Security Vulnerabilities Related To CWE-123

CVSS Scores Greater Than: 0 1 2 3 4 5 6 7 8 9

Sort Results By : CVE Number Descending CVE Number Ascending CVSS Score Descending Number Of Exploits Descending

#	CVE ID	CWE ID	Vulnerability Type(s)	Publish Date	Update Date	Score	Gained Access Level	Access	Complexity	Authentication	Conf.	Integ.	Avail.
1	CVE-2021-42540	123		2021-10-22	2021-10-28	6.5	None	Remote	Low	???	Partial	Partial	Partial
The affected product is vulnerable to a unsanitized extract folder for system configuration. A low-privileged user can leverage this logic to overwrite the settings and other key functionality.
2	CVE-2021-38449	123		2021-10-22	2021-10-27	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Some API functions permit by-design writing or copying data into a given buffer. Since the client controls these parameters, an attacker could rewrite the memory in any location of the affected product.
3	CVE-2021-38441	123		2022-05-05	2022-05-13	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
Eclipse CycloneDDS versions prior to 0.8.0 are vulnerable to a write-what-where condition, which may allow an attacker to write arbitrary values in the XML parser.
4	CVE-2021-36057	123	DoS	2021-09-01	2021-10-27	2.1	None	Local	Low	Not required	None	None	Partial
XMP Toolkit SDK version 2020.1 (and earlier) is affected by a write-what-where condition vulnerability caused during the application's memory allocation process. This may cause the memory management functions to become mismatched resulting in local application denial of service in the context of the current user.
5	CVE-2021-1520	123		2021-05-06	2021-05-14	7.2	None	Local	Low	Not required	Complete	Complete	Complete
A vulnerability in the internal message processing of Cisco RV340, RV340W, RV345, and RV345P Dual WAN Gigabit VPN Routers could allow an authenticated, local attacker to run arbitrary commands with root privileges on the underlying operating system (OS). This vulnerability exists because an internal messaging service does not properly sanitize input. An attacker could exploit this vulnerability by first authenticating to the device and then sending a crafted request to the internal service. A successful exploit could allow the attacker to run arbitrary commands with root privileges on the underlying OS. To exploit this vulnerability, the attacker must have valid Administrator credentials for the device.
6	CVE-2021-1390	123	Exec Code	2021-03-24	2021-03-30	7.2	None	Local	Low	Not required	Complete	Complete	Complete
A vulnerability in one of the diagnostic test CLI commands of Cisco IOS XE Software could allow an authenticated, local attacker to execute arbitrary code on an affected device. To exploit this vulnerability, the attacker would need to have valid user credentials at privilege level 15. This vulnerability exists because the affected software permits modification of the run-time memory of an affected device under specific circumstances. An attacker could exploit this vulnerability by authenticating to the affected device and issuing a specific diagnostic test command at the CLI. A successful exploit could trigger a logic error in the code that was designed to restrict run-time memory modifications. The attacker could take advantage of this logic error to overwrite system memory locations and execute arbitrary code on the underlying Linux operating system (OS) of the affected device.
7	CVE-2020-7560	123	Exec Code	2020-12-11	2022-01-31	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
A CWE-123: Write-what-where Condition vulnerability exists in EcoStruxure™ Control Expert (all versions) and Unity Pro (former name of EcoStruxure™ Control Expert) (all versions), that could cause a crash of the software or unexpected code execution when opening a malicious file in EcoStruxure™ Control Expert software.
8	CVE-2018-16962	123		2018-09-12	2021-09-08	7.2	None	Local	Low	Not required	Complete	Complete	Complete
Webroot SecureAnywhere before 9.0.8.34 on macOS mishandles access to the driver by a process that lacks root privileges.
9	CVE-2018-15376	123		2018-10-05	2019-10-09	7.2	None	Local	Low	Not required	Complete	Complete	Complete
A vulnerability in the embedded test subsystem of Cisco IOS Software for Cisco 800 Series Industrial Integrated Services Routers could allow an authenticated, local attacker to write arbitrary values to arbitrary locations in the memory space of an affected device. The vulnerability is due to the presence of certain test commands that were intended to be available only in internal development builds of the affected software. An attacker could exploit this vulnerability by using these commands on an affected device. A successful exploit could allow the attacker to write arbitrary values to arbitrary locations in the memory space of the affected device.
10	CVE-2018-15375	123		2018-10-05	2019-10-09	7.2	None	Local	Low	Not required	Complete	Complete	Complete
A vulnerability in the embedded test subsystem of Cisco IOS Software for Cisco 800 Series Industrial Integrated Services Routers could allow an authenticated, local attacker to write arbitrary values to arbitrary locations in the memory space of an affected device. The vulnerability is due to the presence of certain test commands that were intended to be available only in internal development builds of the affected software. An attacker could exploit this vulnerability by using these commands on an affected device. A successful exploit could allow the attacker to write arbitrary values to arbitrary locations in the memory space of the affected device.
11	CVE-2018-4038	123	Exec Code	2018-12-01	2022-04-19	6.8	None	Remote	Medium	Not required	Partial	Partial	Partial
An exploitable arbitrary write vulnerability exists in the open document format parser of the Atlantis Word Processor, version 3.2.7.2, while trying to null-terminate a string. A specially crafted document can allow an attacker to pass an untrusted value as a length to a constructor. This constructor will miscalculate a length and then use it to calculate the position to write a null byte. This can allow an attacker to corrupt memory, which can result in code execution under the context of the application. An attacker must convince a victim to open a specially crafted document in order to trigger this vulnerability.
12	CVE-2018-3971	123	Mem. Corr.	2018-10-25	2022-04-19	7.2	None	Local	Low	Not required	Complete	Complete	Complete
An exploitable arbitrary write vulnerability exists in the 0x2222CC IOCTL handler functionality of Sophos HitmanPro.Alert 3.7.6.744. A specially crafted IRP request can cause the driver to write data under controlled by an attacker address, resulting in memory corruption. An attacker can send IRP request to trigger this vulnerability.
13	CVE-2017-10994	123	Exec Code	2017-07-07	2017-08-24	9.3	None	Remote	Medium	Not required	Complete	Complete	Complete
Foxit Reader before 8.3.1 and PhantomPDF before 8.3.1 have an Arbitrary Write vulnerability, which allows remote attackers to execute arbitrary code via a crafted document.
14	CVE-2017-6282	123		2018-03-06	2018-03-27	7.2	None	Local	Low	Not required	Complete	Complete	Complete
NVIDIA Tegra kernel driver contains a vulnerability in NVMAP where an attacker has the ability to write an arbitrary value to an arbitrary location which may lead to an escalation of privileges. This issue is rated as high.
15	CVE-2015-8271	123	Exec Code	2017-04-13	2017-11-04	7.5	None	Remote	Low	Not required	Partial	Partial	Partial
The AMF3CD_AddProp function in amf.c in RTMPDump 2.4 allows remote RTMP Media servers to execute arbitrary code.

Total number of vulnerabilities : 15 Page : 1 (This Page)