorrect data validation, HTTP Request Splitting attacks may succeed against HTTP and HTTPS traffic. This leads to cache poisoning. This allows any client, including browser scripts, to bypass local security and poison the browser cache and any downstream caches with content from an arbitrary source. Squid uses a string search instead of parsing the Transfer-Encoding header to find chunked encoding. This allows an attacker to hide a second request inside Transfer-Encoding: it is interpreted by Squid as chunked and split out into a second request delivered upstream. Squid will then deliver two distinct responses to the client, corrupting any downstream caches.

The post CVE-2020-15811 appeared first on CVE Vulnerability.

]]> CVE-2020-15131 https://cvevulnerability.com/cve_vulnerabilities/cve-2020-15131/ Sun, 26 Feb 2023 06:37:42 +0000 https://www.cvevulnerability.com/cve_vulnerabilities/cve-2020-15131/ In SLP Validate (npm package slp-validate) before version 1.2.2, there is a vulnerability to false-positive validation outcomes for the NFT1 Child Genesis transaction type. A poorly implemented SLP wallet or opportunistic attacker could create a seemingly valid NFT1 child token without burning any of the NFT1 Group token type as is required by the NFT1 […]

The post CVE-2020-15131 appeared first on CVE Vulnerability.

]]> In SLP Validate (npm package slp-validate) before version 1.2.2, there is a vulnerability to false-positive validation outcomes for the NFT1 Child Genesis transaction type. A poorly implemented SLP wallet or opportunistic attacker could create a seemingly valid NFT1 child token without burning any of the NFT1 Group token type as is required by the NFT1 specification. This is fixed in version 1.2.2.

The post CVE-2020-15131 appeared first on CVE Vulnerability.

]]>