CVE Vulnerability Catalog

A vulnerability in Cisco WebEx browser extensions for Google Chrome and Mozilla Firefox could allow an unauthenticated, remote attacker to execute arbitrary code with the privileges of the affected browser on an affected system. The vulnerability is due to a design defect in the extension.

A vulnerability in the web proxy functionality of the Cisco Web Security Appliance (WSA) could allow an unauthenticated, remote attacker to forward traffic from the web proxy interface to the administrative management interface of the affected device, known as an Access Control Bypass Vulnerability.

A vulnerability in AsyncOS for the Cisco Web Security Appliance (WSA) could allow an unauthenticated local attacker to log in to the device with the privileges of a limited user or an unauthenticated remote attacker to authenticate to certain areas of the web GUI.

A vulnerability in the web interface of the Cisco Web Security Appliance (WSA) allows an authenticated, remote attacker to perform command injection and elevate privileges to root. The attacker must authenticate with valid administrator credentials.

A vulnerability in certain filtering mechanisms of access control lists (ACLs) for Cisco ASR 5000 Series Aggregation Services Routers through 21.x could allow an unauthenticated, remote attacker to bypass ACL rules that have been configured for an affected device.

A vulnerability in the GPRS support node (GGSN) of Cisco ASR 5000 Series Aggregation Services Routers from versions 17.3.9.62033 to 21.1.2 allows an unauthenticated, remote attacker to redirect HTTP traffic sent to an affected device.

Multiple cross-site request forgery (CSRF) vulnerabilities in the Podcast feature in Subsonic 6.1.1 allow remote attackers to hijack the authentication of users for requests such as subscribing to a podcast or updating Internet Radio Settings.

SAP TREX 7.10 allows remote attackers to (1) read arbitrary files via an fget command or (2) write to arbitrary files and consequently execute arbitrary code via an fdir command.

ZyXEL PK5001Z devices have zyad5001 as the su password, which makes it easier for remote attackers to obtain root access if a non-root account password is known (or a non-root default account exists within an ISP's deployment of these devices).

s2k.js in OpenPGP.js allows decrypting arbitrary messages regardless of passphrase for crafted PGP keys, enabling remote attackers to bypass authentication if message decryption is used as an authentication mechanism.

The vulnerability in hwpapp.dll in Hangul Word Processor allows remote attackers to execute arbitrary code via a crafted heap spray and by leveraging 'type confusion' through an HWPX file containing a crafted para text tag.

In xzgrep versions 5.2.x before 5.2.0 and before 5.0.0, the script scripts/xzgrep.in does not properly process file names containing semicolons. This allows remote attackers to execute arbitrary code by having a user run xzgrep on a crafted file name.

The cipherstring parsing code in nss_compat_ossl while in multi-keyword mode does not match the expected set of ciphers for a given cipher combination, allowing attackers to have unspecified impact via unknown vectors.

CVE-2015-2798 is a SQL injection vulnerability in Joomla! Component Contact Form Maker version 1.0.1 that allows remote attackers to execute arbitrary SQL commands via the id parameter.

CVE-2015-1438 involves a heap-based buffer overflow in the Panda Security Kernel Memory Access Driver version 1.0.0.13, allowing attackers to execute arbitrary code with kernel privileges via a crafted size input for allocated kernel paged pool and allocated non-paged pool buffers.

The inet module in FreeBSD in versions before 10.2-PRERELEASE, 10.2-BETA2-p2, 10.2-RC1-p1, 10.1 before 10.1-RELEASE-p16, 9.x before 9.3-STABLE, 9.3-RELEASE-p21, and 8.x before 8.4-STABLE, 8.4-RELEASE-p35, with VNET enabled and at least 16 VNET instances is vulnerable to a denial of service attack (mbuf consumption) via multiple concurrent TCP connections.

The oxide::JavaScriptDialogManager function in oxide-qt before version 1.9.1, packaged in Ubuntu 15.04 and Ubuntu 14.04, allows remote attackers to cause application crashes or execute arbitrary code via a crafted website.

MEDHOST Connex contains hard-coded credentials for customer database access. An attacker with knowledge of these credentials and the ability to communicate with the database may obtain or modify sensitive patient and financial information.

AppUse 4.0 allows shell command injection via a proxy field.

CVE-2017-7980 involves a heap-based buffer overflow in the Cirrus CLGD 54xx VGA Emulator in Quick Emulator (Qemu) version 2.8 and earlier. This allows local guest OS users to execute arbitrary code or cause a denial of service (crash) via vectors related to a VNC client updating its display after a VGA operation.