CVE Vulnerability Catalog

Restlet Framework before 2.3.11, when using SimpleXMLProvider, allows remote attackers to access arbitrary files via an XXE attack in a REST API HTTP request. This affects use of the Jax-rs extension.

An issue was discovered on D-Link DIR-605L Model B before FW2.11betaB06_hbrf devices, related to the code that handles the authentication values for HNAP. An attacker can cause a denial of service (device crash) or possibly have unspecified other impact by sending a sufficiently long string in the password field of the HTTP Basic Authentication section of the HTTP request.

Apache CXF Fediz plugins for Spring 2, 3, and 4 before versions 1.4.3 and 1.3.3 contain a CSRF vulnerability that can lead to a security context being set up using a malicious client's roles for the given end user.

A vulnerability in Cisco WebEx Network Recording Player allows for remote code execution affecting ARF and WRF files. A remote attacker could exploit this by sending a malicious ARF or WRF file to a user and convincing them to launch it.

A vulnerability exists in Cisco WebEx Network Recording Player that allows remote code execution through malicious ARF or WRF files. An attacker could exploit this by convincing a user to launch such a file.

A remote code execution vulnerability exists in Cisco WebEx Network Recording Player related to ARF and WRF files. A remote attacker could exploit this by providing a malicious ARF or WRF file to a user, potentially causing the player to crash or allowing arbitrary code execution on the user's system.

A 'Cisco WebEx Network Recording Player Out-of-Bounds Vulnerability' exists in Cisco WebEx Network Recording Player for ARF and WRF files. A remote attacker could exploit this by providing a user with a malicious ARF or WRF file, leading to player crashes or arbitrary code execution on the user's system.

A vulnerability in Cisco WebEx Network Recording Player allows for remote code execution related to ARF and WRF files. A remote attacker could exploit this by providing a user with a malicious ARF or WRF file, potentially causing the player to crash or allowing arbitrary code execution on the user's system.

A denial of service vulnerability exists in Cisco WebEx Network Recording Player related to ARF and WRF files. A remote attacker could exploit this by providing a malicious ARF or WRF file, which could cause the player to crash or, in some cases, allow arbitrary code execution on the user's system.

Multiple vulnerabilities in Cisco Data Center Network Manager (DCNM) Software could allow a remote attacker to inject arbitrary values into DCNM configuration parameters, redirect a user to a malicious website, inject malicious content into a DCNM client interface, or conduct a cross-site scripting (XSS) attack against a user of the affected software.

Splunk Web in Splunk Enterprise versions 7.0.x before 7.0.0.1, 6.6.x before 6.6.3.2, 6.5.x before 6.5.6, 6.4.x before 6.4.9, and 6.3.x before 6.3.12, when SAML authType is enabled, mishandles SAML, allowing remote attackers to bypass intended access restrictions or conduct impersonation attacks.

An issue was discovered in Squiz Matrix before 5.3.6.1 and 5.4.x before 5.4.1.3, allowing authenticated users with permissions to edit design assets to cause Remote Code Execution (RCE) via a maliciously crafted time_format tag.

The 'File Bridge' plugin in Squiz Matrix versions from 5.3 to 5.3.6.1 and 5.4.1.3 has an information disclosure issue caused by a Path Traversal vulnerability, allowing confirmation of the existence of files outside the bridged path.

Atlassian Fisheye and Crucible versions less than 4.4.3 and version 4.5.0 are vulnerable to argument injection through filenames in Mercurial repositories, allowing attackers to execute arbitrary code on a system running the impacted software.

An improper access control vulnerability in Fortinet FortiWebManager 5.8.0 allows anyone that can access the admin webUI to successfully log-in regardless of the provided password.

Versions of curl and libcurl before 7.57.0 on 32-bit platforms allow attackers to cause a denial of service through out-of-bounds access, leading to application crashes.

The FTP wildcard function in curl and libcurl before version 7.57.0 allows remote attackers to cause a denial of service (out-of-bounds read and application crash) or possibly have unspecified other impact via a string that ends with an '[' character.

The NTLM authentication feature in curl and libcurl before version 7.57.0 on 32-bit platforms allows attackers to cause a denial of service through integer overflow and resultant buffer overflow, leading to application crash.

EMC RSA Authentication Agent API version 8.5 for C and RSA Authentication Agent SDK version 8.6 for C allow attackers to bypass authentication, known as an 'Error Handling Vulnerability.'

EMC RSA Authentication Agent for Web: Apache Web Server version 8.0 and RSA Authentication Agent for Web: Apache Web Server version 8.0.1 prior to Build 618 have a security vulnerability that could potentially lead to authentication bypass.