OWASP A08:2025 Software or Data Integrity Failures vulnerabilities, newest first, page 114

The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A08:2025 at MITRE.

1. 7.8CVE-2022-0483EPSS 0.2%2022-02-11

   Local privilege escalation due to insecure folder permissions. The following products are affected: Acronis VSS Doctor (Windows) before build 53

2. 8.8CVE-2022-24289EPSS 2.3%2022-02-11

   Hessian serialization is a network protocol that supports object-based transmission. Apache Cayenne's optional Remote Object Persistence (ROP) feature is a web services-based technology that provides object persistence and query functional…

3. 9.8CVE-2022-24955EPSS 1.1%2022-02-11

   Foxit PDF Reader before 11.2.1 and Foxit PDF Editor before 11.2.1 have an Uncontrolled Search Path Element for DLL files.

4. 7.5CVE-2022-23630EPSS 1.3%2022-02-10

   Gradle is a build tool with a focus on build automation and support for multi-language development. In some cases, Gradle may skip that verification and accept a dependency that would otherwise fail the build as an untrusted external artif…

5. 6.8CVE-2021-44850EPSS 0.2%2022-02-10

   On Xilinx Zynq-7000 SoC devices, physical modification of an SD boot image allows for a buffer overflow attack in the ROM. Because the Zynq-7000's boot image header is unencrypted and unauthenticated before use, an attacker can modify the …

6. 7.8CVE-2022-22528EPSS 0.3%2022-02-09

   SAP Adaptive Server Enterprise (ASE) - version 16.0, installation makes an entry in the system PATH environment variable in Windows platform which, under certain conditions, allows a Standard User to execute malicious Windows binaries whic…

7. 7.8CVE-2021-33101EPSS 0.2%2022-02-09

   Uncontrolled search path in the Intel(R) GPA software before version 21.2 may allow an authenticated user to potentially enable escalation of privilege via local access.

8. 6.7CVE-2021-0169EPSS 0.2%2022-02-09

   Uncontrolled Search Path Element in software for Intel(R) PROSet/Wireless Wi-Fi in Windows 10 and 11 may allow a privileged user to potentially enable escalation of privilege via local access.

9. 5.1CVE-2022-22567EPSS 0.1%2022-02-09

   Select Dell Client Commercial and Consumer platforms are vulnerable to an insufficient verification of data authenticity vulnerability. An authenticated malicious user may exploit this vulnerability in order to install modified BIOS firmwa…

10. 8.8CVE-2022-22005EPSS 17%2022-02-09

    Microsoft SharePoint Server Remote Code Execution Vulnerability

11. 7.5CVE-2022-0538EPSS 3.9%2022-02-09

    Jenkins 2.333 and earlier, LTS 2.319.2 and earlier defines custom XStream converters that have not been updated to apply the protections for the vulnerability CVE-2021-43859 and allow unconstrained resource usage.

12. 7.3CVE-2021-44206EPSS 0.2%2022-02-04

    Local privilege escalation due to DLL hijacking vulnerability in Acronis Media Builder service. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 39612, Acronis True Image 2021 (Windows) before b…

13. 7.3CVE-2021-44205EPSS 0.2%2022-02-04

    Local privilege escalation due to DLL hijacking vulnerability. The following products are affected: Acronis Cyber Protect Home Office (Windows) before build 39612, Acronis True Image 2021 (Windows) before build 39287

14. 7.8CVE-2020-12891EPSS 0.3%2022-02-04

    AMD Radeon Software may be vulnerable to DLL Hijacking through path variable. An unprivileged user may be able to drop its malicious DLL file in any location which is in path environment variable.

15. 8.2CVE-2021-41841EPSS 0.3%2022-02-03

    An issue was discovered in AhciBusDxe in the kernel 5.0 through 5.5 in Insyde InsydeH2O. There is an SMM callout that allows an attacker to access the System Management Mode and execute arbitrary code. This occurs because of Inclusion of F…

16. 8.1CVE-2021-42631EPSS 6.2%2022-01-31

    PrinterLogic Web Stack versions 19.1.1.13 SP9 and below deserializes attacker controlled leading to pre-auth remote code execution.

17. 9.8CVE-2022-22994EPSS 1.9%2022-01-28

    A remote code execution vulnerability was discovered on Western Digital My Cloud devices where an attacker could trick a NAS device into loading through an unsecured HTTP call. This was a result insufficient verification of calls to the de…

18. 7.3CVE-2021-44463EPSS 0.3%2022-01-28

    Missing DLLs, if replaced by an insider, could allow an attacker to achieve local privilege escalation on the DeltaV Distributed Control System Controllers and Workstations (All versions) when some DeltaV services are started.

