CVE Vulnerability Catalog

The Zephyr parser in tcpdump before version 4.9.2 has a buffer over-read in print-zephyr.c in several functions.

The EIGRP parser in tcpdump before version 4.9.2 has a buffer over-read in the eigrp_print() function.

Several protocol parsers in tcpdump before version 4.9.2 could cause a buffer over-read in util-print.c:tok2strbuf().

The DECnet parser in tcpdump before version 4.9.2 has a buffer over-read in the decnet_print() function.

The NFS parser in tcpdump before version 4.9.2 has a buffer over-read in print-nfs.c:interp_reply().

The ISO CLNS parser in tcpdump before version 4.9.2 has a buffer over-read in the isoclns_print() function.

The ISAKMP parser in tcpdump before version 4.9.2 has a buffer over-read in print-isakmp.c:isakmp_rfc3948_print().

The ICMP parser in tcpdump before version 4.9.2 has a buffer over-read issue in the icmp_print() function.

Several protocol parsers in tcpdump before version 4.9.2 could cause a buffer over-read in addrtoname.c:lookup_bytestring().

The SMB/CIFS parser in tcpdump before version 4.9.2 has a buffer over-read in smbutil.c:name_len().

A vulnerability in the TURN server included with Cisco Meeting Server (CMS) could allow an authenticated, remote attacker to gain unauthorized access to components or sensitive information in an affected system. The issue is due to an incorrect default configuration of the TURN server, which could expose internal interfaces and ports.

The DHCP client on D-Link DIR-850L REV. A and REV. B devices allows unauthenticated remote code execution as root due to mishandling of shell metacharacters in /etc/services/INET/inet_ipv4.php.

D-Link DIR-850L REV. B devices (with firmware through FW208WWb02) have a hardcoded password for the Alphanetworks account, allowing remote attackers to gain root access via a TELNET session upon device reset.

The register_send.php file on D-Link DIR-850L REV. B devices (with firmware up to FW208WWb02) does not require authentication, which can lead to unintended enrollment in mydlink Cloud Services.

A double free vulnerability in MIT Kerberos 5 (krb5) allows attackers to have unspecified impact via automatic deletion of security contexts on error.

An unspecified vulnerability in the HTTP/2 experimental feature in Apache Traffic Server before version 5.3.2 may lead to unknown impact and attack vectors.

Unspecified vulnerability in the HTTP/2 experimental feature in Apache Traffic Server 5.3.x before 5.3.2 may lead to unknown impact and attack vectors.

Axesstel MU553S MU55XS-V1.14 devices have a default password of 'admin' for the admin account, which poses a risk of unauthorized access.

The EyesOfNetwork web interface version 5.1-0 has an SQL injection vulnerability via the term parameter in module/admin_group/search.php.

The EyesOfNetwork web interface version 5.1-0 has an SQL injection vulnerability via the user_name parameter to module/admin_user/add_modify_user.php in the 'ACCOUNT CREATION' section, related to lack of input validation in include/function.php.