CVE Vulnerability Catalog

A vulnerability in the DHCP option 82 encapsulation functionality of Cisco IOS and IOS XE Software allows an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS). It exists because the software performs incomplete input validation of option 82 information in DHCPv4 packets from DHCP relay agents. Sending a crafted DHCPv4 packet can cause a heap overflow and device reload.

A vulnerability in the Smart Install feature of Cisco IOS and IOS XE Software is caused by improper validation of packet data. An unauthenticated remote attacker can send a crafted Smart Install message to TCP port 4786, causing a buffer overflow that may lead to device reload, arbitrary code execution, or a watchdog crash.

Multiple buffer overflow vulnerabilities in the LLDP subsystem of Cisco IOS, IOS XE, and IOS XR Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) or execute arbitrary code with elevated privileges. The issue affects LLDP packet processing.

A vulnerability in the Simple Network Management Protocol (SNMP) subsystem of Cisco IOS Software running on certain models of Cisco Catalyst Switches could allow an authenticated, remote attacker to cause a denial of service (DoS) condition, aka a GET MIB Object ID Denial of Service Vulnerability. The vulnerability occurs when the affected software processes an SNMP read request containing a request for the ciscoFlashMIB object ID, which could cause the device to restart due to a SYS-3-CPUHOG. This affects Cisco Catalyst 2960-L Series Switches, Cisco Catalyst Digital Building Series Switches 8P and 8U running SNMPv2 or SNMPv3.

A vulnerability in the IKEv1 implementation of Cisco IOS and IOS XE Software could allow an unauthenticated, remote attacker to cause an affected device to reload, resulting in a denial of service (DoS). It is due to improper validation of specific IKEv1 packets. Sending crafted IKEv1 packets during IKE negotiation can cause a device reload.

A vulnerability in the IKEv2 module of Cisco IOS and IOS XE Software could allow an unauthenticated, remote attacker to cause a memory leak or a reload of an affected device, leading to a denial of service (DoS). It is due to incorrect processing of certain IKEv2 packets. Sending crafted IKEv2 packets can cause continuous memory consumption and eventual device reload.

A vulnerability in the Smart Install feature of Cisco IOS and IOS XE Software could allow an unauthenticated, remote attacker to trigger a reload of an affected device, resulting in a denial of service (DoS). It is due to improper validation of packet data. Sending a crafted packet to TCP port 4786 can cause a device reload. Only Smart Install client switches are affected, not Smart Install directors.

A vulnerability in the BFD offload implementation of Cisco Catalyst 4500 and 4500-X Series Switches could allow an unauthenticated, remote attacker to cause a crash of the iosd process, resulting in a denial of service (DoS). It is due to insufficient error handling when the BFD header in a BFD packet is incomplete. Sending a crafted BFD message can trigger a system reload.

A vulnerability in the crypto engine of the Cisco Integrated Services Module for VPN (ISM-VPN) running Cisco IOS Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition. The issue is due to insufficient handling of VPN traffic. An attacker could exploit this by sending crafted VPN traffic, causing the device to hang or crash.

A vulnerability in the QoS subsystem of Cisco IOS and IOS XE Software is due to incorrect bounds checking of values in packets destined for UDP port 18999. An unauthenticated remote attacker can send malicious packets, causing a buffer overflow that may lead to arbitrary code execution with elevated privileges or a device reload.

A cross-site scripting (XSS) vulnerability in ZmMailMsgView.getAttachmentLinkHtml in Zimbra Collaboration Suite (ZCS) before 8.7 Patch 1 and 8.8.x before 8.8.7. Remote attackers can inject arbitrary web script or HTML via a Content-Location header in an email attachment.

A vulnerability in the Border Gateway Protocol (BGP) over an Ethernet Virtual Private Network (EVPN) for Cisco IOS XE Software could allow an unauthenticated, remote attacker to cause the device to reload, resulting in a denial of service (DoS) condition, or potentially corrupt the BGP routing table, which could result in network instability. The vulnerability exists due to changes in the implementation of the BGP MPLS-Based Ethernet VPN RFC (RFC 7432) draft between IOS XE software releases. When the BGP Inclusive Multicast Ethernet Tag Route or BGP EVPN MAC/IP Advertisement Route update packet is received, it could be possible that the IP address length field is miscalculated. This vulnerability affects all releases of Cisco IOS XE Software prior to software release 16.3 that support BGP EVPN configurations.

A buffer overflow was found in the MikroTik RouterOS SMB service when processing NetBIOS session request messages. A remote attacker with access to the service can exploit this vulnerability to gain code execution on the system, and the overflow occurs before authentication, so an unauthenticated remote attacker can exploit it.

A vulnerability in Java deserialization used by Cisco Secure Access Control System (ACS) prior to release 5.8 patch 9 is due to insecure deserialization of user-supplied content. An unauthenticated remote attacker can send a crafted serialized Java object and execute arbitrary commands on the device with root privileges.

An OS command injection vulnerability in soap.cgi (soapcgi_main in cgibin) in D-Link DIR-880L, DIR-868L, DIR-865L, and DIR-860L routers in specific firmware versions allows remote attackers to execute arbitrary OS commands via the service parameter.

SAP CRM, 7.01, 7.02, 7.30, 7.31, 7.33, 7.54, allows an attacker to exploit insufficient validation of path information provided by users, thus characters representing 'traverse to parent directory' are passed through to the file APIs.

An issue was discovered in the base64d function in the SMTP listener in Exim before 4.90.1. Sending a handcrafted message may cause a buffer overflow, which can be used to execute code remotely.

A vulnerability in the web interface of Cisco RV132W ADSL2+ Wireless-N VPN and RV134W VDSL2 Wireless-AC VPN Routers is due to incomplete input validation on user-controlled input in an HTTP request. An unauthenticated remote attacker can send a crafted HTTP request to execute arbitrary code with root privileges and gain full control of the system or cause it to reload.

A use-after-free vulnerability was discovered in Adobe Flash Player before 28.0.0.161. It occurs due to a dangling pointer in the Primetime SDK related to media player handling of listener objects. A successful attack can lead to arbitrary code execution, and it was exploited in the wild in January and February 2018.

Jenkins versions 2.56 and earlier as well as 2.46.1 LTS and earlier are vulnerable to unauthenticated remote code execution. An attacker can transfer a serialized Java SignedObject to the Jenkins CLI, which is deserialized using a new ObjectInputStream, bypassing the existing blacklist-based protection mechanism.