CVE Vulnerability Catalog

On Samsung Galaxy S3 i9305 devices running 4.4.4, an issue was discovered in the WEP, WPA, WPA2, and WPA3 implementations that accept plaintext A-MSDU frames as long as the first 8 bytes correspond to a valid RFC1042 (LLC/SNAP) header for EAPOL. An adversary can abuse this to inject arbitrary network packets independent of the network configuration.

An issue was discovered in the ALFA Windows 10 driver 6.1316.1209 for AWUS036H. The WEP, WPA, WPA2, and WPA3 implementations accept plaintext frames in a protected Wi-Fi network. An adversary can abuse this to inject arbitrary data frames independent of the network configuration.

InvoicePlane 1.5.11 discloses the full path of the file upload directory when using the upload feature.

An exploitable denial-of-service vulnerability exists in Systemd 245. A specially crafted DHCP FORCERENEW packet can cause a server running the DHCP client to be vulnerable to a DHCP ACK spoofing attack. An attacker can forge a pair of FORCERENEW and DHCP ACK packets to reconfigure the server.

The package handlebars before 4.7.7 is vulnerable to Prototype Pollution when selecting certain compiling options to compile templates coming from an untrusted source.

A vulnerability in the Snort detection engine of multiple Cisco products could allow an unauthenticated, remote attacker to bypass a configured file policy for HTTP. The issue is due to incorrect handling of specific HTTP header parameters. An attacker could exploit this by sending crafted HTTP packets through an affected device, bypassing the policy and delivering a malicious payload.

A vulnerability in the upgrade process of Cisco Adaptive Security Appliance (ASA) Software and Cisco Firepower Threat Defense (FTD) Software could allow an authenticated, local attacker to inject commands that could be executed with root privileges on the underlying OS. This is due to insufficient input validation. Exploitation involves uploading a crafted upgrade package file.

A vulnerability in the CLI of Cisco ASA and FTD could allow an authenticated, local attacker to execute arbitrary commands on the underlying OS with root privileges. This is due to insufficient input validation of user-supplied commands.

A vulnerability in the CLI of Cisco FTD Software could allow an authenticated, local attacker to overwrite files on the file system using directory traversal techniques. This is due to insufficient validation of user input for the file path in a specific CLI command. A successful exploit could cause system instability if important system files are overwritten.

GNU Wget through 1.21.1 does not omit the Authorization header upon a redirect to a different origin, a related issue to CVE-2018-1000007.

Unbound before 1.9.5 allows configuration injection in create_unbound_ad_servers.sh upon a successful man-in-the-middle attack against a cleartext HTTP session. The vendor does not consider this a vulnerability of Unbound itself, as the script is a community contribution and not part of the Unbound installation.

Sonatype Nexus Repository Manager 3 Pro up to and including 3.30.0 has Incorrect Access Control. The flaw may allow unauthorized access to repository resources.

A race condition in the Linux kernel SCTP sockets implementation (net/sctp/socket.c) before version 5.12-rc8. If sctp_destroy_sock is called without the addr_wq_lock, an element is removed from the auto_asconf_splist list without proper locking. This can be exploited by an attacker with network service privileges to escalate to root or by an unprivileged user if a BPF_CGROUP_INET_SOCK_CREATE is attached that blocks creation of some SCTP sockets.

AdTran Personal Phone Manager software is vulnerable to multiple reflected cross-site scripting (XSS) issues. This affects at least version 10.8.1 and below, but potentially later versions as well. The affected NetVanta 7060 and NetVanta 7100 appliances are End of Life and will not receive a patch.

AdTran Personal Phone Manager software is vulnerable to an authenticated stored cross-site scripting (XSS) issue. This affects at least version 10.8.1 and earlier, but potentially later versions as well. The affected NetVanta 7060 and NetVanta 7100 appliances are End of Life and will not receive a patch.

The jose library, used for cryptographic operations, has a vulnerability in the AES_CBC_HMAC_SHA2 algorithm that allows the use of a padding oracle to decrypt data without knowing the key. Observable timing differences during padding errors can enable an attacker to exploit this vulnerability.