Threat Level: green Handler on Duty: Xavier Mertens

SANS ISC: TCP/UDP Port 80 Activity - SANS Internet Storm Center TCP/UDP Port 80 Activity


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
Loading...
Port Information
Protocol Service Name
tcp 20005 NetUSB
tcp www World Wide Web HTTP
udp www World Wide Web HTTP
TCP [ICS] OPC UA XML [ICS] OPC UA XML
tcp RingZero [trojan] RingZero
tcp RTB666 [trojan] RTB 666
tcp Seeker [trojan] Seeker
tcp WANRemote [trojan] WAN Remote
tcp WebDownloader [trojan] WebDownloader
tcp WebServerCT [trojan] Web Server CT
tcp 2700 Matlab
udp http World Wide Web HTTP
tcp 9418 git
tcp 8085 http proxy for Koobface Variant
tcp ReverseWWWTunnel [trojan] Reverse WWW Tunnel Backdoor
tcp Ramen [trojan] Ramen
tcp Noob [trojan] Noob
tcp AckCmd [trojan] AckCmd
tcp BackEnd [trojan] Back End
tcp BO2000Plug-Ins [trojan] Back Orifice 2000 Plug-Ins
tcp Cafeini [trojan] Cafeini
tcp CGIBackdoor [trojan] CGI Backdoor
tcp Executor [trojan] Executor
tcp GodMessage4Creator [trojan] God Message 4 Creator
tcp GodMessage [trojan] God Message
tcp Hooker [trojan] Hooker
tcp http World Wide Web HTTP
tcp IISworm [trojan] IISworm
tcp MTX [trojan] MTX
tcp NCX [trojan] NCX
tcp 711trojan [trojan] 711 trojan (Seven Eleven)
[get complete service list]
User Comments
Submitted By Date
Comment
Boris Atanassov 2010-04-02 00:05:39
Port 443 together with 80 is also used by SKYPE.
Adam Nowacki 2004-07-01 16:27:06
This is default listen port for distcc daemon (distributed C/C++ compiler). It only supports IP based authentication and defaults to allow from all, which means anyone can use it. It does no other harm than letting others to use your hardware (at +5 nice) to speed up their compilation process.
Adam Nowacki 2004-07-01 16:26:52
3632 is default listen port for distcc daemon (distributed C/C++ compiler). It only supports IP based authentication and defaults to allow from all, which means anyone can use it. It does no other harm than letting others to use your hardware (at +5 nice) to speed up their compilation process.
arzie 2004-06-20 20:14:44
Port 4672/udp is used by the emule file sharing software. http://www.emule-project.net/home/perl/help.cgi?l=2&topic_id=27&rm=show_topic
Javier Fernandez-Sanguino 2003-12-14 08:56:37
It might be worthwhile adding the CVE entries related to known Apache security vulnerabilities. Sources for information with these are: - http://www.apacheweek.com/features/security-13 for Apache 1.3 and - http://www.apacheweek.com/features/security-20 for Apache 2..0
Marcus H. Sachs, SANS Institute 2003-10-10 00:33:47
SANS Top-20 Entry: W1 Internet Information Services (IIS) http://isc.sans.org/top20.html#w1 Default installations of Internet Information Services (IIS) have proven vulnerable to a number of serious attacks over time. The impact of these vulnerabilities can include: - Denial of service - Exposure or compromise of sensitive files or data - Execution of arbitrary commands - Complete compromise of the server ---------- SANS Top-20 Entry: U3 Apache Web Server http://isc.sans.org/top20.html#u3 Apache has historically been, and continues to be the most popular web server on the Internet. In comparison to Microsofts Internet Information Server, Apache may have a cleaner record in regards to security, but it still has its fair share of vulnerabilities. In addition to exploits in Apaches core and modules (CA-2002-27, CA-2002-17), SQL, databases, CGI, PHP vulnerabilities are all potentially exposed through the web server. If left unsecured, vulnerabilities in the Apache web server implementation and associated components can result in denial of service, information disclosure, web site defacement, remote root access, or countless other unfavorable results.
