CVE Vulnerability Catalog

The default authentication protocol in IBM Tivoli Storage Manager (IBM Spectrum Protect 7.1 and 8.1) is vulnerable to a brute force attack due to disclosing too much information during authentication. An attacker could gain user or administrative access to the TSM server.

A remote code execution vulnerability exists in HP UCMDB Foundation Software versions 10.10, 10.11, 10.20, 10.21, 10.22, 10.30, 10.31, 10.32, and 10.33, which could be remotely exploited to allow code execution.

In FreeBSD through version 11.1, the smb_strdupin function in sys/netsmb/smb_subr.c has a race condition leading to an out-of-bounds read, because it can cause t2p->t_name strings to lack a final null character.

EmTec PyroBatchFTP before 3.18 allows remote servers to cause application crashes, leading to denial of service.

ImageMagick version 7.0.7-2 contains a memory leak in ReadYUVImage in coders/yuv.c.

ImageMagick version 7.0.7-2 contains a memory leak in ReadYCBCRImage in coders/ycbcr.c.

A vulnerability in the gRPC code of Cisco IOS XR Software for Cisco Network Convergence System (NCS) 5500 Series Routers could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition when the emsd service stops. The vulnerability is due to the software's inability to process HTTP/2 packets.

A vulnerability in the web interface of Cisco License Manager software allows an unauthenticated, remote attacker to download and view files within the application that should be restricted, known as Directory Traversal. The issue is due to improper sanitization of user-supplied input in HTTP request parameters that describe filenames.

A vulnerability in the implementation of the direct authentication feature in Cisco Adaptive Security Appliance (ASA) Software could allow an unauthenticated, remote attacker to cause an affected device to unexpectedly reload, resulting in a denial of service (DoS) condition. The vulnerability is due to incomplete input validation of the HTTP header.

A vulnerability in SSL traffic decryption for Cisco Firepower Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to cause depletion of system memory, leading to a denial of service (DoS) condition. The issue arises from an error in how the Firepower Detection Snort Engine handles SSL traffic decryption.

A vulnerability in the detection engine parsing of IPv6 packets for Cisco Firepower System Software could allow an unauthenticated, remote attacker to cause high CPU utilization or to cause a denial of service (DoS) condition because the Snort process restarts unexpectedly.

The Binary File Descriptor (BFD) library in GNU Binutils 2.29 has a pointer mishandling issue in dwarf1.c, which may lead to application crashes or unspecified other impacts via a crafted ELF file.

LAME 3.99.5 has a NULL Pointer Dereference in the hip_decode_init function within libmp3lame/mpglib_interface.c triggered by a malformed mpg file due to an incorrect calloc call.

ImageMagick version 7.0.7-0 Q16 has a NULL pointer dereference vulnerability in ReadOneMNGImage in coders/png.c.

ImageMagick version 7.0.7-0 Q16 has a NULL pointer dereference vulnerability in ReadEnhMetaFile in coders/emf.c.

ImageMagick version 7.0.7-0 Q16 has a NULL pointer dereference vulnerability in PDFDelegateMessage in coders/pdf.c.

An Improper Authentication issue was discovered in Ctek SkyRouter Series 4200 and 4400, all versions prior to V6.00.11. A malicious user can access the application without authenticating by accessing a specific URL on the web server.

An Improper Authentication issue was discovered in iniNet Solutions iniNet Webserver, all versions prior to V2.02.0100. The webserver does not properly authenticate users, which may allow a malicious attacker to access sensitive information such as HMI pages or modify PLC variables.

An issue with uncontrolled search path was discovered in i-SENS SmartLog Diabetes Management Software, version 2.4.0 and prior. This vulnerability allows an attacker to place a specially crafted DLL file in the search path, potentially leading to arbitrary code execution on the system.

An Improper Privilege Management issue was discovered in SpiderControl SCADA Web Server Version 2.02.0007 and prior. Authenticated, non-administrative local users are able to alter service executables with escalated privileges.