CVE Vulnerability Catalog

An issue was discovered on Humax Digital HG100R 2.0.6 devices that allows downloading the backup file without the need for credentials. Additionally, the router credentials are stored in plaintext inside the backup file, known as GatewaySettings.bin.

An Improper Authentication issue was discovered in Newport XPS-Cx and XPS-Qx. An attacker may bypass authentication by accessing a specific uniform resource locator (URL).

The management interface for the Teltonika RUT9XX routers (aka LuCI) with firmware 00.03.265 and earlier allows remote attackers to execute arbitrary commands with root privileges via shell metacharacters in the username parameter in a login request.

The dashboard subscription interface in Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2 might allow remote authenticated users with certain privileges to execute arbitrary code via a crafted saved search name.

Request Tracker (RT) versions 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2 allow remote attackers to obtain sensitive information about CSRF verification tokens via a crafted URL.

NetApp OnCommand System Manager before version 9.0 allows remote attackers to obtain sensitive credentials via vectors related to cluster peering setup.

NetApp AltaVault 4.1 and earlier allows man-in-the-middle attackers to obtain sensitive information, gain privileges, or cause a denial of service via vectors related to the SMB protocol.

NetApp Clustered Data ONTAP has a vulnerability that allows man-in-the-middle attackers to obtain sensitive information, gain privileges, or cause a denial of service due to the failure to enable SMB signing enforcement in its default state.

NetApp Data ONTAP versions 8.1 and 8.2, when operating in 7-Mode, allows man-in-the-middle attackers to obtain sensitive information, gain privileges, or cause a denial of service via vectors related to the SMB protocol.

AeroAdmin 4.1 uses an insecure protocol (HTTP) to perform software updates. An attacker can hijack an update via man-in-the-middle in order to execute code on the machine.

AeroAdmin 4.1 uses a function to copy data between two pointers where the size of the data copied is taken directly from a network packet. This can cause a buffer overflow and denial of service.

The NFSv4 server in the Linux kernel before 4.11.3 does not properly validate the layout type when processing the NFSv4 pNFS GETDEVICEINFO or LAYOUTGET operand in a UDP packet from a remote attacker. This uninitialized type value leads to an OOPS and eventually a DoS of knfsd and a soft-lockup of the whole system.

Tor 0.3.x before 0.3.0.9 has a guard-selection algorithm that only considers the exit relay, not the exit relay's family. This may allow remote attackers to defeat intended anonymity properties by leveraging the existence of large families.

The _asn1_check_identifier function in GNU Libtasn1 through 4.12 causes a NULL pointer dereference and crash when reading crafted input that triggers assignment of a NULL value within an asn1_node structure.

The DBD::mysql module through 4.043 for Perl allows remote attackers to cause a denial of service (use-after-free and application crash) or possibly have unspecified other impact by triggering certain error responses from a MySQL server or a loss of a network connection to a MySQL server.

Versions of MCollective prior to 2.10.4 deserialized YAML from agents without calling safe_load, allowing the potential for arbitrary code execution on the server. The fix for this is to call YAML.safe_load on input.

In avcodec 2.2.x, used in VideoLAN VLC media player 2.2.7-x before June 29, 2017, there is a flaw that allows out-of-bounds heap memory write. This is due to an incorrect size passed to memcpy(), leading to application crashes or potentially code execution.

An XML External Entity (XXE) issue exists in OSCI-Transport 1.2 as used in OSCI Transport Library 1.6.1 (Java) and OSCI Transport Library 1.6 (.NET), exploitable by sending a crafted standard-conforming OSCI message from within the infrastructure.

A Weak Cryptography for Passwords issue was discovered in General Electric (GE) Multilin SR 750, SR 760, SR 469, SR 489, SR 745, SR 369, and Multilin Universal Relay and URplus devices. Firmware versions prior to specified versions are susceptible to dictionary attacks due to the use of a non-random initialization vector.