CVE Vulnerability Catalog

A vulnerability in the crypto engine of the Cisco Integrated Services Module for VPN (ISM-VPN) running Cisco IOS Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. The issue is due to insufficient handling of VPN traffic. An attacker could exploit this by sending crafted VPN traffic, causing the device to hang or crash.

A vulnerability in the QoS subsystem of Cisco IOS and IOS XE Software is due to incorrect bounds checking of values in packets destined for UDP port 18999. An unauthenticated remote attacker can send malicious packets, causing a buffer overflow that may lead to arbitrary code execution with elevated privileges or a device reload.

A cross-site scripting (XSS) vulnerability in ZmMailMsgView.getAttachmentLinkHtml in Zimbra Collaboration Suite (ZCS) before 8.7 Patch 1 and 8.8.x before 8.8.7. Remote attackers can inject arbitrary web script or HTML via a Content-Location header in an email attachment.

A vulnerability in the Border Gateway Protocol (BGP) over an Ethernet Virtual Private Network (EVPN) for Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause the device to reload, resulting in a denial of service (DoS) condition, or potentially corrupt the BGP routing table, which could result in network instability. The vulnerability exists due to changes in the implementation of the BGP MPLS-Based Ethernet VPN RFC (RFC 7432) draft between IOS XE software releases. When the BGP Inclusive Multicast Ethernet Tag Route or BGP EVPN MAC/IP Advertisement Route update packet is received, it could be possible that the IP address length field is miscalculated. This vulnerability affects all releases of Cisco IOS XE Software prior to software release 16.3 that support BGP EVPN configurations.

A buffer overflow was found in the MikroTik RouterOS SMB service when processing NetBIOS session request messages. A remote attacker with access to the service can exploit this vulnerability to gain code execution on the system, and the overflow occurs before authentication, so an unauthenticated remote attacker can exploit it.

A vulnerability in Java deserialization used by Cisco Secure Access Control System (ACS) prior to release 5.8 patch 9 is due to insecure deserialization of user-supplied content. An unauthenticated remote attacker can send a crafted serialized Java object and execute arbitrary commands on the device with root privileges.

An OS command injection vulnerability in soap.cgi (soapcgi_main in cgibin) in D-Link DIR-880L, DIR-868L, DIR-865L, and DIR-860L routers in specific firmware versions allows remote attackers to execute arbitrary OS commands via the service parameter.

SAP CRM, 7.01, 7.02, 7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing 'traverse to parent directory' are passed through to the file APIs.

An issue was discovered in the base64d function in the SMTP listener in Exim before 4.90.1. Sending a handcrafted message may cause a buffer overflow, which can be used to execute code remotely.

A vulnerability in the web interface of Cisco RV132W ADSL2+ Wireless-N VPN and RV134W VDSL2 Wireless-AC VPN Routers is due to incomplete input validation on user-controlled input in an HTTP request. An unauthenticated remote attacker can send a crafted HTTP request to execute arbitrary code with root privileges and gain full control of the system or cause it to reload.

A use-after-free vulnerability was discovered in Adobe Flash Player before 28.0.0.161. It occurs due to a dangling pointer in the Primetime SDK related to media player handling of listener objects. A successful attack can lead to arbitrary code execution, and it was exploited in the wild in January and February 2018.

Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to unauthenticated remote code execution. An attacker can transfer a serialized Java SignedObject to the Jenkins CLI, which is deserialized using a new ObjectInputStream, bypassing the existing blacklist-based protection mechanism.

Equation Editor in Microsoft Office 2007, 2010, 2013, and 2016 has a remote code execution vulnerability due to improper handling of objects in memory, aka 'Microsoft Office Memory Corruption Vulnerability'. This CVE is unique from CVE-2018-0797 and CVE-2018-0812.

Equation Editor in Microsoft Office 2007, 2010, 2013, and 2016 has a remote code execution vulnerability due to improper handling of objects in memory, aka 'Microsoft Office Memory Corruption Vulnerability'.

Primetek Primefaces 5.x is vulnerable to a weak encryption flaw resulting in remote code execution.

Embedthis GoAhead przed wersją 3.6.5 umożliwia zdalne wykonanie kodu, jeśli CGI jest włączone, a program CGI jest dynamicznie powiązany. Problem wynika z inicjalizacji środowiska skryptów CGI w funkcji cgiHandler przy użyciu nieufnych parametrów żądania HTTP.

Palo Alto Networks PAN-OS w wersjach przed 6.1.19, 7.0.x przed 7.0.19, 7.1.x przed 7.1.14 oraz 8.0.x przed 8.0.6 umożliwia zdalnym atakującym wykonanie dowolnego kodu poprzez interfejs zarządzania.

Podatność w Microsoft Office 2007, 2010, 2013 i 2016 pozwala atakującemu na wykonanie dowolnego kodu w kontekście bieżącego użytkownika z powodu niewłaściwego zarządzania obiektami w pamięci. Jest to znane jako 'Podatność na uszkodzenie pamięci w Microsoft Office'.

Roundcube Webmail w wersjach przed 1.1.10, 1.2.x przed 1.2.7 oraz 1.3.x przed 1.3.3 umożliwia nieautoryzowany dostęp do dowolnych plików na systemie plików hosta, w tym plików konfiguracyjnych. Wykorzystanie tej podatności miało miejsce w listopadzie 2017 roku.

W V8 w Google Chrome przed wersją 59.0.3071.86 dla systemów Linux, Windows i Mac oraz przed wersją 59.0.3071.92 dla Androida wystąpiło zjawisko pomylenia typów, które umożliwiło zdalnemu atakującemu wykonanie dowolnego kodu wewnątrz piaskownicy za pomocą spreparowanej strony HTML.