CVE Vulnerability Catalog

A vulnerability in the restricted shell of the Cisco Identity Services Engine (ISE) accessible via SSH allows an authenticated local attacker to run arbitrary CLI commands with elevated privileges. The issue is due to incomplete input validation of user input for CLI commands issued at the restricted shell.

A vulnerability in Cisco Unified Computing System (UCS) Manager, Cisco Firepower 4100 Series NGFW, and Cisco Firepower 9300 Security Appliance allows an authenticated, local attacker to obtain root shell privileges on the device through command injection. The issue is due to improper validation of string input in the shell application.

OpenAM (Open Source Edition) allows an attacker to bypass authentication and access unauthorized contents via unspecified vectors. This vulnerability affects OpenAM implementations configured as SAML 2.0IdP, which switch authentication methods based on AuthnContext requests sent from the service provider.

A vulnerability in Rakuraku Hagaki and Ichitaro allows attackers to execute arbitrary code with application privileges via specially crafted files. This affects versions from 2016 to 2018 and various editions of Ichitaro.

The vulnerability in the Installer of Flets Easy Setup Tool version 1.2.0 and earlier allows an attacker to gain privileges via a malicious DLL in an unspecified directory.

IBM OpenPages GRC Platform versions 7.1, 7.2, and 7.3 are vulnerable to cross-site request forgery, which could allow an attacker to execute malicious and unauthorized actions on behalf of a trusted user.

In radare version 2.0.1, an out-of-bounds read vulnerability exists in string_scan_range() in libr/bin/bin.c when performing a string search.

In version 2.0.1 of radare, a memory corruption vulnerability exists in the functions store_versioninfo_gnu_verdef() and store_versioninfo_gnu_verneed() in the file elf.c. This issue is due to improper sh_size validation during memory allocation.

Sera 1.2 stores the user's login password in plain text in their home directory. This makes privilege escalation trivial and also exposes the user and system keychains to local attacks.

In SchedMD Slurm versions before 16.05.11, 17.x before 17.02.9, and 17.11.x before 17.11.0rc2, insecure handling of the SPANK environment variable allows privilege escalation to root during Prolog or Epilog execution.

GraphicsMagick version 1.3.26 is vulnerable to a heap-based buffer overflow found in the DescribeImage() function in the magick/describe.c file. One possible way to trigger the vulnerability is to run the identify command on a specially crafted MIFF format file with the verbose flag.

The Favorite Plugin for Jenkins version 2.2.0 and older is vulnerable to CSRF, which can lead to data modification.

The Catalyst-Plugin-Static-Simple module before 0.34 for Perl allows remote attackers to read arbitrary files if there is a '.' character anywhere in the pathname, which differs from the intended policy of allowing access only when the filename itself has a '.' character.

OctoberCMS 1.0.426 is vulnerable to Cross-Site Request Forgery (CSRF) due to improper validation of CSRF tokens for postback handling, allowing an attacker to take over the victim's account. The attack bypasses a protection mechanism involving X-CSRF headers and CSRF tokens via a certain _handler postback variable.

EMC AppSync Server prior to 3.5.0.1 contains database accounts with hardcoded passwords that could potentially be exploited by malicious users to compromise the affected system.

CVE-2017-10954 allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender Internet Security 2018 prior to build 7.72918. User interaction is required to exploit this vulnerability, meaning the target must visit a malicious page or open a malicious file.

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.0.14878. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.2.1.6871. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.2.1.6871. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.2.1.6871. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.