| CVE |
Vendors |
Products |
Updated |
CVSS v3.1 |
| Use of hard-coded cryptographic key vulnerability in Tobit Laboratories AG TeamDavid's Webbox. For users created locally in David, passwords are stored in various
files using only obfuscation. Any user with access to the server’s file
system, or who can otherwise extract files from the server (see
vulnerability “Random File Read”), can potentially obtain affected
users’ passwords. This issue affects TeamDavid through Rollout 524. |
| Tobit Laboratories AG TeamDavid's Webbox 's link storing functionality (//ServerClient_celink.htm)
accepts a “pathname” parameter, which can be set to network locations
using UNC paths (e.g., “\\Server\Share”). The server processes these
paths without validation, resulting in outbound connection attempts to
attacker-controlled SMB servers. This enables authenticated attackers to
trigger the server to authenticate to arbitrary SMB endpoints,
potentially exposing NTLM authentication information (such as NTLM
hashes). If outbound connections to port 445 (SMB) are permitted,
attackers can use this to conduct SMB relay or credential theft attacks.
Exploitation of the “pathname” parameter is possible without
authentication. This issue affects TeamDavid through Rollout 524. |
| Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
| Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
| Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally. |
| Stack-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
| Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally. |
| Double free in Microsoft Office Word allows an unauthorized attacker to execute code locally. |
| Heap-based buffer overflow in Microsoft Office PowerPoint allows an unauthorized attacker to execute code locally. |
| Use of uninitialized resource in Microsoft Office Excel allows an unauthorized attacker to execute code locally. |
| Exposure of sensitive information to an unauthorized actor in Windows Win32K allows an authorized attacker to disclose information locally. |
| Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally. |
| Integer overflow or wraparound in Windows Terminal allows an unauthorized attacker to execute code locally. |
| Use after free in Windows VMSwitch allows an authorized attacker to elevate privileges over a network. |
| Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally. |
| Incorrect implementation of authentication algorithm in ASP.NET Core allows an authorized attacker to elevate privileges over a network. |
| Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service over a network. |
| Authentication bypass by assumed-immutable data in ASP.NET Core allows an authorized attacker to elevate privileges over a network. |
| TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, and WR6500 v2.3.15 were discovered to contain a command injection vulnerability in the system.setclock interface. This vulnerability allows attackers to execute arbitrary commands as root via a crafted input. |
| TR1200 v2.4.15, TR3000 v2.4.21, WR300 v2.4.25, WR1200 v2.4.23, WR1300 v2.4.22, WR1500 v2.3.10, WR3000 v2.4.19, WR3600 v2.3.16, and WR6500 v2.3.15 were discovered to contain a command injection vulnerability in the ipsec_conn interface. This vulnerability allows attackers to execute arbitrary commands as root via a crafted input. |
