CVE Vulnerability Catalog

A vulnerability in the web UI of Cisco Desk Phone 9800 Series, Cisco IP Phone 7800 and 8800 Series, and Cisco Video Phone 8875 running Cisco SIP Software could allow an unauthenticated, remote attacker to cause a DoS condition on an affected device. This is due to a buffer overflow when processing HTTP packets. An attacker could exploit this by sending crafted HTTP input, causing the device to reload. To exploit, the phone must be registered to Cisco Unified Communications Manager and have Web Access enabled (disabled by default).

A vulnerability in the logging component of Cisco TelePresence Collaboration Endpoint (CE) and Cisco RoomOS Software allows an authenticated remote attacker with administrative credentials to view sensitive information in clear text. This occurs when SIP media component logging is enabled and credentials are stored unencrypted.

Potential vulnerabilities have been identified in the audio package for certain HP PC products using the Sound Research SECOMN64 driver, which might allow escalation of privilege. HP is releasing updated audio packages to mitigate the potential vulnerabilities.

Potential vulnerabilities have been identified in the audio package for certain HP PC products using the Sound Research SECOMN64 driver, which might allow escalation of privilege. HP is releasing updated audio packages to mitigate the potential vulnerabilities.

Biblioteki Alloy Core w ekosystemie Ethereum Rust przed wersjami 0.8.26 i 1.4.1 miały podatność na nieobsłużony błąd wywołany przez nieprawidłowe dane wejściowe do alloy_dyn_abi::TypedData, co mogło prowadzić do odmowy usługi (DoS) poprzez eip712_signing_hash().

When a BIG-IP Advanced WAF or ASM security policy is configured on a virtual server, undisclosed requests can cause the bd process to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

A reflected cross-site scripting (XSS) vulnerability exists in an undisclosed page of BIG-IP APM that allows an attacker to run JavaScript in the context of the targeted logged-out user. Software versions which have reached End of Technical Support (EoTS) are not evaluated.

A vulnerability exists in F5OS-A software that allows a highly privileged authenticated attacker to access sensitive FIPS hardware security module (HSM) information on F5 rSeries systems.

Applications using affected versions of Ehcache 3.x can experience degraded cache-write performance if they use keys sourced from (malicious) external parties in an unfiltered/unsalted way.

A potential null pointer dereference vulnerability was reported in the Lenovo Power Management Driver. It could allow a local authenticated user to cause a Windows blue screen error.

W PC Manager zgłoszono potencjalną podatność, która może pozwolić lokalnie uwierzytelnionemu użytkownikowi na wykonanie kodu z podwyższonymi uprawnieniami.

An improper certificate validation vulnerability was reported in the Lenovo Universal Device Client (UDC) that could allow a user capable of intercepting network traffic to obtain application metadata, including device information, geolocation, and telemetry data.

In NetX Duo before version 6.4.4, a component of Eclipse Foundation ThreadX, there is an incorrect bound check resulting in an out-of-bounds read by two bytes.

A vulnerability was reported in the Lenovo LeCloud client application that, under certain conditions, could allow information disclosure.

W Lenovo PC Manager zidentyfikowano potencjalną podatność na hijacking DLL, która może pozwolić lokalnie uwierzytelnionemu użytkownikowi na wykonanie kodu z podwyższonymi uprawnieniami.

When a per-request policy is configured on a BIG-IP APM portal access virtual server, undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.

W systemach BIG-IP występuje podatność w poleceniu iHealth, która może umożliwić uwierzytelnionemu atakującemu z rolą administratora zasobów ominięcie ograniczeń tmsh i uzyskanie dostępu do powłoki bash. W przypadku systemów działających w trybie Appliance, udany atak może pozwolić na przekroczenie granicy bezpieczeństwa.

Undisclosed traffic can cause the Traffic Management Microkernel (TMM) to terminate. This issue may occur when a DTLS 1.2 virtual server is enabled with a Server SSL profile configured with a certificate, key, and SSL Sign Hash set to ANY, and the backend server has DTLS 1.2 and client authentication enabled. Software versions that have reached End of Technical Support (EoTS) are not evaluated.

When a BIG-IP Advanced WAF or ASM security policy is configured with a URL greater than 1024 characters for Data Guard Protection Enforcement, either manually or via Policy Builder, the bd process can terminate repeatedly. Note: EoTS versions not evaluated.

When a highly-privileged, authenticated attacker attempts to initialize the rSeries FIPS module using a password with special shell metacharacters, arbitrary system commands may be executed, and the FIPS hardware security module (HSM) may fail to initialize. A successful exploit can allow the attacker to cross a security boundary. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.