CVE Vulnerability Catalog

A vulnerability in the Snort detection engine of multiple Cisco products when processing ICMP traffic could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. The issue is due to improper memory resource management while processing ICMP packets. An attacker could send a series of ICMP packets through an affected device, potentially exhausting resources and causing a reload.

A vulnerability in the SNMPv3 access control functionality of Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to query SNMP data. This is due to ineffective access control. An attacker could send an SNMPv3 query from a host not permitted by the ACL and retrieve information if valid credentials are held.

A vulnerability in the TCP Normalizer of Cisco Adaptive Security Appliance (ASA) Software and Firepower Threat Defense (FTD) Software operating in transparent mode could allow an unauthenticated, remote attacker to poison MAC address tables, resulting in a denial of service (DoS) vulnerability. The issue is due to incorrect handling of certain TCP segments in transparent mode. Sending a crafted TCP segment can poison MAC tables in adjacent devices, causing network disruption.

A vulnerability in the memory management of Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS). The issue is due to improper resource management when connection rates are high. Exploitation involves opening a significant number of connections.

Multiple vulnerabilities in the Application Level Gateway (ALG) for the Network Address Translation (NAT) feature of Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass the ALG and open unauthorized connections with a host behind the ALG. These vulnerabilities are publicly known as NAT Slipstreaming.

Multiple vulnerabilities in the Application Level Gateway (ALG) for the Network Address Translation (NAT) feature of Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass the ALG and open unauthorized connections with a host behind the ALG. These vulnerabilities are publicly known as NAT Slipstreaming.

A vulnerability in the identity-based firewall (IDFW) rule processing feature of Cisco ASA and Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass security protections. This is due to improper handling of network requests by devices configured with object group search. An attacker could send a specially crafted request to bypass ACL rules and send traffic to unauthorized hosts.

A vulnerability in the software-based SSL/TLS message handler of Cisco ASA and FTD Software could allow an unauthenticated, remote attacker to reload the device, causing a denial of service (DoS). The issue is due to insufficient validation of SSL/TLS messages during software-based decryption. Exploitation involves sending a crafted SSL/TLS message.

A vulnerability in SSH connection processing for multi-instance deployments of Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause a DoS condition. It is due to improper error handling when an SSH session fails. An attacker can send a high rate of crafted SSH connections, leading to resource exhaustion and DoS; manual reload is required.

Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an attacker to execute a cross-site scripting (XSS) attack or an open redirect attack. For more details, see the Details section of the Cisco advisory.

Multiple vulnerabilities in the web-based management interface of Cisco Firepower Management Center (FMC) could allow an attacker to perform a cross-site scripting (XSS) attack or an open redirect attack.

A vulnerability in the web-based management interface of Cisco Firepower Management Center (FMC) Software could allow an authenticated, remote attacker to perform a directory traversal attack. The attacker would require valid device credentials. The issue is due to insufficient input validation of the HTTPS URL.

A vulnerability in Cisco Firepower Threat Defense (FTD) Software allows an authenticated local attacker with administrative privileges to overwrite or append arbitrary data to system files with root privileges. This is due to incomplete validation of user input for a specific CLI command.

Multiple vulnerabilities in the CLI of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to execute arbitrary commands with root privileges. For more information, see the Details section of the advisory.

Multiple vulnerabilities in the CLI of Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to execute arbitrary commands with root privileges. For more information, see the Details section of the advisory.

Multiple vulnerabilities in the payload inspection for Ethernet Industrial Protocol (ENIP) traffic in Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to bypass configured rules for ENIP traffic. This is due to incomplete processing during deep packet inspection for ENIP packets. An attacker could send a crafted ENIP packet to bypass access control and intrusion policies.

W systemie zarządzania skargami Sourcecodester w wersji 1.0 występuje podatność na wstrzykiwanie SQL poprzez parametr cid w pliku complaint-details.php.

jQuery UI prior to version 1.13.0 is vulnerable to execution of untrusted code when the value of the `of` option of the `.position()` utility is accepted from untrusted sources. The issue is fixed in 1.13.0, where any string value passed to the `of` option is treated as a CSS selector.

jQuery UI prior to version 1.13.0 is vulnerable to execution of untrusted code when the values of various `*Text` options of the Datepicker widget are accepted from untrusted sources. The issue is fixed in 1.13.0, where values passed to various `*Text` options are always treated as pure text, not HTML.

jQuery UI prior to version 1.13.0 is vulnerable to execution of untrusted code when the value of the `altField` option of the Datepicker widget is accepted from untrusted sources. The issue is fixed in 1.13.0, where any string value passed to the `altField` option is treated as a CSS selector.