CVE Vulnerability Catalog

In the GUI of Ceragon FibeAir IP-10 (before version 7.2.0), a remote attacker can bypass authentication by adding an ALBATROSS cookie with the value 0-4-11 to their browser.

Siklu EtherHaul radios before version 3.7.1 and 6.x before version 6.9.0 have a built-in, hidden root account with an unchangeable password that is the same across all devices. This account is accessible via both SSH and the device's web interface, allowing full control over the embedded Linux OS.

Trango ApexLynx 2.0, ApexOrion 2.0, GigaLynx 2.0, GigaOrion 2.0, and StrataLink 3.0 devices have a built-in, hidden root account with a default password for which the MD5 hash value is public. This account is accessible via SSH and/or TELNET, allowing full control over the underlying embedded UNIX OS.

Trango Altum AC600 devices have a built-in, hidden root account with a default password of abcd1234. This account is accessible via SSH and/or TELNET, allowing full control over the underlying embedded UNIX OS on the device.

Trango Apex, Giga, and Strata devices have a built-in, hidden root account with a default password that was stored in cleartext within a software update package. This account is accessible via SSH and/or TELNET, allowing full control over the device's operating system.

CVE-2017-5226 allows a nonprivileged session to escape the bubblewrap sandbox by using the TIOCSTI ioctl to push characters into the terminal's input buffer.

In Ambari versions 1.2.0 through 2.2.2, it may be possible to execute arbitrary system commands on the Ambari Server host while generating SSL certificates for hosts in an Ambari cluster.

Zimbra Collaboration Suite (ZCS) before version 8.7.4 allows remote attackers to conduct XML External Entity (XXE) attacks.

Custom commands may be executed on Ambari Agent (2.4.x, before 2.4.2) hosts without authorization, leading to unauthorized access to operations that may affect the underlying system. Such operations are invoked by the Ambari Agent process on Ambari Agent hosts, as the user executing the Ambari Agent process.

Apache Camel's unmarshalling operations using Jackson and JacksonXML are vulnerable to Remote Code Execution attacks.

VideoLAN VLC media player before 2.1.5 allows remote attackers to execute arbitrary code or cause a denial of service.

The read_config_file function in lib/hesiod.c in Hesiod 3.2.1 defaults to the '.athena.mit.edu' domain when opening the configuration file fails, allowing remote attackers to gain root privileges by poisoning the DNS cache.

Revive Adserver versions before 3.2.5 and 4.0.0 are vulnerable to Reflected File Download (RFD) attacks. Attackers can exploit the vulnerability in `www/delivery/asyncspc.php` to remotely download a file onto the victim's machine.

Revive Adserver before 3.2.3 suffers from session fixation, allowing arbitrary session identifiers to be forced. Additionally, it does not invalidate the existing session upon successful authentication, which could enable an attacker to steal an authenticated session.

Revive Adserver before version 3.2.3 suffers from improper restriction of excessive authentication attempts. The login page is vulnerable to password-guessing attacks, which may lead to unauthorized access.

The go-jose library before version 1.0.4 is vulnerable to an invalid curve attack in the ECDH-ES algorithm. When deriving a shared key, go-jose fails to check that the received public key is on the same curve as the receiver's static private key.

The netjoin processing in Irssi 1.x before 1.0.2 allows attackers to cause a denial of service (use-after-free) and possibly execute arbitrary code via unspecified vectors.

The ssh_agent_channel_data function in PuTTY before version 0.68 allows remote attackers to have unspecified impact via a large length value in an agent protocol message, leading to a buffer overflow.

Przepełnienie bufora w funkcji ScStoragePathFromUrl w usłudze WebDAV w Internet Information Services (IIS) 6.0 w systemie Microsoft Windows Server 2003 R2 umożliwia zdalnym atakującym wykonanie dowolnego kodu poprzez długi nagłówek zaczynający się od 'If: <http://' w żądaniu PROPFIND.

Subrion CMS version 4.0.5.10 has an SQL injection vulnerability in the admin/database module via the query parameter.