Add a comment
CVE Links
CVE # Description
CVE-1999-0021
CVE-1999-0039
CVE-1999-0045
CVE-1999-0066
CVE-1999-0067
CVE-1999-0068
CVE-1999-0070
CVE-1999-0146
CVE-1999-0147
CVE-1999-0148
CVE-1999-0149
CVE-1999-0172
CVE-1999-0174
CVE-1999-0175
CVE-1999-0176
CVE-1999-0178
CVE-1999-0191
CVE-1999-0196
CVE-1999-0229
CVE-1999-0233
CVE-1999-0236
CVE-1999-0237
CVE-1999-0238
CVE-1999-0253
CVE-1999-0260
CVE-1999-0262
CVE-1999-0264
CVE-1999-0266
CVE-1999-0269
CVE-1999-0270
CVE-1999-0276
CVE-1999-0278
CVE-1999-0279
CVE-1999-0287
CVE-1999-0360
CVE-1999-0386
CVE-1999-0407
CVE-1999-0408
CVE-1999-0449
CVE-1999-0455
CVE-1999-0474
CVE-1999-0477
CVE-1999-0509
CVE-1999-0606
CVE-1999-0607
CVE-1999-0610
CVE-1999-0612
CVE-1999-0643
CVE-1999-0678
CVE-1999-0710
CVE-1999-0736
CVE-1999-0737
CVE-1999-0800
CVE-1999-0874
CVE-1999-0885
CVE-1999-0913
CVE-1999-0930
CVE-1999-0934
CVE-1999-0936
CVE-1999-0937
CVE-1999-0947
CVE-1999-0951
CVE-1999-0953
CVE-1999-0970
CVE-1999-1005
CVE-1999-1011
CVE-1999-1030
CVE-1999-1050
CVE-1999-1052
CVE-1999-1063
CVE-1999-1067
CVE-1999-1069
CVE-1999-1070
CVE-1999-1072
CVE-1999-1078
CVE-1999-1081
CVE-1999-1154
CVE-1999-1177
CVE-1999-1178
CVE-1999-1179
CVE-1999-1180
CVE-1999-1189
CVE-1999-1232
CVE-1999-1278
CVE-1999-1374
CVE-1999-1376
CVE-1999-1377
CVE-1999-1462
CVE-1999-1479
CVE-1999-1520
CVE-1999-1530
CVE-1999-1533
CVE-1999-1538
CVE-1999-1550
CVE-2000-0024
CVE-2000-0039
CVE-2000-0054
CVE-2000-0057
CVE-2000-0063
CVE-2000-0066
CVE-2000-0071
CVE-2000-0074
CVE-2000-0079
CVE-2000-0097
CVE-2000-0117
CVE-2000-0122
CVE-2000-0127
CVE-2000-0169
CVE-2000-0180
CVE-2000-0189
CVE-2000-0191
CVE-2000-0192
CVE-2000-0207
CVE-2000-0208
CVE-2000-0213
CVE-2000-0236
CVE-2000-0242
CVE-2000-0252
CVE-2000-0260
CVE-2000-0278
CVE-2000-0282
CVE-2000-0287
CVE-2000-0288
CVE-2000-0302
CVE-2000-0304
CVE-2000-0322
CVE-2000-0381
CVE-2000-0382
CVE-2000-0396
CVE-2000-0401
CVE-2000-0413
CVE-2000-0423
CVE-2000-0429
CVE-2000-0432
CVE-2000-0439
CVE-2000-0457
CVE-2000-0521
CVE-2000-0526
CVE-2000-0538
CVE-2000-0590
CVE-2000-0622
CVE-2000-0627
CVE-2000-0628
CVE-2000-0629
CVE-2000-0630
CVE-2000-0638
CVE-2000-0642
CVE-2000-0670
CVE-2000-0671
CVE-2000-0672
CVE-2000-0674
CVE-2000-0677
CVE-2000-0682
CVE-2000-0683
CVE-2000-0707
CVE-2000-0726
CVE-2000-0746
CVE-2000-0758
CVE-2000-0760
CVE-2000-0769
CVE-2000-0778
CVE-2000-0826
CVE-2000-0832
CVE-2000-0835
CVE-2000-0853
CVE-2000-0868
CVE-2000-0869
CVE-2000-0884
CVE-2000-0906
CVE-2000-0921
CVE-2000-0922
CVE-2000-0924
CVE-2000-0925
CVE-2000-0940
CVE-2000-0942
CVE-2000-0945
CVE-2000-0951
CVE-2000-0952
CVE-2000-0967
CVE-2000-0975
CVE-2000-0977
CVE-2000-1005
CVE-2000-1016
CVE-2000-1023
CVE-2000-1024
CVE-2000-1025
CVE-2000-1036
CVE-2000-1049
CVE-2000-1078
CVE-2000-1092
CVE-2000-1110
CVE-2000-1131
CVE-2000-1132
CVE-2000-1171
CVE-2000-1196
CVE-2001-0009
CVE-2001-0021
CVE-2001-0022
CVE-2001-0023
CVE-2001-0025
CVE-2001-0075
CVE-2001-0076
CVE-2001-0096
CVE-2001-0099
CVE-2001-0100
CVE-2001-0113
CVE-2001-0123
