4496 matches found
CVE-2016-2314
CVE-2016-2314 affects Huawei SmartAX MT882 devices running GlobespanVirata ftpd 1.0. The underlying issue allows remote authenticated users to trigger a denial of service (device outage) by creating an excessively long directory name with the FTP MKD command and then issuing additional FTP comman...
UBUNTU-CVE-2015-8629
The xdrnullstring function in lib/kadm5/kadmrpcxdr.c in kadmind in MIT Kerberos 5 aka krb5 before 1.13.4 and 1.14.x before 1.14.1 does not verify whether '\0' characters exist as expected, which allows remote authenticated users to obtain sensitive information or cause a denial of service...
UBUNTU-CVE-2015-8630
The 1 kadm5createprincipal3 and 2 kadm5modifyprincipal functions in lib/kadm5/srv/svrprincipal.c in kadmind in MIT Kerberos 5 aka krb5 1.12.x and 1.13.x before 1.13.4 and 1.14.x before 1.14.1 allow remote authenticated users to cause a denial of service NULL pointer dereference and daemon crash b...
CVE-2016-0865
The CVE-2016-0865 entry concerns Tollgrade SmartGrid LightHouse Sensor Management System (SMS) Software EMS before 5.1 and 4.1.0 Build 16. Affected component is the web-based SMS EMS; the root cause is insecure credential handling that allows a remote authenticated user to change arbitrary passwo...
CVE-2016-0882
EMC Documentum xCP is affected: versions 2.1 before patch 23 and 2.2 before patch 11 are vulnerable to a XML External Entity (XXE) issue. The vulnerability enables remote authenticated users to read arbitrary files by sending a POST request containing an XML external entity declaration combined w...
The vulnerability of the Cisco Identity Services Engine, a platform for managing network policies, allows a hacker to gain administrator privileges.
The vulnerability of the Cisco Identity Services Engine, a platform for managing network policies, is related to deficiencies in authentication procedures. Exploiting this vulnerability could allow a malicious actor, operating remotely, to gain administrator privileges...
CVE-2016-1317
Cisco Unified Communications Manager (UCM) 11.5(0.98000.480) is affected by an information disclosure vulnerability. An authenticated, remote attacker could exploit a flaw in the web framework by requesting an unspecified URL to view sensitive data, specifically database table names and entity na...
CVE-2016-2048
Django 1.9.x before 1.9.2, when ModelAdmin.saveas is set to True, allows remote authenticated users to bypass intended access restrictions and create ModelAdmin objects via the "Save as New" option when editing objects and leveraging the "change" permission...
Sauter moduWeb Vision Certificate Insecure Storage Vulnerability
Sauter moduWeb Vision is an embedded web-based SCADA system for HVAC. Sauter modoWeb Vision uses an insecure method of storing credentials, allowing remote attackers to bypass authentication by exploiting this vulnerability...
Design/Logic Flaw
The RBAC implementation in Cisco ASA-CX Content-Aware Security software before 9.3.1.1112 and Cisco Prime Security Manager PRSM software before 9.3.1.1112 allows remote authenticated users to change arbitrary passwords via a crafted HTTP request, aka Bug ID CSCuo94842...
CVE-2016-1308
SQL injection vulnerability in Cisco Unified Communications Manager 10.52.13900.9 allows remote authenticated users to execute arbitrary SQL commands via a crafted URL, aka Bug ID CSCux99227...
Code injection
General Electric GE Industrial Solutions UPS SNMP/Web Adapter devices with firmware before 4.8 allow remote authenticated users to obtain sensitive cleartext account information via unspecified vectors...
CVE-2016-1905
The API server in Kubernetes does not properly check admission control, which allows remote authenticated users to access additional resources via a crafted patched object...
OpenJDK: logging of RMI connection secrets (JMX, 8130710)
Unspecified vulnerability in the Java SE and Java SE Embedded components in Oracle Java SE 6u105, 7u91, and 8u66, and Java SE Embedded 8u65 allows remote authenticated users to affect confidentiality via vectors related to JMX...
CVE-2016-1141
KDDI HOME SPOT CUBE devices before 2 allow remote authenticated users to execute arbitrary OS commands via unspecified vectors...
CVE-2016-1141
KDDI HOME SPOT CUBE devices before 2 allow remote authenticated users to execute arbitrary OS commands via unspecified vectors...
Lexmark Printer Competitive Conditions Vulnerability
Lexmark printer is a printer product from Lexmark, USA. A competitive condition vulnerability exists in the initialization process of the Lexmark printer. A remote attacker can bypass authentication via incorrect detection of security-jumper state...
UBUNTU-CVE-2015-8794
Absolute path traversal vulnerability in program/steps/addressbook/photo.inc in Roundcube before 1.0.6 and 1.1.x before 1.1.2 allows remote authenticated users to read arbitrary files via a full pathname in the alt parameter, related to contact photo handling...
CVE-2015-8794
Roundcube Webmail contains an absolute path traversal vulnerability in program/steps/addressbook/photo.inc, affecting Roundcube before 1.0.6 and 1.1.x before 1.1.2. A remote authenticated user can read arbitrary files by supplying a full pathname in the _alt parameter during contact photo handlin...