CWE-862 Archives - CVE Vulnerability

CVE-2008-6548

Sun, 26 Feb 2023 09:11:34 +0000

The rst parser (parser/text_rst.py) in MoinMoin 1.6.1 does not check the ACL of an included page, which allows attackers to read unauthorized include files via unknown vectors.

The post CVE-2008-6548 appeared first on CVE Vulnerability.

CVE-2008-5027

Sun, 26 Feb 2023 09:10:49 +0000

The Nagios process in (1) Nagios before 3.0.5 and (2) op5 Monitor before 4.0.1 allows remote authenticated users to bypass authorization checks, and trigger execution of arbitrary programs by this process, via an (a) custom form or a (b) browser addon.

The post CVE-2008-5027 appeared first on CVE Vulnerability.

CVE-2007-2925

Sun, 26 Feb 2023 09:06:31 +0000

The default access control lists (ACL) in ISC BIND 9.4.0, 9.4.1, and 9.5.0a1 through 9.5.0a5 do not set the allow-recursion and allow-query-cache ACLs, which allows remote attackers to make recursive queries and query the cache.

The post CVE-2007-2925 appeared first on CVE Vulnerability.

CVE-2018-9548

Sun, 26 Feb 2023 06:51:50 +0000

In multiple functions of ContentProvider.java, there is a possible permission bypass due to a missing URI validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-7.0 Android-7.1.1 Android-7.1.2 Android-8.0 Android-8.1 Android-9. Android ID: A-112555574.

The post CVE-2018-9548 appeared first on CVE Vulnerability.

CVE-2018-9457

Sun, 26 Feb 2023 06:51:49 +0000

In onCheckedChanged of BluetoothPairingController.java, there is a possible way to retrieve contact information due to a permissions bypass. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android. Versions: Android-8.0 Android-8.1 Android-9. Android ID: A-72872376

The post CVE-2018-9457 appeared first on CVE Vulnerability.

CVE-2018-9039

Sun, 26 Feb 2023 06:51:42 +0000

In Octopus Deploy 2.0 and later before 2018.3.7, an authenticated user, with variable edit permissions, can scope some variables to targets greater than their permissions should allow. In other words, they can see machines beyond their team’s scoped environments.

The post CVE-2018-9039 appeared first on CVE Vulnerability.

CVE-2018-8755

Sun, 26 Feb 2023 06:51:35 +0000

NuCom WR644GACV devices before STA006 allow an attacker to download the configuration file without credentials. By downloading this file, an attacker can access the admin password, WPA key, and any config information of the device.

The post CVE-2018-8755 appeared first on CVE Vulnerability.

CVE-2018-8028

Sun, 26 Feb 2023 06:51:16 +0000

An authenticated user can execute ALTER TABLE EXCHANGE PARTITIONS without being authorized by Apache Sentry before 2.0.1. This can allow an attacker unauthorized access to the partitioned data of a Sentry protected table and can allow an attacker to remove data from a Sentry protected table.

The post CVE-2018-8028 appeared first on CVE Vulnerability.

CVE-2018-8012

Sun, 26 Feb 2023 06:51:15 +0000

No authentication/authorization is enforced when a server attempts to join a quorum in Apache ZooKeeper before 3.4.10, and 3.5.0-alpha through 3.5.3-beta. As a result an arbitrary end point could join the cluster and begin propagating counterfeit changes to the leader.

The post CVE-2018-8012 appeared first on CVE Vulnerability.

CVE-2018-7792

Sun, 26 Feb 2023 06:51:10 +0000

A Permissions, Privileges, and Access Control vulnerability exists in Schneider Electric’s Modicon M221 product (all references, all versions prior to firmware V1.6.2.0). The vulnerability allows unauthorized users to decode the password using rainbow table.

The post CVE-2018-7792 appeared first on CVE Vulnerability.