CVE Vulnerability Catalog

Arbitrary file deletion exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before version 7.0.1-build2093. The attack methodology is absolute path traversal in cgi-bin/MANGA/firmware_process.cgi via the upfile.path parameter.

CSRF exists on Peplink Balance 305, 380, 580, 710, 1350, and 2500 devices with firmware before version 7.0.1-build2093. The CGI scripts in the administrative interface are affected, allowing an attacker to execute commands if a logged-in user visits a malicious website.

Elastic X-Pack Security versions 5.0.0 to 5.4.0 contain a privilege escalation bug in the run_as functionality. This bug prevents transitioning into the specified user in a run_as request, leading to incorrect behavior.

In Apache Hadoop versions 2.8.0, 3.0.0-alpha1, and 3.0.0-alpha2, the LinuxContainerExecutor runs docker commands as root with insufficient input validation. When the docker feature is enabled, authenticated users can run commands as root.

A directory traversal vulnerability exists in BigTree CMS through version 4.2.18 on Windows, allowing attackers to read arbitrary files via ..\ sequences in the directory parameter.

SQL injection vulnerability in BigTree CMS version 4.2.18 allows remote authenticated users to execute arbitrary SQL commands via form-create.php. An attacker can create a crafted table name, exposing the vulnerability in the admin dashboard.

In Lenovo Service Bridge before version 4, a bug found in the signature verification logic of the code signing certificate could be exploited by an attacker to insert a forged code signing certificate.

In Lenovo Service Bridge versions before 4.0, an insecure HTTP connection is used to send system serial number, machine type and model, and product name to Lenovo's servers.

CVE-2016-8229 is a cross-site request forgery vulnerability in Lenovo Service Bridge before version 4. An attacker with access to the DHCP server used by the system where LSB is installed could exploit this vulnerability.

In Lenovo Service Bridge before version 4, a user with local privileges on a system could execute code with administrative privileges.

OpenEMR version 5.0.0 and prior allows low-privilege users to upload files of dangerous types, which can lead to arbitrary code execution within the context of the vulnerable application.

Multiple CSRF issues exist in BigTree CMS through version 4.2.18, related to the clear parameter in core\admin\modules\dashboard\vitals-statistics\404\clear.php and the from or to parameters in core\admin\modules\dashboard\vitals-statistics\404\create-301.php.

PJSIP, used in Asterisk Open Source 13.x before 13.15.1 and 14.x before 14.4.1, allows remote attackers to cause a denial of service (buffer overflow and application crash) via a SIP packet with a crafted CSeq header in conjunction with a Via header that lacks a branch parameter.

CSRF exists in BigTree CMS through version 4.2.18, allowing a page to be unlocked using the force parameter in a request to /admin/pages/revisions.php.

The multi-part body parser in PJSIP, used in Asterisk Open Source 13.x before 13.15.1 and 14.x before 14.4.1, allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted packet.

A memory exhaustion vulnerability exists in Asterisk Open Source 13.x before 13.15.1 and 14.x before 14.4.1 and Certified Asterisk 13.13 before 13.13-cert4. It can be triggered by sending specially crafted SCCP packets causing an infinite loop and leading to memory exhaustion.

In Wireshark versions 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the RGMP dissector could crash. This issue was addressed by validating an IPv4 address.

In Wireshark versions 2.2.0 to 2.2.6, the IPv6 dissector could crash. This was addressed by validating an IPv6 address.

In Wireshark versions 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the Bazaar dissector could go into an infinite loop. This was addressed by ensuring that backwards parsing cannot occur.

In Wireshark versions 2.2.0 to 2.2.6 and 2.0.0 to 2.0.12, the DHCP dissector could read past the end of a buffer. This was addressed by extracting the Vendor Class Identifier more carefully.