CVE Vulnerability Catalog

An issue was discovered in certain Apple products, including macOS before 10.13.2, related to the 'IOKit' component. It allows attackers to execute arbitrary code in a privileged context.

An issue was discovered in certain Apple products, including iOS before 11.2 and macOS before 10.13.2, involving the 'IOKit' component. It allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.

An Improper Input Validation issue was discovered in Rockwell Automation FactoryTalk Alarms and Events, Version 2.90 and earlier. An unauthenticated attacker with remote access can send a specially crafted set of packets to Port 403/TCP, causing the service to stall or terminate.

Huawei HG8245H versions earlier than V300R018C00SPC110 have an authentication bypass vulnerability. An attacker can access a specific URL of the affected product, which may lead to information leak.

Huawei S5700 and S6700 with software of V200R005C00 have a DoS vulnerability due to insufficient validation of the Network Quality Analysis (NQA) packets. A remote attacker could exploit this vulnerability by sending malformed NQA packets to the target device, potentially causing it to restart.

Some Huawei products, such as RP200, TE30, TE40, TE50, and TE60, have out-of-bounds read vulnerabilities. Due to insufficient input validation, a remote attacker could exploit these vulnerabilities by sending specially crafted SS7 related packets to the target devices.

Some Huawei products, such as RP200, TE30, TE40, TE50, and TE60, have out-of-bounds read vulnerabilities. Due to insufficient input validation, a remote attacker could exploit these vulnerabilities by sending specially crafted SS7 related packets to the target devices.

Some Huawei products, such as RP200, TE30, TE40, TE50, and TE60, have out-of-bounds read vulnerabilities due to insufficient input validation. A remote attacker could exploit these vulnerabilities by sending specially crafted SS7 related packets to the target devices.

CVE-2017-15317 vulnerability affects various versions of AR120-S, AR1200, AR150, AR160, AR200, AR2200, AR3200, and AR510 routers. It exists in software versions V200R006C10, V200R007C00, V200R008C20, and others.

The GPU driver of Mate 9 and Mate 9 Pro Huawei smartphones before MHA-AL00B 8.0.0.334(C00) and LON-AL00B 8.0.0.334(C00) has a memory double free vulnerability. An attacker can trick a user into installing a malicious application that triggers double free, leading to system crash or arbitrary code execution.

Huawei SmartCare V200R003C10 has a CSV injection vulnerability. A remote authenticated attacker could inject malicious CSV expression to the affected device.

The baseband modules of Huawei Mate 10, Mate 10 Pro, Mate 9, and Mate 9 Pro have a stack overflow vulnerability due to lack of parameter validation. An attacker could send malicious packets to these devices within radio range, leading to stack overflow when the baseband module handles these packets.

The Huawei iReader app before version 8.0.2.301 has a path traversal vulnerability due to insufficient validation on file storage paths. An attacker can exploit this vulnerability to store malicious files in an arbitrary directory.

The Huawei iReader app before version 8.0.2.301 has an input validation vulnerability that allows an attacker to control app access and load malicious websites.

The vulnerability in Music Center for PC version 1.0.01 and earlier allows an attacker to gain privileges via a malicious DLL in an unspecified directory.

H2O version 2.2.3 and earlier allows remote attackers to cause a denial of service in the server via specially crafted HTTP/2 header.

Buffer overflow in H2O version 2.2.2 and earlier allows remote attackers to cause a denial-of-service in the server via unspecified vectors.

H2O version 2.2.2 and earlier allows remote attackers to cause a denial of service in the server via specially crafted HTTP/1 header.

Samsung Internet Browser version 5.4.02.3 allows remote attackers to bypass the Same Origin Policy, enabling them to obtain sensitive information via crafted JavaScript code.

In F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM and WebSafe software versions 13.0.0 and 12.1.0 - 12.1.2, race conditions in iControl REST may lead to commands being executed with different privilege levels than expected.