CVE Vulnerability Catalog

VMware Horizon View Client versions 2.x, 3.x, and 4.x prior to 4.5.0 contain a command injection vulnerability in the service startup script. Successful exploitation of this issue may allow unprivileged users to escalate their privileges to root on the Mac OSX system where the client is installed.

CVE-2016-7050 affects the SerializableProvider component in RESTEasy, present in various versions of Red Hat Enterprise Linux. It allows remote attackers to execute arbitrary code.

The 389 Directory Server in Red Hat Enterprise Linux (Desktop, HPC Node, Server, Workstation) versions 6 and 7 allows remote attackers to obtain user passwords.

The PooledInvokerServlet in JBoss EAP 4.x and 5.x allows remote attackers to execute arbitrary code via a crafted serialized payload.

SQL injection vulnerability in ClearPass Policy Manager versions 6.5.x through 6.5.6 and 6.6.0.

Red5 Media Server versions before 1.0.8 have an issue with deserialization as they do not restrict the classes for which deserialization is performed. This allows remote attackers to execute arbitrary code via crafted Java data.

Seagate Business NAS devices with firmware before version 2015.00322 allow remote attackers to execute arbitrary code with root privileges by leveraging the use of a static encryption key to create session tokens.

A vulnerability in Cisco Prime Data Center Network Manager (DCNM) Software allows an unauthenticated, remote attacker to log in to the administrative console of a DCNM server using an account with a default, static password. This account may have root or system-level privileges.

A vulnerability in the role-based access control (RBAC) functionality of Cisco Prime Data Center Network Manager (DCNM) could allow an unauthenticated, remote attacker to access sensitive information or execute arbitrary code with root privileges on an affected system.

VMware Unified Access Gateway and Horizon View contain a heap buffer-overflow vulnerability that may allow a remote attacker to execute code on the security gateway.

The drag-and-drop (DnD) function in VMware Workstation 12.x before version 12.5.4 and Fusion 8.x before version 8.5.5 has an out-of-bounds memory access vulnerability. This may allow a guest to execute code on the operating system that runs Workstation or Fusion.

SQL injection vulnerability in ZCMS 1.1 allows attackers to manipulate database queries.

VMware vSphere Data Protection (VDP) versions 6.1.x, 6.0.x, 5.8.x, and 5.5.x locally stores vCenter Server credentials using reversible encryption. This may allow plaintext credentials to be obtained.

VMware vSphere Data Protection (VDP) versions 6.1.x, 6.0.x, 5.8.x, and 5.5.x contain a deserialization issue. Exploitation of this issue may allow a remote attacker to execute commands on the appliance.

IBM BigFix Compliance version 1.9.70 does not require strong passwords by default, making it easier for attackers to compromise user accounts.

IBM Domino versions 8.5 and 9.0 could allow an attacker to steal credentials using multiple sessions and large amounts of data via Domino TLS Key Exchange validation.

The XXE vulnerability in Milton Webdav before version 2.7.0.3 allows an attacker to exploit external XML entities to gain access to system data.

An issue was discovered in Personify360 e-Business versions 7.5.2 through 7.6.1 that allows anyone to add a vendor account or read existing vendor account data, including usernames and passwords, by accessing the /TabId/275 URI.

Game-music-emu before 0.6.1 mishandles unspecified integer values.

The Fedora Nagios package uses 'nagiosadmin' as the default password for the 'nagiosadmin' administrator account, making it easier for remote attackers to gain access by leveraging knowledge of the credentials.