CVE Vulnerability Catalog

The setUpSubtleUserAccount function in /bin/bw on Harman AMX devices before January 20, 2016, has a hardcoded password for the 1MB@tMaN account. This makes it easier for remote attackers to gain access via an SSH or HTTP session.

The setUpSubtleUserAccount function in /bin/bw on Harman AMX devices before 2015-10-12 has a hardcoded password for the BlackWidow account, making it easier for remote attackers to gain access via SSH or HTTP sessions.

An unspecified CGI script in Cisco FX-OS before version 1.1.2 on Firepower 9000 devices and in Cisco UCS Manager before versions 2.2(4b), 2.2(5) before 2.2(5a), and 3.0 before 3.0(2e) allows remote attackers to execute arbitrary shell commands via a crafted HTTP request.

Cisco Modular Encoding Platform D9036 software before version 02.04.70 has hardcoded root and guest passwords, making it easier for remote attackers to gain access via an SSH session.

The XS engine in SAP HANA allows remote attackers to spoof log entries in trace files, potentially leading to denial of service (disk consumption and process crash) via a crafted HTTP request.

Buffer overflow in the XS engine (hdbxsengine) in SAP HANA allows remote attackers to cause a denial of service or execute arbitrary code via a crafted HTTP request, related to JSON.

Integer overflow in the authenticate_post function in CGit before version 0.12 allows remote attackers to have unspecified impact via a large value in the Content-Length HTTP header, leading to a buffer overflow.

The gdImageRotateInterpolated function in PHP before 5.5.31, 5.6.x before 5.6.17, and 7.x before 7.0.2 allows remote attackers to obtain sensitive information or cause a denial of service via a large bgd_color argument to the imagerotate function.

CVE-2015-8617 describes a format string vulnerability in the zend_throw_or_error function in PHP 7.x before version 7.0.1. This allows remote attackers to execute arbitrary code via format string specifiers in a string misused as a class name, leading to incorrect error handling.

Seeds acmailer before 3.8.21 and 3.9.x before 3.9.15 Beta allows remote authenticated users to execute arbitrary OS commands via unspecified vectors.

Fortinet FortiAnalyzer, FortiSwitch, FortiCache, and FortiOS have a hardcoded passphrase for the Fortimanager_Access account, allowing remote attackers to gain administrative access via an SSH session.

Integer overflow in the Kernel service in Advantech WebAccess before version 8.1 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted RPC request.

Multiple heap-based buffer overflows in Advantech WebAccess before 8.1 allow remote attackers to execute arbitrary code via unspecified vectors.

Multiple stack-based buffer overflows in Advantech WebAccess before version 8.1 allow remote attackers to execute arbitrary code via unspecified vectors.

CVE-2016-0854 describes an unrestricted file upload vulnerability in the uploadImageCommon function in the UploadAjaxAction script in Advantech WebAccess before version 8.1. This allows remote attackers to write to files of arbitrary types via unspecified vectors.

The Admin portal in Cisco Identity Services Engine (ISE) versions 1.1.x, 1.2.0 before patch 17, 1.2.1 before patch 8, 1.3 before patch 5, and 1.4 before patch 4 allows remote attackers to obtain administrative access via unspecified vectors.

Cisco Wireless LAN Controller (WLC) devices with software 7.6.x, 8.0 before 8.0.121.0, and 8.1 before 8.1.131.0 allow remote attackers to change configuration settings via unspecified vectors.

Adobe Reader and Acrobat before version 11.0.14, and Acrobat and Acrobat Reader DC Classic before version 15.006.30119, as well as Acrobat and Acrobat Reader DC Continuous before version 15.010.20056 on Windows and OS X, allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.

Adobe Reader and Acrobat before version 11.0.14, and Acrobat and Acrobat Reader DC Classic before version 15.006.30119, as well as Acrobat and Acrobat Reader DC Continuous before version 15.010.20056 on Windows and OS X, allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.

Adobe Reader and Acrobat before version 11.0.14, and Acrobat and Acrobat Reader DC Classic before version 15.006.30119, as well as Acrobat and Acrobat Reader DC Continuous before version 15.010.20056 on Windows and OS X, allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.