cve.bz

OWASP A08:2025 Software or Data Integrity Failures vulnerabilities, newest first, page 142

Filter

The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A08:2025 at MITRE.

Its weaknesses: 14

CWE-345, CWE-353, CWE-426, CWE-427, CWE-494, CWE-502, CWE-506, CWE-509, CWE-565, CWE-784, CWE-829, CWE-830, CWE-915, CWE-926

  1. 7.8CVE-2018-13133EPSS 0.3%

    Golden Frog VyprVPN before 2018-06-21 has a vulnerability associated with the installation process on Windows.

  2. 7.8CVE-2018-13102EPSS 1.1%

    AnyDesk before "12.06.2018 - 4.1.3" on Windows 7 SP1 has a DLL preloading vulnerability.

  3. 7.8CVE-2018-10874EPSS 0.5%

    In ansible it was found that inventory variables are loaded from current working directory when running ad-hoc command which are under attacker's control, allowing to run arbitrary code as a result.

  4. 8.1CVE-2018-13012EPSS 0.5%

    Download of code with improper integrity check in snsupd.exe and upd.exe in SAFE'N'SEC SoftControl/SafenSoft SysWatch, SoftControl/SafenSoft TPSecure, and SoftControl/SafenSoft Enterprise Suite before 4.4.12 allows the remote attacker to e…

  5. 7.8CVE-2018-12589ExploitEPSS 20%

    Polaris Office 2017 8.1 allows attackers to execute arbitrary code via a Trojan horse puiframeworkproresenu.dll file in the current working directory.

  6. 9.8CVE-2017-18342EPSS 5.6%

    In PyYAML before 5.1, the yaml.load() API could execute arbitrary code if used with untrusted data. The load() function has been deprecated in version 5.1 and the 'UnsafeLoader' has been introduced for backward compatibility with the funct…

  7. 7.2CVE-2018-1000527EPSS 2.6%

    Froxlor version <= 0.9.39.5 contains a PHP Object Injection vulnerability in Domain name form that can result in Possible information disclosure and remote code execution. This attack appear to be exploitable via Passing malicious PHP obje…

  8. 9.8CVE-2018-1000525EPSS 4.0%

    openpsa contains a PHP Object Injection vulnerability in Form data passed as GET request variables that can result in Possible information disclosure and remote code execution. This attack appear to be exploitable via Specially crafted GET…

  9. 7.2CVE-2018-1000509EPSS 2.0%

    Redirection version 2.7.1 contains a Serialisation vulnerability possibly allowing ACE vulnerability in Settings page AJAX that can result in could allow admin to execute arbitrary code in some circumstances. This attack appear to be explo…

  10. 7.2CVE-2018-1000502EPSS 1.3%

    MyBB Group MyBB contains a File Inclusion vulnerability in Admin panel (Tools and Maintenance -> Task Manager -> Add New Task) that can result in Allows Local File Inclusion on modern PHP versions and Remote File Inclusion on ancient PHP v…

  11. 7.8CVE-2018-0609EPSS 0.8%

    Untrusted search path vulnerability in LINE for Windows versions before 5.8.0 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.

  12. 7.8CVE-2018-0601EPSS 0.9%

    Untrusted search path vulnerability in axpdfium v0.01 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.

  13. 7.8CVE-2018-0600EPSS 1.0%

    Untrusted search path vulnerability in the installer of PlayMemories Home for Windows ver.5.5.01 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.

  14. 7.8CVE-2018-0599EPSS 5.0%

    Untrusted search path vulnerability in the installer of Visual C++ Redistributable allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.

  15. 7.8CVE-2018-0598EPSS 9.9%

    Untrusted search path vulnerability in Self-extracting archive files created by IExpress bundled with Microsoft Windows allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.

  16. 7.8CVE-2018-0597EPSS 5.4%

    Untrusted search path vulnerability in the installer of Visual Studio Code allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.

  17. 7.8CVE-2018-0596EPSS 5.4%

    Untrusted search path vulnerability in the installer of Visual Studio Community allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.

  18. 7.8CVE-2018-0595EPSS 5.4%

    Untrusted search path vulnerability in the installer of Skype for Windows allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.

  19. 7.8CVE-2018-0594EPSS 5.4%

    Untrusted search path vulnerability in Skype for Windows allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.

  20. 7.8CVE-2018-0593EPSS 5.4%

    Untrusted search path vulnerability in the installer of Microsoft OneDrive allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.

  21. 7.8CVE-2018-0592EPSS 5.4%

    Untrusted search path vulnerability in Microsoft OneDrive allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.

  22. 7.8CVE-2018-0563EPSS 1.0%

    Untrusted search path vulnerability in the installer of FLET'S VIRUS CLEAR Easy Setup & Application Tool ver.13.0 and earlier versions and FLET'S VIRUS CLEAR v6 Easy Setup & Application Tool ver.13.0 and earlier versions allows an attacker…

  23. 7.5CVE-2018-11040EPSS 3.2%

    Spring Framework, versions 5.0.x prior to 5.0.7 and 4.3.x prior to 4.3.18 and older unsupported versions, allows web applications to enable cross-domain requests via JSONP (JSON with Padding) through AbstractJsonpResponseBodyAdvice for RES…

  24. 7.8CVE-2018-1000201EPSS 1.3%

    ruby-ffi version 1.9.23 and earlier has a DLL loading issue which can be hijacked on Windows OS, when a Symbol is used as DLL name instead of a String This vulnerability appears to have been fixed in v1.9.24 and later.