19. 9.8CVE-2021-45899EPSS 2.2%2022-01-28

    SuiteCRM before 7.12.3 and 8.x before 8.0.2 allows PHAR deserialization that can lead to remote code execution.

20. 7.8CVE-2021-45975EPSS 0.6%2022-01-26

    In ListCheck.exe in Acer Care Center 4.x before 4.00.3038, a vulnerability in the loading mechanism of Windows DLLs could allow a local attacker to perform a DLL hijacking attack. This vulnerability is due to incorrect handling of director…

21. 8.1CVE-2021-41766EPSS 2.0%2022-01-26

    Apache Karaf allows monitoring of applications and the Java runtime by using the Java Management Extensions (JMX). JMX is a Java RMI based technology that relies on Java serialized objects for client server communication. Whereas the defau…

22. 7.5CVE-2021-46559EPSS 0.4%2022-01-26

    The firmware on Moxa TN-5900 devices through 3.1 has a weak algorithm that allows an attacker to defeat an inspection mechanism for integrity protection.

23. 8.0CVE-2021-36338EPSS 0.4%2022-01-21

    Unisphere for PowerMax versions prior to 9.2.2.2 contains a privilege escalation vulnerability. An adjacent malicious user could potentially exploit this vulnerability to escalate their privileges and access functionalities they do not hav…

24. 5.3CVE-2022-21341EPSS 3.8%2022-01-19

    Vulnerability in the Oracle Java SE, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Serialization). Supported versions that are affected are Oracle Java SE: 7u321, 8u311, 11.0.13, 17.0.1; Oracle GraalVM Enterprise …

25. 7.8CVE-2022-0166EPSS 2.9%2022-01-19

    A privilege escalation vulnerability in the McAfee Agent prior to 5.7.5. McAfee Agent uses openssl.cnf during the build process to specify the OPENSSLDIR variable as a subdirectory within the installation directory. A low privilege user co…

26. 8.8CVE-2022-23307EPSS 54%2022-01-18

    CVE-2020-9493 identified a deserialization issue that was present in Apache Chainsaw. Prior to Chainsaw V2.0 Chainsaw was a component of Apache Log4j 1.2.x where the same issue exists.

27. 8.8CVE-2022-23302EPSS 64%2022-01-18

    JMSSink in all versions of Log4j 1.x is vulnerable to deserialization of untrusted data when the attacker has write access to the Log4j configuration or if the configuration references an LDAP service the attacker has access to. The attack…

28. 8.8CVE-2021-45394EPSS 1.6%2022-01-18

    An issue was discovered in Spipu HTML2PDF before 5.2.4. Attackers can trigger deserialization of arbitrary data via the injection of a malicious <link> tag in the converted HTML document.

29. 7.8CVE-2022-0015EPSS 0.2%2022-01-12

    A local privilege escalation (PE) vulnerability exists in the Palo Alto Networks Cortex XDR agent that enables an authenticated local user to execute programs with elevated privileges. This issue impacts: Cortex XDR agent 5.0 versions earl…

30. 7.3CVE-2022-0014EPSS 0.2%2022-01-12

    An untrusted search path vulnerability exists in the Palo Alto Networks Cortex XDR agent that enables a local attacker with file creation privilege in the Windows root directory (such as C:\) to store a program that can then be unintention…

31. 6.7CVE-2022-0129EPSS 0.3%2022-01-11

    Uncontrolled search path element vulnerability in McAfee TechCheck prior to 4.0.0.2 allows a local administrator to load their own Dynamic Link Library (DLL) gaining elevation of privileges to system user. This was achieved through placing…

32. 8.6CVE-2022-21668EPSS 3.9%2022-01-10

    pipenv is a Python development workflow tool. Starting with version 2018.10.9 and prior to version 2022.1.8, a flaw in pipenv's parsing of requirements files allows an attacker to insert a specially crafted string inside a comment anywhere…

33. 9.8CVE-2021-43297EPSS 17%2022-01-10

    A deserialization vulnerability existed in dubbo hessian-lite 3.2.11 and its earlier versions, which could lead to malicious code execution. Most Dubbo users use Hessian2 as the default serialization/deserialization protocol, during Hessia…

34. 9.8CVE-2021-42392ExploitEPSS 83%2022-01-10

    The org.h2.util.JdbcUtils.getConnection method of the H2 database takes as parameters the class name of the driver and URL of the database. An attacker may pass a JNDI driver name and a URL leading to a LDAP or RMI servers, causing remote …

