CVE Vulnerability Catalog

The Regular Expressions package in International Components for Unicode (ICU) for C/C++ before 2014-12-03, as used in Google Chrome before version 40.0.2214.91, calculates certain values without ensuring that they can be represented in a 24-bit field. This allows remote attackers to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted string.

On the TP-Link TL-SG108E 1.0, admin network communications are encoded using the deprecated RC4 algorithm. This issue affects the 1.1.2 Build 20141017 Rel.50749 firmware.

On the TP-Link TL-SG108E 1.0, a remote attacker could retrieve credentials from 'Switch Info' log lines where passwords are in cleartext. This affects the 1.1.2 Build 20141017 Rel.50749 firmware.

On the TP-Link TL-SG108E 1.0, a remote attacker could retrieve credentials from 'SEND data' log lines where passwords are encoded in hexadecimal. This affects the 1.1.2 Build 20141017 Rel.50749 firmware.

Exponent CMS versions 2.4.1 and earlier have an SQL injection vulnerability via a base64 serialized API key (apikey parameter) in the api function of framework/modules/eaas/controllers/eaasController.php.

The backend/Login/load/ script in Shopware before version 5.1.5 allows remote attackers to execute arbitrary code.

Cygwin before 2.5.0 does not properly handle updating permissions when changing users, which allows attackers to gain privileges.

Versions of Spring AMQP before 1.5.5 contain a vulnerability in the org.springframework.core.serializer.DefaultDeserializer class that allows remote attackers to execute arbitrary code.

ExaGrid appliances with firmware before version 4.8 P26 have a default password (1) inflection for the root account and (2) support for the support account in the web interface, allowing remote attackers to gain administrative access via an SSH or HTTP session.

Tenable Appliance versions 3.5 - 4.4.0, and possibly prior versions, contain a flaw in the simpleupload.py script in the Web UI. A remote attacker can inject arbitrary commands through manipulation of the tns_appliance_session_user parameter.

Buffer overflow in D-Link devices DAP-2310, DAP-2330, DAP-2360, DAP-2553, DAP-2660, DAP-2690, DAP-2695, DAP-3320, and DAP-3662 allows remote attackers to have unspecified impact via a crafted 'dlink_uid' cookie.

Netgear WNAP320, WNDAP350, and WNDAP360 before version 3.5.5.0 reveal wireless passwords and administrative usernames and passwords over SNMP.

An Information Exposure issue was discovered in Schneider Electric Wonderware InTouch Access Anywhere, version 11.5.2 and prior. Credentials may be exposed to external systems via specific URL parameters.

An exploitable OS Command Injection vulnerability exists in the web application 'ping' functionality of Moxa AWK-3131A Wireless Access Points running firmware 1.1. Specially crafted web form input can cause an OS Command Injection resulting in complete compromise of the vulnerable device.

Integer overflow in the Post Office Agent in Novell GroupWise before 2014 R2 Service Pack 1 Hot Patch 1 might allow remote attackers to execute arbitrary code via a long username or password, triggering a heap-based buffer overflow.

Cybozu Garoon before 4.2.2 allows remote attackers to bypass login authentication via vectors related to API use.

Zyxel WRE6505 devices have a default TELNET password of 1234 for the root and admin accounts, which makes it easier for remote attackers to conduct DNS hijacking attacks by reconfiguring the built-in dnshijacker process.

In Apache Log4j 2.x before version 2.8.2, when using the TCP socket server or UDP socket server to receive log events, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.

In Apache Tomcat versions 9.0.0.M1 to 9.0.0.M18 and 8.5.0 to 8.5.12, a regression in send file processing was introduced. If the send file processing completed quickly, it was possible for the same Processor to be added to the processor cache twice.