CVE-2001-0133
CVE-2001-0180
CVE-2001-0210
CVE-2001-0211
CVE-2001-0212
CVE-2001-0214
CVE-2001-0215
CVE-2001-0216
CVE-2001-0217
CVE-2001-0223
CVE-2001-0224
CVE-2001-0232
CVE-2001-0241
CVE-2001-0250
CVE-2001-0251
CVE-2001-0252
CVE-2001-0253
CVE-2001-0271
CVE-2001-0272
CVE-2001-0291
CVE-2001-0302
CVE-2001-0305
CVE-2001-0319
CVE-2001-0330
CVE-2001-0333
CVE-2001-0341
CVE-2001-0400
CVE-2001-0420
CVE-2001-0432
CVE-2001-0436
CVE-2001-0463
CVE-2001-0466
CVE-2001-0476
CVE-2001-0527
CVE-2001-0537
CVE-2001-0552
CVE-2001-0555
CVE-2001-0561
CVE-2001-0590
CVE-2001-0660
CVE-2001-0731
CVE-2001-0740
CVE-2001-0746
CVE-2001-0749
CVE-2001-0780
CVE-2001-0805
CVE-2001-0821
CVE-2001-0849
CVE-2001-0871
CVE-2001-0922
CVE-2001-0937
CVE-2001-0938
CVE-2001-0958
CVE-2001-0997
CVE-2001-1014
CVE-2001-1020
CVE-2001-1032
CVE-2001-1044
CVE-2001-1049
CVE-2001-1067
CVE-2001-1100
CVE-2001-1114
CVE-2001-1115
CVE-2001-1130
CVE-2001-1150
CVE-2001-1195
CVE-2001-1196
CVE-2001-1199
CVE-2001-1205
CVE-2001-1209
CVE-2001-1212
CVE-2001-1216
CVE-2001-1226
CVE-2001-1252
CVE-2001-1283
CVE-2001-1341
CVE-2001-1343
CVE-2001-1370
CVE-2001-1408
CVE-2002-0008
CVE-2002-0011
CVE-2002-0071
CVE-2002-0081
CVE-2002-0150
CVE-2002-0206
CVE-2002-0220
CVE-2002-0230
CVE-2002-0232
CVE-2002-0236
CVE-2002-0263
CVE-2002-0273
CVE-2002-0290
CVE-2002-0306
CVE-2002-0308
CVE-2002-0346
CVE-2002-0364
CVE-2002-0375
CVE-2002-0392
CVE-2002-0434
CVE-2002-0495
CVE-2002-0516
CVE-2002-0539
CVE-2002-0562
CVE-2002-0568
CVE-2002-0599
CVE-2002-0611
CVE-2002-0613
CVE-2002-0614
CVE-2002-0682
CVE-2002-0710
CVE-2002-0734
CVE-2002-0749
CVE-2002-0855
CVE-2002-0882
CVE-2002-0902
CVE-2002-0917
CVE-2002-0920
CVE-2002-0923
CVE-2002-0934
CVE-2002-0947
CVE-2002-1027
CVE-2002-1042
CVE-2002-1070
CVE-2002-1142
CVE-2002-1169
CVE-2002-1236
CVE-2002-1334
CVE-2002-1341
CVE-2002-1361
CVE-2002-1436
CVE-2002-1526
CVE-2002-1559
CVE-2003-0042
CVE-2003-0054
CVE-2003-0109
CVE-2003-0117
CVE-2003-0153
CVE-2003-0215
CVE-2003-0217
CVE-2003-0227
CVE-2003-0377
CVE-2003-0394
CVE-2003-0422
CVE-2003-0434
CVE-2003-0471
CVE-2003-0486
CVE-2003-0624
CVE-2003-0626
CVE-2003-0818
CVE-2003-0906
CVE-2004-0030
CVE-2004-0032
CVE-2004-0039
CVE-2004-0095
CVE-2004-0204
CVE-2004-0798
CVE-2004-1134
CVE-2005-0202
CVE-2006-4138
CVE-2006-6696
CVE-2007-5746
CVE-2008-0112
CVE-2008-2540
CVE-2008-2992
CVE-2008-4268
CVE-2010-0188
CVE-2010-0806
CVE-2010-1297
CVE-2010-2884
CVE-2011-0609
CVE-2011-0611
CVE-2011-0807
CVE-2011-1969
CVE-2011-2003
CVE-2011-3544
CVE-2011-5052
CVE-2012-0158
CVE-2012-0209
CVE-2012-0391
CVE-2012-0392
CVE-2012-0394
CVE-2012-0507
CVE-2012-1535
CVE-2012-2998
CVE-2012-4681
CVE-2012-4969
CVE-2012-5159
CVE-2013-0158 Unspecified vulnerability in CloudBees Jenkins before 1.498, Jenkins LTS before 1.480.2, and Jenkins Enterprise 1.447.x before 1.447.6.1 and 1.466.x before 1.466.12.1, when a slave is attached and anonymous read access is enabled, allows remote attackers to obtain the master cryptographic key via unknown vectors.
