Origin
by Openshift
CVEs (7)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2015-8945 | Med | 0.33 | 5.1 | 0.00 | Aug 5, 2016 | openshift-node in OpenShift Origin 1.1.6 and earlier improperly stores router credentials as envvars in the pod when the --credentials option is used, which allows local users to obtain sensitive private key information by reading the systemd journal. | ||
| CVE-2016-8651 | Low | 0.20 | 3.1 | 0.01 | Aug 1, 2018 | An input validation flaw was found in the way OpenShift 3 handles requests for images. A user, with a copy of the manifest associated with an image, can pull an image even if they do not have access to the image normally, resulting in the disclosure of any information contained… | ||
| CVE-2019-11354 | 0.06 | — | 0.23 | Apr 19, 2019 | The client in Electronic Arts (EA) Origin 10.5.36 on Windows allows template injection in the title parameter of the Origin2 URI handler. This can be used to escape the underlying AngularJS sandbox and achieve remote code execution via an origin2://game/launch URL for… | |||
| CVE-2019-12828 | 0.04 | — | 0.13 | Jun 14, 2019 | An issue was discovered in Electronic Arts Origin before 10.5.39. Due to improper sanitization of the origin:// and origin2:// URI schemes, it is possible to inject additional arguments into the Origin process and ultimately leverage code execution by loading a backdoored Qt… | |||
| CVE-2019-19741 | 0.00 | — | 0.01 | Feb 20, 2020 | Electronic Arts Origin 10.5.55.33574 is vulnerable to local privilege escalation due to arbitrary directory DACL manipulation, a different issue than CVE-2019-19247 and CVE-2019-19248. When Origin.exe connects to the named pipe OriginClientService, the privileged service… | |||
| CVE-2019-19248 | 0.00 | — | 0.00 | Dec 12, 2019 | Electronic Arts Origin through 10.5.x allows Elevation of Privilege (issue 2 of 2). | |||
| CVE-2019-19247 | 0.00 | — | 0.00 | Dec 12, 2019 | Electronic Arts Origin through 10.5.x allows Elevation of Privilege (issue 1 of 2). |
- risk 0.33cvss 5.1epss 0.00
openshift-node in OpenShift Origin 1.1.6 and earlier improperly stores router credentials as envvars in the pod when the --credentials option is used, which allows local users to obtain sensitive private key information by reading the systemd journal.
- risk 0.20cvss 3.1epss 0.01
An input validation flaw was found in the way OpenShift 3 handles requests for images. A user, with a copy of the manifest associated with an image, can pull an image even if they do not have access to the image normally, resulting in the disclosure of any information contained…
- CVE-2019-11354Apr 19, 2019risk 0.06cvss —epss 0.23
The client in Electronic Arts (EA) Origin 10.5.36 on Windows allows template injection in the title parameter of the Origin2 URI handler. This can be used to escape the underlying AngularJS sandbox and achieve remote code execution via an origin2://game/launch URL for…
- CVE-2019-12828Jun 14, 2019risk 0.04cvss —epss 0.13
An issue was discovered in Electronic Arts Origin before 10.5.39. Due to improper sanitization of the origin:// and origin2:// URI schemes, it is possible to inject additional arguments into the Origin process and ultimately leverage code execution by loading a backdoored Qt…
- CVE-2019-19741Feb 20, 2020risk 0.00cvss —epss 0.01
Electronic Arts Origin 10.5.55.33574 is vulnerable to local privilege escalation due to arbitrary directory DACL manipulation, a different issue than CVE-2019-19247 and CVE-2019-19248. When Origin.exe connects to the named pipe OriginClientService, the privileged service…
- CVE-2019-19248Dec 12, 2019risk 0.00cvss —epss 0.00
Electronic Arts Origin through 10.5.x allows Elevation of Privilege (issue 2 of 2).
- CVE-2019-19247Dec 12, 2019risk 0.00cvss —epss 0.00
Electronic Arts Origin through 10.5.x allows Elevation of Privilege (issue 1 of 2).