CWE-863 Archives - CVE Vulnerability

CVE-2008-7109

Sun, 26 Feb 2023 09:11:52 +0000

The Scanner File Utility (aka listener) in Kyocera Mita (KM) 3.3.0.1 allows remote attackers to bypass authorization and upload arbitrary files to the client system via a modified program that does not prompt the user for a password.

The post CVE-2008-7109 appeared first on CVE Vulnerability.

CVE-2008-6123

Sun, 26 Feb 2023 09:11:21 +0000

The netsnmp_udp_fmtaddr function (snmplib/snmpUDPDomain.c) in net-snmp 5.0.9 through 5.4.2.1, when using TCP wrappers for client authorization, does not properly parse hosts.allow rules, which allows remote attackers to bypass intended access restrictions and execute SNMP queries, related to “source/destination IP address confusion.”

The post CVE-2008-6123 appeared first on CVE Vulnerability.

CVE-2008-4577

Sun, 26 Feb 2023 09:10:36 +0000

The ACL plugin in Dovecot before 1.1.4 treats negative access rights as if they are positive access rights, which allows attackers to bypass intended access restrictions.

The post CVE-2008-4577 appeared first on CVE Vulnerability.

CVE-2008-3424

Sun, 26 Feb 2023 09:10:00 +0000

Condor before 7.0.4 does not properly handle wildcards in the ALLOW_WRITE, DENY_WRITE, HOSTALLOW_WRITE, or HOSTDENY_WRITE configuration variables in authorization policy lists, which might allow remote attackers to bypass intended access restrictions.

The post CVE-2008-3424 appeared first on CVE Vulnerability.

CVE-2008-0595

Sun, 26 Feb 2023 09:08:37 +0000

dbus-daemon in D-Bus before 1.0.3, and 1.1.x before 1.1.20, recognizes send_interface attributes in allow directives in the security policy only for fully qualified method calls, which allows local users to bypass intended access restrictions via a method call with a NULL interface.

The post CVE-2008-0595 appeared first on CVE Vulnerability.

CVE-2007-2586

Sun, 26 Feb 2023 09:06:22 +0000

The FTP Server in Cisco IOS 11.3 through 12.4 does not properly check user authorization, which allows remote attackers to execute arbitrary code, and have other impact including reading startup-config, as demonstrated by a crafted MKD command that involves access to a VTY device and overflows a buffer, aka bug ID CSCek55259.

The post CVE-2007-2586 appeared first on CVE Vulnerability.

CVE-2018-9488

Sun, 26 Feb 2023 06:51:49 +0000

In the SELinux permissions of crash_dump.te, there is a permissions bypass due to a missing restriction. This could lead to a local escalation of privilege, with System privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-8.0 Android-8.1 Android-9.0 Android ID: A-110107376.

The post CVE-2018-9488 appeared first on CVE Vulnerability.

CVE-2018-9492

Sun, 26 Feb 2023 06:51:49 +0000

In checkGrantUriPermissionLocked of ActivityManagerService.java, there is a possible permissions bypass. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Product: Android Versions: Android-8.0 Android-8.1 Android-9.0 Android ID: A-111934948

The post CVE-2018-9492 appeared first on CVE Vulnerability.

CVE-2018-8927

Sun, 26 Feb 2023 06:51:40 +0000

Improper authorization vulnerability in SYNO.Cal.Event in Calendar before 2.1.2-0511 allows remote authenticated users to create arbitrary events via the (1) cal_id or (2) original_cal_id parameter.

The post CVE-2018-8927 appeared first on CVE Vulnerability.

CVE-2018-8724

Sun, 26 Feb 2023 06:51:34 +0000

K7Computing Pvt Ltd K7AntiVirus Premium 15.1.0.53 is affected by: Incorrect Access Control. The impact is: gain privileges (local). The component is: K7TSMngr.exe.

The post CVE-2018-8724 appeared first on CVE Vulnerability.