CWE-749 Archives - CVE Vulnerability

CVE-2007-6382

Sun, 26 Feb 2023 09:08:08 +0000

The Event Dispatch Thread in Robocode before 1.5.1 allows remote attackers to execute arbitrary Java code by using a robot to invoke the SwingUtilities.invokeLater method.

The post CVE-2007-6382 appeared first on CVE Vulnerability.

CVE-2007-1112

Sun, 26 Feb 2023 09:05:44 +0000

Kaspersky Anti-Virus 6.0 and Internet Security 6.0 exposes unsafe methods in the (a) AXKLPROD60Lib.KAV60Info (AxKLProd60.dll) and (b) AXKLSYSINFOLib.SysInfo (AxKLSysInfo.dll) ActiveX controls, which allows remote attackers to “download” or delete arbitrary files via crafted arguments to the (1) DeleteFile, (2) StartBatchUploading, (3) StartStrBatchUploading, or (4) StartUploading methods.

The post CVE-2007-1112 appeared first on CVE Vulnerability.

CVE-2018-8949

Sun, 26 Feb 2023 06:51:40 +0000

An issue was discovered in app/Model/Attribute.php in MISP before 2.4.89. There is a critical API integrity bug, potentially allowing users to delete attributes of other events. A crafted edit for an event (without attribute UUIDs but attribute IDs set) could overwrite an existing attribute.

The post CVE-2018-8949 appeared first on CVE Vulnerability.

CVE-2018-19322

Sun, 26 Feb 2023 06:48:07 +0000

The GPCIDrv and GDrv low-level drivers in GIGABYTE APP Center v1.05.21 and earlier, AORUS GRAPHICS ENGINE before 1.57, XTREME GAMING ENGINE before 1.26, and OC GURU II v2.08 expose functionality to read/write data from/to IO ports. This could be leveraged in a number of ways to ultimately run code with elevated privileges.

The post CVE-2018-19322 appeared first on CVE Vulnerability.

CVE-2018-10931

Sun, 26 Feb 2023 06:45:03 +0000

It was found that cobbler 2.6.x exposed all functions from its CobblerXMLRPCInterface class over XMLRPC. A remote, unauthenticated attacker could use this flaw to gain high privileges within cobbler, upload files to arbitrary location in the context of the daemon.

The post CVE-2018-10931 appeared first on CVE Vulnerability.

CVE-2020-17388

Sun, 26 Feb 2023 06:38:29 +0000

This vulnerability allows remote attackers to execute arbitrary code on affected installations of Marvell QConvergeConsole 5.5.0.64. Although authentication is required to exploit this vulnerability, the existing authentication mechanism can be bypassed. The specific flaw exists within the Tomcat configuration file. The issue results from the lack of proper restriction to the Tomcat admin console. An attacker can leverage this vulnerability to execute code in the context of SYSTEM. Was ZDI-CAN-10799.

The post CVE-2020-17388 appeared first on CVE Vulnerability.

CVE-2020-17391

Sun, 26 Feb 2023 06:38:29 +0000

This vulnerability allows local attackers to disclose information on affected installations of Parallels Desktop 15.1.3-47255. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the handler for HOST_IOCTL_INIT_HYPERVISOR in the prl_hypervisor kext. The issue results from the exposure of dangerous method or function to the unprivileged user. An attacker can leverage this in conjunction with other vulnerabilities to execute arbitrary code in the context of the kernel. Was ZDI-CAN-10518.

The post CVE-2020-17391 appeared first on CVE Vulnerability.

CVE-2020-15623

Sun, 26 Feb 2023 06:37:54 +0000

This vulnerability allows remote attackers to write arbitrary files on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_mod_security.php. When parsing the archivo parameter, the process does not properly validate a user-supplied path prior to using it in file operations. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9722.

The post CVE-2020-15623 appeared first on CVE Vulnerability.

CVE-2019-4386

Sun, 26 Feb 2023 06:33:23 +0000

IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.1 could allow an authenticated user to execute a function that would cause the server to crash. IBM X-Force ID: 162714.

The post CVE-2019-4386 appeared first on CVE Vulnerability.

CVE-2019-12948

Sun, 26 Feb 2023 06:30:04 +0000

A vulnerability in the web-based management interface of VVX, Trio, SoundStructure, SoundPoint, and SoundStation phones running Polycom UC Software, if exploited, could allow an authenticated, remote attacker with admin privileges to cause a denial of service (DoS) condition or execute arbitrary code.

The post CVE-2019-12948 appeared first on CVE Vulnerability.