cve.bz

OWASP A08:2025 Software or Data Integrity Failures vulnerabilities, newest first, page 143

Filter

The records that name a CWE MITRE's catalog puts in this OWASP Top 10 category. What the category is: A08:2025 at MITRE.

Its weaknesses: 14

CWE-345, CWE-353, CWE-426, CWE-427, CWE-494, CWE-502, CWE-506, CWE-509, CWE-565, CWE-784, CWE-829, CWE-830, CWE-915, CWE-926

  1. 7.5CVE-2017-16077EPSS 1.2%

    mongose was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

  2. 7.5CVE-2017-16076EPSS 1.1%

    proxy.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

  3. 7.5CVE-2017-16075EPSS 1.2%

    http-proxy.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

  4. 7.5CVE-2017-16074EPSS 1.2%

    crossenv was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

  5. 7.5CVE-2017-16073EPSS 1.1%

    noderequest was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

  6. 7.5CVE-2017-16072EPSS 1.2%

    nodemailer.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

  7. 7.5CVE-2017-16071EPSS 1.1%

    nodemailer-js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

  8. 7.5CVE-2017-16070EPSS 1.2%

    nodecaffe was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

  9. 7.5CVE-2017-16069EPSS 1.2%

    nodeffmpeg was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

  10. 7.5CVE-2017-16068EPSS 1.2%

    ffmepg was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

  11. 7.5CVE-2017-16067EPSS 1.1%

    node-opencv was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

  12. 7.5CVE-2017-16066EPSS 1.1%

    opencv.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

  13. 7.5CVE-2017-16065EPSS 1.2%

    openssl.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

  14. 7.5CVE-2017-16064EPSS 1.2%

    node-openssl was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

  15. 7.5CVE-2017-16063EPSS 1.1%

    node-opensl was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

  16. 7.5CVE-2017-16060EPSS 1.2%

    babelcli was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

  17. 7.5CVE-2017-16059EPSS 1.1%

    mssql-node was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

  18. 7.5CVE-2017-16058EPSS 1.1%

    gruntcli was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

  19. 7.5CVE-2017-16057EPSS 1.1%

    nodemssql was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

  20. 7.5CVE-2017-16056EPSS 1.1%

    mssql.js was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

  21. 7.8CVE-2018-7884EPSS 0.9%

    An issue was discovered in DisplayLink Core Software Cleaner Application 8.2.1956. When the drivers are updated to a newer version, the product launches a process as SYSTEM to uninstall the old version: cl_1956.exe is run as SYSTEM on the …

  22. 7.5CVE-2017-16055EPSS 1.1%

    `sqlserver` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

  23. 7.5CVE-2017-16054EPSS 1.2%

    `nodefabric` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

  24. 7.5CVE-2017-16053EPSS 1.1%

    `fabric-js` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

  25. 7.5CVE-2017-16052EPSS 1.2%

    `node-fabric` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

  26. 7.5CVE-2017-16051EPSS 1.3%

    `sqliter` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

  27. 7.5CVE-2017-16050EPSS 1.1%

    `sqlite.js` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

  28. 7.5CVE-2017-16049EPSS 1.2%

    `nodesqlite` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

  29. 7.5CVE-2017-16048EPSS 1.2%

    `node-sqlite` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

  30. 7.5CVE-2017-16046EPSS 1.1%

    `mariadb` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

  31. 7.5CVE-2017-16045EPSS 1.1%

    `jquery.js` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

  32. 7.5CVE-2017-16044EPSS 1.5%

    `d3.js` was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

  33. 7.8CVE-2018-11551EPSS 2.5%

    AXON PBX 2.02 contains a DLL hijacking vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary code on a targeted system. The vulnerability exists because a DLL file is loaded by 'pbxsetup.exe' improperly.