35. 7.8CVE-2021-30360EPSS 0.6%2022-01-10

    Users have access to the directory where the installation repair occurs. Since the MS Installer allows regular users to run the repair, an attacker can initiate the installation repair and place a specially crafted EXE in the repair folder…

36. 6.5CVE-2020-10137EPSS 0.7%2022-01-10

    Z-Wave devices based on Silicon Labs 700 series chipsets using S2 do not adequately authenticate or encrypt FIND_NODE_IN_RANGE frames, allowing a remote, unauthenticated attacker to inject a FIND_NODE_IN_RANGE frame with an invalid random …

37. 7.2CVE-2022-21663EPSS 3.8%2022-01-06

    WordPress is a free and open-source content management system written in PHP and paired with a MariaDB database. On a multisite, users with Super Admin role can bypass explicit/additional hardening under certain conditions through object i…

38. 9.8CVE-2022-21647EPSS 38%2022-01-04

    CodeIgniter is an open source PHP full-stack web framework. Deserialization of Untrusted Data was found in the `old()` function in CodeIgniter4. Remote attackers may inject auto-loadable arbitrary objects with this vulnerability, and possi…

39. 7.8CVE-2021-44168KEVEPSS 0.9%2022-01-04

    A download of code without integrity check vulnerability in the "execute restore src-vis" command of FortiOS before 7.0.3 may allow a local authenticated attacker to download arbitrary files on the device via specially crafted update packa…

40. 4.2CVE-2021-36751EPSS 0.5%2022-01-02

    ENC DataVault 7.2.3 and before, and OEM versions, use an encryption algorithm that is vulnerable to data manipulation (without knowledge of the key). This is called ciphertext malleability. There is no data integrity mechanism to detect th…

41. 7.5CVE-2021-41819EPSS 3.2%2022-01-01

    CGI::Cookie.parse in Ruby through 2.6.8 mishandles security prefixes in cookie names. This also affects the CGI gem through 0.3.0 for Ruby.

42. 9.8CVE-2020-7883EPSS 1.0%2021-12-28

    Printchaser v2.2021.804.1 and earlier versions contain a vulnerability, which could allow remote attacker to download and execute remote file by setting the argument, variable in the activeX module. This can be leveraged for code execution.

43. 9.8CVE-2020-7878EPSS 0.7%2021-12-28

    An arbitrary file download and execution vulnerability was found in the VideoOffice X2.9 and earlier versions (CVE-2020-7878). This issue is due to missing support for integrity check.

44. 7.2CVE-2021-20318EPSS 1.8%2021-12-23

    The HornetQ component of Artemis in EAP 7 was not updated with the fix for CVE-2016-4978. A remote attacker could use this flaw to execute arbitrary code with the permissions of the application using a JMS ObjectMessage.

45. 7.8CVE-2021-4118EPSS 1.0%2021-12-23

    pytorch-lightning is vulnerable to Deserialization of Untrusted Data

46. 5.4CVE-2021-43853EPSS 0.9%2021-12-22

    Ajax.NET Professional (AjaxPro) is an AJAX framework available for Microsoft ASP.NET. Affected versions of this package are vulnerable to JavaScript object injection which may result in cross site scripting when leveraged by a malicious us…

47. 8.8CVE-2021-45419EPSS 0.5%2021-12-22

    Certain Starcharge products are affected by Improper Input Validation. The affected products include: Nova 360 Cabinet <= 1.3.0.0.7b102 - Fixed: Beta1.3.0.1.0 and Titan 180 Premium <= 1.3.0.0.6 - Fixed: 1.3.0.0.9.

48. 9.8CVE-2021-44029EPSS 0.9%2021-12-22

    An issue was discovered in Quest KACE Desktop Authority before 11.2. This vulnerability allows attackers to execute remote code through a deserialization exploitation in the RadAsyncUpload function of ASP.NET AJAX. An attacker can leverage…

49. 9.8CVE-2021-36336EPSS 1.7%2021-12-21

    Wyse Management Suite 3.3.1 and below versions contain a deserialization vulnerability that could allow an unauthenticated attacker to execute code on the affected system.

50. 6.6CVE-2021-42550EPSS 4.8%2021-12-16

    In logback version 1.2.7 and prior versions, an attacker with the required privileges to edit configurations files could craft a malicious configuration allowing to execute arbitrary code loaded from LDAP servers.