CVE Vulnerability Catalog

The custom authentication realm used by karaf-tomcat's 'opendaylight' realm in Opendaylight before Helium SR3 will authenticate any username and password combination.

Versions of kamailio before 4.2.0-2 have a vulnerability that allows local users to gain elevated privileges.

OpenDaylight defense4all version 1.1.0 and earlier allows remote authenticated users to write report data to arbitrary files.

Internet Explorer versions 6-11 allow remote attackers to execute arbitrary code.

CVE-2012-5010 vulnerability affects various versions of ASA (Adaptive Security Appliance) software that are susceptible to attacks before specific patch versions. This particularly concerns versions 9.4.x, 9.2.x, 8.4.x, 8.2.x, 9.1.x, and 1.2.4.x for ACI devices.

Ebuild in Gentoo may change directory and file permissions depending on the order of installed packages, allowing local users to read or write to restricted directories or execute restricted commands.

In Code42 CrashPlan 5.4.x, remote code execution is possible via the org.apache.commons.ssl.rmi.DateRMI class, which upon instantiation creates an RMI server that listens on a TCP port and deserializes objects sent by TCP clients.

TeamSpeak Client 3.0.19 allows remote attackers to cause an application crash via a sequence of Unicode characters, leading to denial of service.

IBM API Connect version 5.0.6.0 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.

IBM DB2 for Linux, UNIX and Windows versions 9.2, 10.1, 10.5, and 11.1 is vulnerable to a stack-based buffer overflow, caused by improper bounds checking which could allow a local attacker to execute arbitrary code.

IBM DB2 for Linux, UNIX and Windows versions 9.2, 10.1, 10.5, and 11.1 is vulnerable to a buffer overflow that could allow a local user to overwrite DB2 files or cause a denial of service.

IBM QRadar versions 7.2 and 7.3 do not require users to have strong passwords by default, making it easier for attackers to compromise user accounts.

In the web management interface of the Foscam C1 Indoor HD Camera running application firmware version 2.52.2.37, a specially crafted HTTP request can allow a user to inject arbitrary data into the 'msmtprc' configuration file, resulting in command execution. An attacker can simply send an HTTP request to the device to trigger this vulnerability.

In the web management interface of the Foscam C1 Indoor HD Camera running application firmware 2.52.2.37, a specially crafted HTTP request can allow a user to inject arbitrary data into the 'msmtprc' configuration file, resulting in command execution. An attacker can simply send an HTTP request to the device to trigger this vulnerability.

A command injection vulnerability exists in the web management interface of the Foscam C1 Indoor HD Camera. A specially crafted HTTP request can allow an attacker to inject arbitrary data into the 'msmtprc' configuration file, leading to command execution.

tpm2-tools versions before 1.1.1 are vulnerable to a password leak due to transmitting password in plaintext from client to server when generating HMAC.

OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to denial-of-service and/or possibly sensitive memory leak triggered by man-in-the-middle attacker.

OpenVPN versions before 2.4.3 and before 2.3.17 are vulnerable to remote denial-of-service when receiving malformed IPv6 packet.

Exiv2 version 0.26 has an invalid free in Image::printIFDStructure that leads to a segmentation fault. Crafted input can lead to a remote denial of service attack.