CVE Vulnerability Catalog

In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, the configuration file is accessible to the 'user' account via direct object reference, even though this option is not available in the normal web administrative console.

In versions 4.3.2-R4 and prior of Cambium Networks cnPilot firmware, an undocumented, root-privilege administration web shell is available using the HTTP path https://<device-ip-or-hostname>/adm/syscmd.asp.

In version 3.5 and prior of Cambium Networks ePMP firmware, a lack of input sanitation for certain parameters on the web management console allows authenticated users, including low-privilege readonly users, to inject shell meta-characters via a specially-crafted POST request to the get_chart function and execute OS-level commands as root.

In version 3.5 and prior of Cambium Networks ePMP firmware, non-administrative users 'installer' and 'home' have the capability of changing passwords for other accounts, including admin, after disabling a client-side protection mechanism.

There is an SQL injection vulnerability in the LoginServlet page in SolarWinds Storage Manager, Storage Profiler, and Backup Profiler before version 5.1.2. This allows remote attackers to execute arbitrary SQL commands via the loginName field.

CVE-2017-6094 vulnerability allows forging 'chk' values for MAC addresses, enabling access to configuration settings of other subscribers. These settings may contain sensitive information such as credentials for VoIP services.

An issue with unprotected transport of credentials was discovered in ABB Ellipse versions 8.3 through 8.9, released prior to December 2017. The vulnerability affects the authentication of Ellipse to LDAP/AD using the LDAP protocol.

A Stack-based Buffer Overflow issue was discovered in Xiongmai Technology IP Cameras and DVRs using the NetSurveillance Web interface. This vulnerability may allow an attacker to execute code remotely or crash the device.

A heap-based buffer overflow issue was identified in WECON LeviStudio HMI, which may allow remote code execution.

IBM Security Guardium 10.0 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database.

IBM Jazz for Service Management (IBM Tivoli Components 1.1.3) is vulnerable to cross-site request forgery, which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.

IBM QRadar versions 7.2 and 7.3 could allow a remote authenticated attacker to execute arbitrary commands on the system. By sending a specially-crafted request, an attacker could exploit this vulnerability.

IBM Integration Bus versions 9.0 and 10.0 transmits user credentials in clear text, which can be read by an attacker using man in the middle techniques.

IBM Jazz for Service Management (IBM Tivoli Components 1.1.3) is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.

IBM Security Guardium 10.0 Database Activity Monitor uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.

The ntguard.sys driver in IKARUS anti.virus before version 2.16.18 contains an Arbitrary Write vulnerability due to not validating input values from IOCtl 0x83000084.

The ntguard.sys driver in IKARUS anti.virus before version 2.16.18 contains an Arbitrary Write vulnerability due to not validating input values from IOCtl 0x830000c4.

The ntguard.sys driver in IKARUS anti.virus before version 2.16.18 contains an Arbitrary Write vulnerability due to not validating input values from IOCtl 0x83000080.

The ntguard.sys driver in IKARUS anti.virus before version 2.16.18 contains an Arbitrary Write vulnerability due to not validating input values from IOCtl 0x830000c0.

The ntguard.sys driver in IKARUS anti.virus before version 2.16.18 contains an Arbitrary Write vulnerability due to not validating input values from IOCtl 0x830000cc.