CVE Vulnerability Catalog

SAP TREX version 7.10 Revision 63 allows remote attackers to write to arbitrary files via vectors related to RFC-Gateway, posing a serious security threat.

SAP TREX version 7.10 Revision 63 allows remote attackers to read arbitrary files via unspecified vectors, posing a serious security risk.

Directory traversal vulnerability in SAP TREX 7.10 Revision 63 allows remote attackers to read arbitrary files via unspecified vectors.

Use-after-free vulnerability in the nsXULPopupManager::KeyDown function in Mozilla Firefox before 48.0 and Firefox ESR 45.x before 45.3 allows attackers to execute arbitrary code or cause a denial of service by leveraging keyboard access to use the Alt key during selection of top-level menu items.

Crestron Electronics DM-TXRX-100-STR devices with firmware before version 1.3039.00040 have a hardcoded password 'admin' for the admin account, making it easier for remote attackers to gain access via the web management interface.

Crestron Electronics DM-TXRX-100-STR devices with firmware before version 1.3039.00040 use a hardcoded X.509 certificate from OpenSSL Test Certification Authority. This makes it easier for remote attackers to conduct man-in-the-middle attacks against HTTPS sessions.

Crestron Electronics DM-TXRX-100-STR devices with firmware before version 1.3039.00040 allow remote attackers to bypass authentication and change settings via a JSON API call.

Crestron Electronics DM-TXRX-100-STR devices with firmware before version 1.3039.00040 allow remote attackers to bypass authentication via a direct request to a page other than index.html.

Crestron Electronics DM-TXRX-100-STR devices with firmware before version 1.3039.00040 rely on the client for authentication, allowing remote attackers to gain access by setting the value of objresp.authenabled to 1.

Directory traversal vulnerability in cgi-bin/rftest.cgi on Crestron AirMedia AM-100 devices with firmware before 1.4.0.13 allows remote attackers to execute arbitrary commands via a .. (dot dot) in the ATE_COMMAND parameter.

Huawei NE40E, CX600, PTN 6900-2-M8, NE5000E, and CloudEngine 12800 devices with specific software versions are vulnerable to remote attacks. Attackers with control plane access can cause denial of service or execute arbitrary code via crafted packets.

Atlassian Bamboo before 5.11.4.1 and 5.12.x before 5.12.3.1 does not properly restrict permitted deserialized classes, allowing remote attackers to execute arbitrary code via vectors related to XStream Serialization.

The server in Red Hat JBoss Operations Network (JON) before version 3.3.6 allows remote attackers to execute arbitrary code via a crafted HTTP request, related to message deserialization.

SQL injection vulnerability in the Seed Coupon plugin before version 1.6 for EC-CUBE allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

The AdminUI in HPE Operations Manager (OM) before version 9.21.130 on Linux, Unix, and Solaris allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections (ACC) library.

SQL injection vulnerability in Rockwell Automation FactoryTalk EnergyMetrix before version 2.20.00 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

An integer signedness error in the simplestring_addn function in xmlrpc-epi through version 0.54.2, used in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9, allows remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have unspecified other impact via a long first argument to the PHP xmlrpc_encode_request function.

In PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9, there is an improper interaction between the unserialize implementation and garbage collection, which may allow remote attackers to cause a denial of service (use-after-free and application crash) or possibly have unspecified other impact via crafted serialized data.

The locale_accept_from_http function in PHP before 5.5.38, 5.6.x before 5.6.24, and 7.x before 7.0.9 does not properly restrict calls to the ICU uloc_acceptLanguageFromHTTP function. This allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a call with a long argument.

The uloc_acceptLanguageFromHTTP function in common/uloc.cpp in International Components for Unicode (ICU) through 57.1 for C/C++ does not ensure that there is a '\0' character at the end of a certain temporary array, which allows remote attackers to cause a denial of service (out-of-bounds read) or possibly have unspecified other impact via a call with a long httpAcceptLanguage argument.