CVE Vulnerability Catalog

A SQL Injection vulnerability in AVideo/YouPHPTube 10.0 and prior allows an unauthenticated remote attacker to inject SQL code via the catName parameter. This enables retrieval of database information, including application password hashes.

Several web interfaces on the D-Link DIR-868LW router version 1.12b lack authentication requirements, allowing attackers to access users' DNS query history.

An XML External Entity (XXE) vulnerability was found in Symphony 2.7.10 in the class.xmlelement.php file, potentially leading to information disclosure or denial of service (DOS).

W systemie Sourcecodester Online Reviewer 1.0 występuje podatność na zdalne wykonanie kodu (RCE), która pozwala na przesłanie złośliwie przygotowanego pliku PHP, omijającego filtry przesyłania obrazów.

W systemie zamawiania jedzenia online Sourcecodester w wersji 2.0 występuje podatność na zdalne wykonanie kodu (RCE) spowodowana przez złośliwie skonstruowany plik PHP, który omija filtry przesyłania obrazów.

A buffer overflow vulnerability was found in Tenda AC9 routers versions V1.0 through V15.03.05.19(6318) and AC9 V3.0 V15.03.06.42_multi. Attackers can exploit the 'index' parameter to execute arbitrary code.

A buffer overflow vulnerability was found in Tenda AC9 routers versions V1.0 through V15.03.05.19(6318) and AC9 V3.0 V15.03.06.42_multi. Attackers can exploit the 'urls' parameter to execute arbitrary code on the device.

IrfanView 4.54 contains a vulnerability that allows an attacker to cause a denial of service or possibly other unspecified impacts via a crafted XBM file. The issue is related to data from a faulting address being used as arguments in a function call in FORMATS!ReadMosaic.

A vulnerability in the IKEv2 implementation of Cisco ASA and FTD Software could allow an authenticated, remote attacker to trigger a denial of service (DoS) condition. This is due to improper resource control. An attacker who can spoof a trusted IKEv2 site-to-site VPN peer and has valid credentials could send malformed, authenticated IKEv2 messages, causing a device reload.

A vulnerability in the web services interface of Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to trigger a DoS condition. It is due to improper input validation when parsing HTTPS requests. An attacker can send a malicious HTTPS request to cause the device to reload, resulting in DoS.

A vulnerability in the SSL/TLS message handler of Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS). The issue is due to improper processing of incoming SSL/TLS packets. Exploitation involves sending a crafted SSL/TLS packet.

A vulnerability in Snort rules in multiple Cisco products could allow an unauthenticated, remote attacker to cause a denial of service (DoS). The issue is due to improper handling of Block with Reset or Interactive Block with Reset actions if a rule is configured without proper constraints. Exploitation involves sending a crafted IP packet.

A vulnerability in the Snort detection engine of multiple Cisco products when processing ICMP traffic could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. The issue is due to improper memory resource management while processing ICMP packets. An attacker could send a series of ICMP packets through an affected device, potentially exhausting resources and causing a reload.

A vulnerability in the SNMPv3 access control functionality of Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to query SNMP data. This is due to ineffective access control. An attacker could send an SNMPv3 query from a host not permitted by the ACL and retrieve information if valid credentials are held.

A vulnerability in the TCP Normalizer of Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software operating in transparent mode could allow an unauthenticated, remote attacker to poison MAC address tables, resulting in a denial of service (DoS) vulnerability. The issue is due to incorrect handling of certain TCP segments in transparent mode. Sending a crafted TCP segment can poison MAC tables in adjacent devices, causing network disruption.

A vulnerability in the memory management of Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS). The issue is due to improper resource management when connection rates are high. Exploitation involves opening a significant number of connections.

Multiple vulnerabilities in the Application Level Gateway (ALG) for the Network Address Translation (NAT) feature of Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass the ALG and open unauthorized connections with a host behind the ALG. These vulnerabilities are publicly known as NAT Slipstreaming.

Multiple vulnerabilities in the Application Level Gateway (ALG) for the Network Address Translation (NAT) feature of Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass the ALG and open unauthorized connections with a host behind the ALG. These vulnerabilities are publicly known as NAT Slipstreaming.

A vulnerability in the identity-based firewall (IDFW) rule processing feature of Cisco ASA and Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass security protections. This is due to improper handling of network requests by devices configured with object group search. An attacker could send a specially crafted request to bypass ACL rules and send traffic to unauthorized hosts.

A vulnerability in the software-based SSL/TLS message handler of Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to reload the device, causing a denial of service (DoS). The issue is due to insufficient validation of SSL/TLS messages during software-based decryption. Exploitation involves sending a crafted SSL/TLS message.