CVE Vulnerability Catalog

Missing authentication for the remote configuration port 1236/tcp on the Cohu 3960HD allows an attacker to change configuration parameters such as IP address and username/password via specially crafted XML SOAP packets.

Ohcount version 3.0.0 is prone to command injection via specially crafted filenames containing shell metacharacters. An attacker can exploit this vulnerability by providing a source tree for Ohcount processing, allowing arbitrary code execution as the user running Ohcount.

A flaw was found in the way Ansible (2.3.x before 2.3.3, and 2.4.x before 2.4.1) passed certain parameters to the jenkins_plugin module. Remote attackers could use this flaw to expose sensitive information from a remote host's logs.

Fiyo CMS 2.0_1.9.1 has multiple SQL injection vulnerabilities that allow remote attackers to execute arbitrary SQL commands. The attack can be carried out via the 'id' parameter in rating.php or the 'user' parameter in the login process.

Frame replay vulnerability in Wi-Fi subsystem in Intel Dual-Band and Tri-Band Wireless-AC Products allows remote attacker to replay frames via channel-based man-in-the-middle.

A vulnerability in the Intel Deep Learning Training Tool Beta 1 allows a network attacker to remotely execute code as a local user.

Buffer overflow in Active Management Technology (AMT) in Intel Manageability Engine Firmware 8.x, 9.x, 10.x, 11.0, 11.5, 11.6, 11.7, 11.10, and 11.20 allows an attacker with remote Admin access to the system to execute arbitrary code with AMT execution privilege.

Multiple buffer overflows in Active Management Technology (AMT) in Intel Manageability Engine Firmware versions 8.x, 9.x, 10.x, 11.0, 11.5, 11.6, 11.7, 11.10, and 11.20 allow an attacker with local access to the system to execute arbitrary code with AMT execution privilege.

Multiple privilege escalations in kernel in Intel Trusted Execution Engine Firmware 3.0 allows unauthorized process to access privileged content via unspecified vector.

Multiple privilege escalations in kernel in Intel Server Platform Services Firmware 4.0 allow unauthorized processes to access privileged content via unspecified vector.

Multiple privilege escalations in kernel in Intel Manageability Engine Firmware versions 11.0/11.5/11.6/11.7/11.10/11.20 allow unauthorized processes to access privileged content via unspecified vector.

Multiple buffer overflows in kernel in Intel Trusted Execution Engine Firmware 3.0 allow attacker with local access to the system to execute arbitrary code.

Multiple buffer overflows in kernel in Intel Server Platform Services Firmware 4.0 allow attacker with local access to the system to execute arbitrary code.

Multiple buffer overflows in kernel in Intel Manageability Engine Firmware versions 11.0/11.5/11.6/11.7/11.10/11.20 allow an attacker with local access to the system to execute arbitrary code.

There is a command injection vulnerability in Shenzhen Tenda Ac9, Ac15, and Ac18 devices that allows remote unauthenticated attackers to execute arbitrary OS commands. This issue arises from improper input handling in the 'sub_A6E8 usbeject_process_entry' function.

A code injection vulnerability exists in Kernel/System/Spelling.pm in Open Ticket Request System (OTRS) affecting versions 5 before 5.0.24, 4 before 4.0.26, and 3.3 before 3.3.20. An authenticated remote attacker can execute shell commands as the webserver user via URL manipulation.

In dayrui FineCms version 5.2.0, the v5/config/system.php file has a default SYS_KEY value and does not require key regeneration for each installation. This allows remote attackers to upload arbitrary .php files via a member api swfupload action to index.php.

An issue was discovered in middleware.py in OpenStack Swauth through 1.2.0 when used with OpenStack Swift through 2.15.1. The Swift object store and proxy server are saving (unhashed) tokens retrieved from the Swauth middleware authentication mechanism to a log file, allowing attackers to bypass authentication.

The default installation of DocuWare Fulltext Search server through 6.11 allows remote users to connect to and download searchable text from the embedded Solr service, bypassing DocuWare's access control features. An attacker can also gain privileges by modifying text.

The VC-2 Video Compression encoder in FFmpeg versions 3.0 and 3.4 contains a flaw that allows remote attackers to cause a denial of service (out-of-bounds read) due to incorrect buffer padding for non-Haar wavelets.