CVE Vulnerability Catalog

Directory traversal vulnerability in unzip/extract feature in eXtplorer 2.1.9 allows remote attackers to execute arbitrary files via a .. (dot dot) in an archive file.

Kallithea versions before 0.3.2 allow remote attackers to bypass CSRF protection by using the GET HTTP request method.

Multiple server-side request forgery (SSRF) vulnerabilities in Yeager CMS version 1.2.1 allow remote attackers to trigger outbound requests and enumerate open ports via the dbhost parameter in specific test files.

Yeager CMS version 1.2.1 has an SQL injection vulnerability in the 'yeager/y.php/tab_USERLIST' module that allows local users to execute arbitrary SQL commands via the 'pagedir_orderby' parameter.

CVE-2015-7245 describes a vulnerability in the D-Link DVG-N5402SP device with specific firmware versions that allows remote attackers to read sensitive information. This vulnerability is due to directory traversal via the errorpage parameter.

OpenDaylight is vulnerable to the DOMRpcImplementationNotAvailableException when sending Port-Status packets. This causes the controller to throw exceptions and consume more CPU resources.

CVE-2017-1000357 vulnerability concerns a Denial of Service attack that occurs when the switch rejects packets from the controller. It affects the OpenDaylight odl-l2switch-switch component responsible for OpenFlow communication.

An information leak vulnerability in Juniper Networks NorthStar Controller Application prior to version 2.1.0 Service Pack 1 may allow a network-based malicious attacker to perform a man-in-the-middle attack, thereby stealing authentic credentials from encrypted paths which are easily decrypted.

An insufficient authentication vulnerability in Juniper Networks NorthStar Controller Application prior to version 2.1.0 Service Pack 1 may allow a malicious, network based, unauthenticated attacker to perform privileged actions to gain complete control over the environment.

A firewall bypass vulnerability in Juniper Networks NorthStar Controller Application prior to version 2.1.0 Service Pack 1 may allow a network-based malicious attacker to bypass firewall policies. This can lead to authentication bypass methods, information disclosure, modification of system files, and denials of service.

A denial of service vulnerability in Juniper Networks NorthStar Controller Application prior to version 2.1.0 Service Pack 1 may allow a malicious attacker crafting packets destined to the device to cause a persistent denial of service to the path computation server service.

A vulnerability in Juniper Networks NorthStar Controller Application prior to version 2.1.0 Service Pack 1 may allow an unauthenticated, unprivileged, network-based attacker to cause various system services partial to full denials of services, modification of system states and files, and potential disclosure of sensitive information.

A vulnerability in Juniper Networks NorthStar Controller Application prior to version 2.1.0 Service Pack 1 may allow a malicious attacker to compromise the systems confidentiality or integrity without authentication.

A denial of service vulnerability in Juniper Networks NorthStar Controller Application prior to version 2.1.0 Service Pack 1 may allow an unauthenticated attacker to disrupt database operations, leading to potential information disclosure and modification of system states.

A vulnerability in IPv6 processing has been discovered on Juniper Networks EX Series Ethernet Switches running affected Junos OS versions, which may lead to a slow memory leak. A specially crafted IPv6 Neighbor Discovery (ND) packet may cause resource exhaustion and denial of service.

Juniper Networks devices running affected versions of Junos OS may be vulnerable to a crafted BGP UPDATE which can lead to a crash and restart of the routing process daemon (rpd). Repeated crashes of the rpd daemon can result in an extended denial of service condition.

D-Link DCS cameras have a weak CrossDomain.XML file that allows CSRF attacks, enabling malicious sites to access and change device settings. The 'allow-access-from domain' child element set to * accepts requests from any domain.

Lenovo System Update before version 5.07.0019 allows local users to gain privileges by interacting with options in the Tvsukernel.exe application, leading to local privilege escalation.

Lenovo System Update before version 5.07.0019 allows local users to gain privileges by predicting the tvsu_tmp_xxxxxXXXXX account credentials, which requires knowledge of the time this account was created.

The DNP3 protocol analyzer in Bro before version 2.3.2 does not reject certain non-zero values of packet length, allowing remote attackers to cause a denial of service (buffer overflow or buffer over-read) via a crafted DNP3 packet.