CVE Vulnerability Catalog

A vulnerability in the Service Assistant GUI in IBM Storwize V7000 (2076) version 8.1 could allow a remote attacker to perform a privilege escalation.

IBM Tivoli Endpoint Manager (IBM BigFix 9.2 and 9.5) does not require strong passwords by default, making it easier for attackers to compromise user accounts.

A Stack-based Buffer Overflow issue was discovered in Schneider Electric InduSoft Web Studio v8.0 SP2 Patch 1 and prior versions, and InTouch Machine Edition v8.0 SP2 Patch 1 and prior versions. This vulnerability may allow remote code execution with high privileges.

The Recurly Client .NET Library before versions 1.0.1, 1.1.10, 1.2.8, 1.3.2, 1.4.14, 1.5.3, 1.6.2, 1.7.1, 1.8.1 is vulnerable to a Server-Side Request Forgery due to incorrect use of 'Uri.EscapeUriString'. This could lead to compromise of API keys or other critical resources.

The Recurly Client Python Library before versions 2.0.5, 2.1.16, 2.2.22, 2.3.1, 2.4.5, 2.5.1, 2.6.2 is vulnerable to a Server-Side Request Forgery vulnerability in the 'Resource.get' method that could result in compromise of API keys or other critical resources.

The Recurly Client Ruby Library before versions 2.0.13, 2.1.11, 2.2.5, 2.3.10, 2.4.11, 2.5.4, 2.6.3, 2.7.8, 2.8.2, 2.9.2, 2.10.4, 2.11.3 is vulnerable to a Server-Side Request Forgery vulnerability in the 'Resource#find' method that could result in compromise of API keys or other critical resources.

The Paperclip gem version 3.1.4 and later has a Server-Side Request Forgery (SSRF) vulnerability in the Paperclip::UriAdapter class. Attackers may be able to access information about internal network resources.

Buffer overflow in NTT DOCOMO Wi-Fi STATION L-02F Software version L02F-MDM9625-V10h-JUN-23-2017-DCM-JP and earlier allows an attacker to execute arbitrary code via unspecified vectors.

An issue was discovered in certain Apple products, including macOS before 10.13.1, related to the third-party 'PCRE' product. Versions before 8.40 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact.

An issue was discovered in certain Apple products, including macOS before 10.13.1, related to the '802.1X' component. It allows attackers to have an unspecified impact by leveraging TLS 1.0 support.

An issue was discovered in certain Apple products, including macOS before 10.13.1, related to the third-party 'file' product. Versions before 5.31 allow remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact.

In CMS Made Simple version 2.1.6, there is a Server-Side Template Injection vulnerability via the cntnt01detailtemplate parameter.

The installer in MyBB before 1.8.13 allows remote attackers to execute arbitrary code by writing to the configuration file.

An exploitable vulnerability exists in the YAML parsing functionality in the read_yaml_file method in django_make_app 0.1.3, allowing arbitrary Python command execution. An attacker can inject Python code into loaded YAML to trigger this vulnerability.

An exploitable vulnerability exists in the YAML parsing functionality in config.py in Confire 0.2.0. Due to the user-specific configuration being loaded from '~/.confire.yaml' using the yaml.load function, an attacker can inject Python commands, leading to arbitrary command execution.

In Inedo BuildMaster versions before 5.8.2, XslTransform was used where XslCompiledTransform should have been used.

In Joomla! before version 3.8.2, a bug allowed third parties to bypass a user's 2-factor authentication method.

The UserPro plugin before version 4.9.17.1 for WordPress, when used on a site with the 'admin' username, allows remote attackers to bypass authentication and gain administrative access by setting the up_auto_log parameter to 'true' in the QUERY_STRING to the default URI.

Buffer overflow in the SoftConsole client in Avaya IP Office before version 10.1.1 allows remote servers to execute arbitrary code via a long response.

Red Hat JBoss and other Red Hat products allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library.