CVE Vulnerability Catalog

An issue in Pivotal PCF Elastic Runtime allows unprivileged attackers to impersonate other users due to incomplete validation in JSON Web Token (JWT) libraries. This affects versions 1.6.x prior to 1.6.60, 1.7.x prior to 1.7.41, 1.8.x prior to 1.8.23, and 1.9.x prior to 1.9.1.

An issue was discovered in Cloud Foundry Foundation routing-release versions prior to 0.142.0 and cf-release versions 203 to 231. Incomplete validation logic in JSON Web Token (JWT) libraries can allow unprivileged attackers to impersonate other users to the routing API.

A command injection vulnerability was discovered in Cloud Foundry in versions prior to v245 and in cf-mysql-release versions prior to v31. A malicious user may exploit numerous vectors to execute arbitrary commands on servers running Cloud Foundry.

nscd in the GNU C Library (glibc or libc6) before version 2.20 does not correctly compute the size of an internal buffer when processing netgroup requests, possibly leading to an nscd daemon crash or code execution as the user running nscd.

There is a remote stack-based buffer overflow in register.ghp in EFS Software Easy Chat Server versions 2.0 to 3.1. An attacker may send an overly long username string to registresult.htm, potentially allowing arbitrary code execution.

D-Link DIR-615 Wireless N 300 Router allows authentication bypass via a modified POST request to login.cgi. This issue occurs because it fails to validate the password field.

SKYSEA Client View w wersji 11.221.03 i wcześniejszych umożliwia zdalne wykonanie kodu z powodu luki w przetwarzaniu uwierzytelniania w połączeniu TCP z programem konsoli zarządzającej.

A use-after-free vulnerability in H2O allows remote attackers to cause a denial-of-service (DoS) or obtain server certificate private keys and possibly other information.

I-O DATA DEVICE WFS-SR01 firmware version 1.10 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors.

IBM Tivoli Key Lifecycle Manager does not require that users should have strong passwords by default, which makes it easier for attackers to compromise user accounts.

AdBlock before 2.21 allows remote attackers to block arbitrary resources on arbitrary websites and to disable arbitrary blocking filters.

In PHP versions 7.0.7 and 5.6.x, a vulnerability allows remote attackers to execute arbitrary code. This issue was introduced as part of an incomplete fix for CVE-2015-6833.

VMware Horizon View Client versions 2.x, 3.x, and 4.x prior to 4.5.0 contain a command injection vulnerability in the service startup script. Successful exploitation of this issue may allow unprivileged users to escalate their privileges to root on the Mac OSX system where the client is installed.

CVE-2016-7050 affects the SerializableProvider component in RESTEasy, present in various versions of Red Hat Enterprise Linux. It allows remote attackers to execute arbitrary code.

The 389 Directory Server in Red Hat Enterprise Linux (Desktop, HPC Node, Server, Workstation) versions 6 and 7 allows remote attackers to obtain user passwords.

The PooledInvokerServlet in JBoss EAP 4.x and 5.x allows remote attackers to execute arbitrary code via a crafted serialized payload.

SQL injection vulnerability in ClearPass Policy Manager versions 6.5.x through 6.5.6 and 6.6.0.

Red5 Media Server versions before 1.0.8 have an issue with deserialization as they do not restrict the classes for which deserialization is performed. This allows remote attackers to execute arbitrary code via crafted Java data.

Seagate Business NAS devices with firmware before version 2015.00322 allow remote attackers to execute arbitrary code with root privileges by leveraging the use of a static encryption key to create session tokens.

A vulnerability in Cisco Prime Data Center Network Manager (DCNM) Software allows an unauthenticated, remote attacker to log in to the administrative console of a DCNM server using an account with a default, static password. This account may have root or system-level privileges.