CVE Vulnerability Catalog

Apache Tika before 1.14 allows Java code execution for serialized objects embedded in MATLAB files. The issue exists because Tika invokes JMatIO to do native deserialization.

Rogue Wave JViews before version 8.8 patch 21 and 8.9 before patch 1 allows remote attackers to execute arbitrary Java code that exists in the classpath. The issue exists because the ilog.views.faces.IlvFacesController servlet does not require explicit configuration of servlets that can be called.

A vulnerability in Cisco Aironet 1830 and 1850 Series Access Points running Cisco Mobility Express Software allows an unauthenticated remote attacker to take complete control of an affected device. The issue is due to the existence of default credentials available regardless of the device's configuration.

The Spiceworks TFTP Server, as distributed with Spiceworks Inventory 7.5, allows remote attackers to access the Spiceworks data/configurations directory. It leverages the unauthenticated nature of the TFTP service for all clients who can reach UDP port 69.

F5 SSL Intercept iApp versions 1.5.0 - 1.5.7 is vulnerable to an unauthenticated remote attack that may allow modification of the BIG-IP system configuration, extraction of sensitive system files, and possible remote command execution on the system when deployed using the Explicit Proxy feature plus SNAT Auto Map option for egress traffic.

AIRTAME HDMI dongle with firmware before version 2.2.0 allows unauthenticated access to a large part of the management interface. It is possible to extract all information including the Wi-Fi password, reboot the device, or force a software update at any time.

In the Linux kernel before version 4.5, there is a vulnerability that allows remote attackers to execute arbitrary code via UDP traffic. This issue occurs during an unsafe second checksum calculation during the execution of a recv system call with the MSG_PEEK flag.

Multiple SQL injection vulnerabilities in account/signup.php and account/signup2.php in WebsiteBaker 2.10.0 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) username, (2) display_name parameter.

Pixie 1.0.4 allows remote authenticated users to upload and execute arbitrary PHP code via the POST data in an admin/index.php?s=publish&x=filemanager request for a filename with a double extension, such as a .jpg.php file with Content-Type of image/jpeg.

During the installation of Ambari versions 2.4.0 to 2.4.2, Ambari Server artifacts are not created with proper access control lists (ACLs).

Cougar-LG stores sensitive information under the web root with insufficient access control, allowing remote attackers to obtain credentials.

mrlg-lib.php in mrlg4php before version 1.0.8 allows remote attackers to execute arbitrary shell code.

JavaScriptCore in WebKit, as distributed in Safari Technology Preview Release 22, allows remote attackers to cause a denial of service through heap-based out-of-bounds write, leading to application crash. The attack can be executed via crafted JavaScript code that triggers access to red-zone memory locations.

Devices Jensen of Scandinavia AS Air:Link 3G (AL3G) version 2.23m (Rev. 3), Air:Link 5000AC (AL5000AC) version 1.13, and Air:Link 59300 (AL59300) version 1.04 (Rev. 4) allow remote attackers to execute arbitrary commands via shell metacharacters to certain /goform/* pages.

There is a vulnerability in Huawei Tecal devices that may lead to unauthorized access to the system. This affects multiple server models, including RH1288 V2, RH2265 V2, RH2285 V2, and others with specific software versions.

An issue was discovered in certain Apple products, including macOS before 10.12.4, related to the 'libxslt' component. This issue may lead to denial of service (memory corruption) or potentially other unspecified impacts via unknown vectors.

An issue was discovered in certain Apple products, including iOS before 10.3, related to the 'HomeKit' component. It allows attackers to have an unspecified impact by leveraging the presence of Home Control on Control Center.

An issue was discovered in certain Apple products related to the 'HTTPProtocol' component. Affects iOS before 10.3, macOS before 10.12.4, tvOS before 10.2, and watchOS before 3.2. The issue involves nghttp2 before 1.17.0.

An issue was discovered in certain Apple products affecting iOS before 10.3 and macOS before 10.12.4. The issue involves the 'Security' component and allows remote attackers to bypass intended access restrictions.