CVE Vulnerability Catalog

AVideo/YouPHPTube 10.0 and prior has multiple reflected Cross-Site Scripting (XSS) vulnerabilities via the 'u' parameter. A remote attacker can exploit this to steal administrator session cookies or perform actions as an administrator.

AVideo/YouPHPTube 10.0 and prior has multiple reflected Cross-Site Scripting (XSS) vulnerabilities via the searchPhrase parameter. This allows a remote attacker to steal administrators' session cookies or perform actions as an administrator.

Several web interfaces on the D-Link DIR-868LW router version 1.12b lack authentication requirements, allowing attackers to access users' DNS query history.

A vulnerability in the IKEv2 implementation of Cisco ASA and FTD Software could allow an authenticated, remote attacker to trigger a denial of service (DoS) condition. This is due to improper resource control. An attacker who can spoof a trusted IKEv2 site-to-site VPN peer and has valid credentials could send malformed, authenticated IKEv2 messages, causing a device reload.

A vulnerability in the Snort detection engine of multiple Cisco products when processing ICMP traffic could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. The issue is due to improper memory resource management while processing ICMP packets. An attacker could send a series of ICMP packets through an affected device, potentially exhausting resources and causing a reload.

A vulnerability in the SNMPv3 access control functionality of Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to query SNMP data. This is due to ineffective access control. An attacker could send an SNMPv3 query from a host not permitted by the ACL and retrieve information if valid credentials are held.

Multiple vulnerabilities in the Application Level Gateway (ALG) for the Network Address Translation (NAT) feature of Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass the ALG and open unauthorized connections with a host behind the ALG. These vulnerabilities are publicly known as NAT Slipstreaming.

Multiple vulnerabilities in the Application Level Gateway (ALG) for the Network Address Translation (NAT) feature of Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass the ALG and open unauthorized connections with a host behind the ALG. These vulnerabilities are publicly known as NAT Slipstreaming.

A vulnerability in the identity-based firewall (IDFW) rule processing feature of Cisco ASA and Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass security protections. This is due to improper handling of network requests by devices configured with object group search. An attacker could send a specially crafted request to bypass ACL rules and send traffic to unauthorized hosts.

Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an attacker to execute a cross-site scripting (XSS) attack or an open redirect attack. For more details, see the Details section of the Cisco advisory.

Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) could allow an attacker to perform a cross-site scripting (XSS) attack or an open redirect attack.

A vulnerability in Cisco Firepower Threat Defense (FTD) Software allows an authenticated local attacker with administrative privileges to overwrite or append arbitrary data to system files with root privileges. This is due to incomplete validation of user input for a specific CLI command.

Multiple vulnerabilities in the CLI of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to execute arbitrary commands with root privileges. For more information, see the Details section of the advisory.

Multiple vulnerabilities in the CLI of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to execute arbitrary commands with root privileges. For more information, see the Details section of the advisory.

Multiple vulnerabilities in the payload inspection for Ethernet Industrial Protocol (ENIP) traffic in Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass configured rules for ENIP traffic. This is due to incomplete processing during deep packet inspection for ENIP packets. An attacker could send a crafted ENIP packet to bypass access control and intrusion policies.

jQuery UI prior to version 1.13.0 is vulnerable to execution of untrusted code when the value of the `of` option of the `.position()` utility is accepted from untrusted sources. The issue is fixed in 1.13.0, where any string value passed to the `of` option is treated as a CSS selector.

jQuery UI prior to version 1.13.0 is vulnerable to execution of untrusted code when the values of various `*Text` options of the Datepicker widget are accepted from untrusted sources. The issue is fixed in 1.13.0, where values passed to various `*Text` options are always treated as pure text, not HTML.

jQuery UI prior to version 1.13.0 is vulnerable to execution of untrusted code when the value of the `altField` option of the Datepicker widget is accepted from untrusted sources. The issue is fixed in 1.13.0, where any string value passed to the `altField` option is treated as a CSS selector.

In Oracle PeopleSoft Enterprise CS Campus Community (Notification Framework) versions 9.0 and 9.2, a low-privileged attacker with physical access to the communication segment can gain unauthorized access to critical data or all accessible data.

A Cross-Site Request Forgery (CSRF) vulnerability was discovered in PHPMyWind 5.6, allowing attackers to create a new administrator account without authentication.