CVE Vulnerability Catalog

A vulnerability in the Smart Install feature of Cisco IOS and IOS XE Software could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a denial of service (DoS). It is due to improper validation of packet data. Sending a crafted packet to TCP port 4786 can cause a device reload. Only Smart Install client switches are affected, not Smart Install directors.

A vulnerability in the BFD offload implementation of Cisco Catalyst 4500 and 4500-X Series Switches could allow an unauthenticated, remote attacker to cause a crash of the iosd process, resulting in a denial of service (DoS). It is due to insufficient error handling when the BFD header in a BFD packet is incomplete. Sending a crafted BFD message can trigger a system reload.

A vulnerability in the crypto engine of the Cisco Integrated Services Module for VPN (ISM-VPN) running Cisco IOS Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. The issue is due to insufficient handling of VPN traffic. An attacker could exploit this by sending crafted VPN traffic, causing the device to hang or crash.

A vulnerability in the QoS subsystem of Cisco IOS and IOS XE Software is due to incorrect bounds checking of values in packets destined for UDP port 18999. An unauthenticated remote attacker can send malicious packets, causing a buffer overflow that may lead to arbitrary code execution with elevated privileges or a device reload.

A cross-site scripting (XSS) vulnerability in ZmMailMsgView.getAttachmentLinkHtml in Zimbra Collaboration Suite (ZCS) before 8.7 Patch 1 and 8.8.x before 8.8.7. Remote attackers can inject arbitrary web script or HTML via a Content-Location header in an email attachment.

A vulnerability in the Border Gateway Protocol (BGP) over an Ethernet Virtual Private Network (EVPN) for Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause the device to reload, resulting in a denial of service (DoS) condition, or potentially corrupt the BGP routing table, which could result in network instability. The vulnerability exists due to changes in the implementation of the BGP MPLS-Based Ethernet VPN RFC (RFC 7432) draft between IOS XE software releases. When the BGP Inclusive Multicast Ethernet Tag Route or BGP EVPN MAC/IP Advertisement Route update packet is received, it could be possible that the IP address length field is miscalculated. This vulnerability affects all releases of Cisco IOS XE Software prior to software release 16.3 that support BGP EVPN configurations.

A buffer overflow was found in the MikroTik RouterOS SMB service when processing NetBIOS session request messages. A remote attacker with access to the service can exploit this vulnerability to gain code execution on the system, and the overflow occurs before authentication, so an unauthenticated remote attacker can exploit it.

A vulnerability in Java deserialization used by Cisco Secure Access Control System (ACS) prior to release 5.8 patch 9 is due to insecure deserialization of user-supplied content. An unauthenticated remote attacker can send a crafted serialized Java object and execute arbitrary commands on the device with root privileges.

An OS command injection vulnerability in soap.cgi (soapcgi_main in cgibin) in D-Link DIR-880L, DIR-868L, DIR-865L, and DIR-860L routers in specific firmware versions allows remote attackers to execute arbitrary OS commands via the service parameter.

SAP CRM, 7.01, 7.02, 7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing 'traverse to parent directory' are passed through to the file APIs.

An issue was discovered in the base64d function in the SMTP listener in Exim before 4.90.1. Sending a handcrafted message may cause a buffer overflow, which can be used to execute code remotely.