CVE-2018-0193

Multiple vulnerabilities in the CLI parser of Cisco IOS XE Software could allow an authenticated, local attacker to inject arbitrary commands into the CLI of the affected software, which could allow the attacker to gain access to the underlying Linux shell of an affected device and execute comman...

CVE-2018-0190

CVE-2018-0190 affects Cisco IOS XE Software web UI. The issue is cross-site scripting caused by insufficient input validation of parameters passed via the web UI, enabling an unauthenticated, remote attacker to lure a user to a malicious link or intercept and inject code, potentially executing ar...

CVE-2018-0195

A vulnerability in the Cisco IOS XE Software REST API could allow an authenticated, remote attacker to bypass API authorization checks and use the API to perform privileged actions on an affected device. The vulnerability is due to insufficient authorization checks for requests that are sent to t...

CVE-2018-0193

Multiple vulnerabilities in the CLI parser of Cisco IOS XE Software could allow an authenticated, local attacker to inject arbitrary commands into the CLI of the affected software, which could allow the attacker to gain access to the underlying Linux shell of an affected device and execute comman...

CVE-2018-0170

A vulnerability in the Cisco Umbrella Integration feature of Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a denial of service DoS condition, related to the OpenDNS software. The vulnerability is due to a logic error that exists when handling a malformed incoming...

CVE-2018-0179

CVE-2018-0179 describes DoS in Cisco IOS Software due to vulnerabilities in the Login Enhancements (Login Block) feature. Affected are Cisco IOS releases 15.4(2)T, 15.4(3)M, 15.4(2)CG and later. An unauthenticated, remote attacker can trigger a device reload, causing DoS. The connected Cisco advi...

CVE-2018-0170

CVE-2018-0170 affects Cisco IOS XE Software with the Umbrella Integration feature. A logic error when processing malformed incoming IP packets can cause access to a freed internal data structure, enabling an unauthenticated remote attacker to trigger a reload and DoS. Exploitation requires sendin...

CVE-2018-0158

A vulnerability in the Internet Key Exchange Version 2 IKEv2 module of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause a memory leak or a reload of an affected device that leads to a denial of service DoS condition. The vulnerability is due to...

CVE-2018-0155

A vulnerability in the Bidirectional Forwarding Detection BFD offload implementation of Cisco Catalyst 4500 Series Switches and Cisco Catalyst 4500-X Series Switches could allow an unauthenticated, remote attacker to cause a crash of the iosd process, causing a denial of service DoS condition. Th...

CVE-2018-0167

Multiple Buffer Overflow vulnerabilities in the Link Layer Discovery Protocol LLDP subsystem of Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to cause a denial of service DoS condition or execute arbitrary code with elevated...

CVE-2018-0174

A vulnerability in the DHCP option 82 encapsulation functionality of Cisco IOS Software and Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service DoS condition. The vulnerability exists because the affected...

CVE-2017-12310

A vulnerability in the auto discovery phase of Cisco Spark Hybrid Calendar Service could allow an unauthenticated, remote attacker to view sensitive information in the unencrypted headers of an HTTP method request. The attacker could use this information to conduct additional reconnaissance attac...

CVE-2018-0198

A vulnerability in the web framework of Cisco Unified Communications Manager could allow an unauthenticated, remote attacker to view sensitive data. The vulnerability is due to insufficient protection of database tables. An attacker could exploit this vulnerability by browsing to a specific URL. ...

Input validation

clamscan in ClamAV before 0.99.4 contains a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. The vulnerability is due to improper input validation checking mechanisms when handling Portable Document Format .pdf...

CVE-2017-12310

A vulnerability in the auto discovery phase of Cisco Spark Hybrid Calendar Service could allow an unauthenticated, remote attacker to view sensitive information in the unencrypted headers of an HTTP method request. The attacker could use this information to conduct additional reconnaissance attac...

CVE-2018-0198

CVE-2018-0198 affects Cisco Unified Communications Manager (CUCM). The issue is an information-disclosure vulnerability in the web framework caused by insufficient protection of database tables, enabling an unauthenticated, remote attacker to view data by visiting a specific URL and potentially e...

CVE-2018-0202

CVE-2018-0202 affects ClamAV prior to 0.99.4, where the PDF parser (libclamav/pdfng.c: pdf_parse_array/pdf_parse_string) may mishandle crafted PDF files, leading to an out-of-bounds read and a denial of service. Descriptions consistently state an unauthenticated, remote attacker can trigger this ...

CVE-2018-0202

clamscan in ClamAV before 0.99.4 contains a vulnerability that could allow an unauthenticated, remote attacker to cause a denial of service DoS condition on an affected device. The vulnerability is due to improper input validation checking mechanisms when handling Portable Document Format .pdf...

Code injection

IBM GSKit IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, and 11.1 duplicates the PRNG state across fork system calls when multiple ICC instances are loaded which could result in duplicate Session IDs and a risk of duplicate key material. IBM X-Force ID: 139071...

CVE-2018-1426

IBM GSKit IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, and 11.1 duplicates the PRNG state across fork system calls when multiple ICC instances are loaded which could result in duplicate Session IDs and a risk of duplicate key material. IBM X-Force ID: 139071...