  34. 7.5CVE-2017-16062EPSS 1.1%

    node-tkinter was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

  35. 7.5CVE-2017-16061EPSS 1.1%

    tkinter was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

  36. 7.5CVE-2017-16047EPSS 1.3%

    mysqljs was a malicious module published with the intent to hijack environment variables. It has been unpublished by npm.

  37. 9.8CVE-2018-8013EPSS 19%

    In Apache Batik 1.x before 1.10, when deserializing subclass of `AbstractDocument`, the class takes a string from the inputStream as the class name which then use it to call the no-arg constructor of the class. Fix was to check the class t…

  38. 8.1CVE-2018-10654EPSS 1.2%

    There is a Hazelcast Library Java Deserialization Vulnerability in Citrix XenMobile Server 10.8 before RP2 and 10.7 before RP3.

  39. 7.8CVE-2018-10650EPSS 0.8%

    There is an Insufficient Path Validation Vulnerability in Citrix XenMobile Server 10.8 before RP2 and 10.7 before RP3.

  40. 7.5CVE-2018-1310EPSS 3.1%

    Apache NiFi JMS Deserialization issue because of ActiveMQ client vulnerability. Malicious JMS content could cause denial of service. See ActiveMQ CVE-2015-5254 announcement for more information. The fix to upgrade the activemq-client libra…

  41. 7.0CVE-2018-1122ExploitEPSS 1.2%

    procps-ng before version 3.3.15 is vulnerable to a local privilege escalation in top. If a user runs top with HOME unset in an attacker-controlled directory, the attacker could achieve privilege escalation by exploiting one of several vuln…

  42. 9.8CVE-2018-4939KEVEPSS 62%

    Adobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have an exploitable Deserialization of Untrusted Data vulnerability. Successful exploitation could lead to arbitrary code execution.

  43. 7.8CVE-2018-4938EPSS 0.7%

    Adobe ColdFusion Update 5 and earlier versions, ColdFusion 11 Update 13 and earlier versions have an exploitable Insecure Library Loading vulnerability. Successful exploitation could lead to local privilege escalation.

  44. 7.8CVE-2018-4927EPSS 3.4%

    Adobe InDesign versions 13.0 and below have an exploitable Untrusted Search Path vulnerability. Successful exploitation could lead to local privilege escalation.

  45. 7.5CVE-2018-6562EPSS 0.7%

    totemomail Encryption Gateway before 6.0_b567 allows remote attackers to obtain sensitive information about user sessions and encryption key material via a JSONP hijacking attack.

  46. 7.8CVE-2018-10027EPSS 0.4%

    ESTsoft ALZip before 10.76 allows local users to execute arbitrary code via creating a malicious .DLL file and installing it in a specific directory: %PROGRAMFILES%\ESTsoft\ALZip\Formats, %PROGRAMFILES%\ESTsoft\ALZip\Coders, %PROGRAMFILES(…

  47. 8.8CVE-2017-2608EPSS 5.9%

    Jenkins before versions 2.44, 2.32.2 is vulnerable to a remote code execution vulnerability involving the deserialization of various types in javax.imageio in XStream-based APIs (SECURITY-383).

  48. 8.8CVE-2018-1131EPSS 1.2%

    Infinispan permits improper deserialization of trusted data via XML and JSON transcoders under certain server configurations. A user with authenticated access to the server could send a malicious object to a cache configured to accept cert…

  49. 7.8CVE-2018-0580EPSS 2.0%

    Untrusted search path vulnerability in CELSYS, Inc CLIP STUDIO series (CLIP STUDIO PAINT (for Windows) EX/PRO/DEBUT Ver.1.7.3 and earlier, CLIP STUDIO ACTION (for Windows) Ver.1.5.5 and earlier, with its timestamp prior to April 25, 2018, …

  50. 7.8CVE-2018-3649EPSS 0.5%

    DLL injection vulnerability in the installation executables (Autorun.exe and Setup.exe) for Intel's wireless drivers and related software in Intel Dual Band Wireless-AC, Tri-Band Wireless-AC and Wireless-AC family of products allows a loca…