  25. 8.1CVE-2018-12333EPSS 0.4%

    Insufficient Verification of Data Authenticity vulnerability in ECOS Secure Boot Stick (aka SBS) 5.6.5 allows an attacker to manipulate security relevant configurations and execute malicious code.

  26. 8.8CVE-2018-6497EPSS 0.6%

    Remote Cross-site Request forgery (CSRF) potential has been identified in UCMBD Server version DDM Content Pack V 10.20, 10.21, 10.22, 10.22 CUP7, 10.30, 10.31, 10.32, 10.33, 10.33 CUP2, 11.0 and CMS Server version 2018.05 BACKGROUND which…

  27. 8.8CVE-2018-6496EPSS 0.7%

    Remote Cross-site Request forgery (CSRF) potential has been identified in UCMBD Browser version 4.10, 4.11, 4.12, 4.13, 4.14, 4.15, 4.15.1 which could allow for remote unsafe deserialization and cross-site request forgery (CSRF).

  28. 7.8CVE-2017-7836EPSS 0.3%

    The "pingsender" executable used by the Firefox Health Report dynamically loads a system copy of libcurl, which an attacker could replace. This allows for privilege escalation as the replaced libcurl code will run with Firefox's privileges…

  29. 7.8CVE-2017-7755EPSS 1.4%

    The Firefox installer on Windows can be made to load malicious DLL files stored in the same directory as the installer when it is run. This allows privileged execution if the installer is run with elevated privileges. Note: This attack onl…

  30. 9.8CVE-2017-5397EPSS 3.6%

    The cache directory on the local file system is set to be world writable. Firefox defaults to extracting libraries from this cache. This allows for the possibility of an installed malicious application or tools with write access to the fil…

  31. 7.8CVE-2018-6514EPSS 0.8%

    In Puppet Agent 1.10.x prior to 1.10.13, Puppet Agent 5.3.x prior to 5.3.7, Puppet Agent 5.5.x prior to 5.5.2, Facter on Windows is vulnerable to a DLL preloading attack, which could lead to a privilege escalation.

  32. 8.8CVE-2018-6513EPSS 1.1%

    Puppet Enterprise 2016.4.x prior to 2016.4.12, Puppet Enterprise 2017.3.x prior to 2017.3.7, Puppet Enterprise 2018.1.x prior to 2018.1.1, Puppet Agent 1.10.x prior to 1.10.13, Puppet Agent 5.3.x prior to 5.3.7, and Puppet Agent 5.5.x prio…

  33. 9.8CVE-2017-3207EPSS 8.1%

    The Java implementations of AMF3 deserializers in WebORB for Java by Midnight Coders, version 5.1.1.0, derive class instances from java.io.Externalizable rather than the AMF3 specification's recommendation of flash.utils.IExternalizable. A…

  34. 8.1CVE-2017-3203EPSS 6.2%

    The Java implementations of AMF3 deserializers in Pivotal/Spring Spring-flex derive class instances from java.io.Externalizable rather than the AMF3 specification's recommendation of flash.utils.IExternalizable. A remote attacker with the …

  35. 9.8CVE-2017-3202EPSS 8.1%

    The Java implementation of AMF3 deserializers used in Flamingo amf-serializer by Exadel, version 2.2.0, may allow instantiation of arbitrary classes via their public parameter-less constructor and subsequently call arbitrary Java Beans set…

  36. 8.1CVE-2017-3201EPSS 5.2%

    The Java implementation of AMF3 deserializers used in Flamingo amf-serializer by Exadel, version 2.2.0 derives class instances from java.io.Externalizable rather than the AMF3 specification's recommendation of flash.utils.IExternalizable. …

  37. 8.1CVE-2017-3200EPSS 6.0%

    The Java implementation of AMF3 deserializers used in GraniteDS, version 3.1.1.G, may allow instantiation of arbitrary classes via their public parameter-less constructor and subsequently call arbitrary Java Beans setter methods. The abili…

  38. 8.1CVE-2017-3199EPSS 6.0%

    The Java implementation of GraniteDS, version 3.1.1.GA, AMF3 deserializers derives class instances from java.io.Externalizable rather than the AMF3 specification's recommendation of flash.utils.IExternalizable. A remote attacker with the a…

  39. 4.9CVE-2017-1405EPSS 0.5%

    IBM Security Identity Manager Virtual Appliance 7.0 processes patches, image backups and other updates without sufficiently verifying the origin and integrity of the code. IBM X-Force ID: 127392.

  40. 7.3CVE-2017-16207EPSS 0.7%

    discordi.js is a malicious module based on the discord.js library that exfiltrates login tokens to pastebin.

  41. 7.5CVE-2017-16205EPSS 1.1%

    The coffescript module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installation.

  42. 7.5CVE-2017-16204EPSS 1.1%

    The jquey module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installation.

  43. 7.5CVE-2017-16203EPSS 1.1%

    The coffe-script module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installation.

  44. 7.5CVE-2017-16202EPSS 1.2%

    The cofeescript module exfiltrates sensitive data such as a user's private SSH key and bash history to a third party server during installation.

  45. 9.8CVE-2017-16128EPSS 1.4%

    The module npm-script-demo opened a connection to a command and control server. It has been removed from the npm registry.

  46. 9.8CVE-2017-16127EPSS 1.4%

    The module pandora-doomsday infects other modules. It's since been unpublished from the registry.

  47. 7.5CVE-2017-16081EPSS 1.3%

    cross-env.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

  48. 7.5CVE-2017-16080EPSS 1.1%

    nodesass was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

  49. 7.5CVE-2017-16079EPSS 1.1%

    smb was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

  50. 7.5CVE-2017-16078EPSS 1.1%

    shadowsock was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.