CVE Vulnerability Catalog

Vulnerability in the Primavera Gateway component of Oracle Primavera Products Suite allows a high privileged attacker with network access via HTTP to compromise Primavera Gateway. The attack may significantly impact additional products in the ecosystem.

Vulnerability in the Primavera P6 Enterprise Project Portfolio Management component of Oracle Primavera Products Suite allows a low privileged attacker with network access via HTTP to compromise the system. Affected versions are 8.3, 8.4, 15.1, 15.2, 16.1, and 16.2.

Vulnerability in the Automatic Service Request (ASR) component of Oracle Support Tools, affecting versions prior to 5.7. It allows an unauthenticated attacker with network access to compromise ASR.

A vulnerability in lshell 0.9.16 allows remote authenticated users to break out of a limited shell and execute arbitrary commands.

lshell version 0.9.16 allows remote authenticated users to break out of a limited shell and execute arbitrary commands.

Buffer overflow in QuickTime before 7.7.1 for Windows allows remote attackers to execute arbitrary code.

FreeType 2 before March 24, 2017, has an out-of-bounds write caused by a heap-based buffer overflow related to the t1_decoder_parse_charstrings function in psaux/t1decode.c.

Yeager CMS version 1.2.1 has an SQL injection vulnerability in the password recovery feature that allows remote attackers to change the account credentials of known users via the 'userEmail' parameter.

D-Link DVG-N5402SP with firmware W1000CN-00, W1000CN-03, or W2000EN-00 discloses usernames, passwords, keys, values, and web account hashes (super and admin) in plaintext when running a configuration backup.

D-Link DVG-N5402SP with firmware W1000CN-00, W1000CN-03, or W2000EN-00 has a default password of 'root' for the root account and 'tw' for the tw account, making it easier for remote attackers to gain administrative access.

A vulnerability in Juniper Networks NorthStar Controller Application prior to version 2.1.0 Service Pack 1 may allow an unauthenticated, unprivileged, network-based attacker to cause various denials of services leading to targeted information disclosure, modification of any component of the NorthStar system, including managed systems, and full denial of services to any systems under management which NorthStar interacts with using read-only or read-write credentials.

The Regular Expressions package in International Components for Unicode (ICU) for C/C++ before 2014-12-03, as used in Google Chrome before version 40.0.2214.91, calculates certain values without ensuring that they can be represented in a 24-bit field. This allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted string.

On the TP-Link TL-SG108E 1.0, admin network communications are encoded using the deprecated RC4 algorithm. This issue affects the 1.1.2 Build 20141017 Rel.50749 firmware.

On the TP-Link TL-SG108E 1.0, a remote attacker could retrieve credentials from 'Switch Info' log lines where passwords are in cleartext. This affects the 1.1.2 Build 20141017 Rel.50749 firmware.

On the TP-Link TL-SG108E 1.0, a remote attacker could retrieve credentials from 'SEND data' log lines where passwords are encoded in hexadecimal. This affects the 1.1.2 Build 20141017 Rel.50749 firmware.

Exponent CMS versions 2.4.1 and earlier have an SQL injection vulnerability via a base64 serialized API key (apikey parameter) in the api function of framework/modules/eaas/controllers/eaasController.php.

The backend/Login/load/ script in Shopware before version 5.1.5 allows remote attackers to execute arbitrary code.

Cygwin before 2.5.0 does not properly handle updating permissions when changing users, which allows attackers to gain privileges.

Versions of Spring AMQP before 1.5.5 contain a vulnerability in the org.springframework.core.serializer.DefaultDeserializer class that allows remote attackers to execute arbitrary code.

ExaGrid appliances with firmware before version 4.8 P26 have a default password (1) inflection for the root account and (2) support for the support account in the web interface, allowing remote attackers to gain administrative access via an SSH or HTTP session.