CVE-2013-0235 The XMLRPC API in WordPress before 3.5.1 allows remote attackers to send HTTP requests to intranet servers, and conduct port-scanning attacks, by specifying a crafted source URL for a pingback, related to a Server-Side Request Forgery (SSRF) issue.
CVE-2013-0422 Multiple vulnerabilities in Oracle Java 7 before Update 11 allow remote attackers to execute arbitrary code by (1) using the public getMBeanInstantiator method in the JmxMBeanServer class to obtain a reference to a private MBeanInstantiator object, then retrieving arbitrary Class references using the findClass method, and (2) using the Reflection API with recursion in a way that bypasses a security check by the java.lang.invoke.MethodHandles.Lookup.checkSecurityManager method due to the inability of the sun.reflect.Reflection.getCallerClass method to skip frames related to the new reflection API, as exploited in the wild in January 2013, as demonstrated by Blackhole and Nuclear Pack, and a different vulnerability than CVE-2012-4681 and CVE-2012-3174. NOTE: some parties have mapped the recursive Reflection API issue to CVE-2012-3174, but CVE-2012-3174 is for a different vulnerability whose details are not public as of 20130114. CVE-2013-0422 covers both the JMX/MBean and Reflection API issues. NOTE: it was originally reported that Java 6 was also vulnerable, but the reporter has retracted this claim, stating that Java 6 is not exploitable because the relevant code is called in a way that does not bypass security checks. NOTE: as of 20130114, a reliable third party has claimed that the findClass/MBeanInstantiator vector was not fixed in Oracle Java 7 Update 11. If there is still a vulnerable condition, then a separate CVE identifier might be created for the unfixed issue.
CVE-2013-0431 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 through Update 11, and OpenJDK 7, allows user-assisted remote attackers to bypass the Java security sandbox via unspecified vectors related to JMX, aka "Issue 52," a different vulnerability than CVE-2013-1490.
CVE-2013-0632 administrator.cfc in Adobe ColdFusion 9.0, 9.0.1, 9.0.2, and 10 allows remote attackers to bypass authentication and possibly execute arbitrary code by logging in to the RDS component using the default empty password and leveraging this session to access the administrative web interface, as exploited in the wild in January 2013.
CVE-2013-0757 The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderbird ESR 17.x before 17.0.2, and SeaMonkey before 2.15 does not prevent modifications to the prototype of an object, which allows remote attackers to execute arbitrary JavaScript code with chrome privileges by referencing Object.prototype.__proto__ in a crafted HTML document.
CVE-2013-1330 The default configuration of Microsoft SharePoint Portal Server 2003 SP3, SharePoint Server 2007 SP3 and 2010 SP1 and SP2, and Office Web Apps 2010 does not set the EnableViewStateMac attribute, which allows remote attackers to execute arbitrary code by leveraging an unassigned workflow, aka "MAC Disabled Vulnerability."
CVE-2013-1462 Integer signedness error in the ExecuteSoapAction function in the SOAPAction handler in the HTTP service in MiniUPnP MiniUPnPd 1.0 allows remote attackers to cause a denial of service (incorrect memory copy) via a SOAPAction header that lacks a " (double quote) character, a different vulnerability than CVE-2013-0230.
CVE-2013-1489 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 10 and Update 11, when running on Windows using Internet Explorer, Firefox, Opera, and Google Chrome, allows remote attackers to bypass the "Very High" security level of the Java Control Panel and execute unsigned Java code without prompting the user via unknown vectors, aka "Issue 53" and the "Java Security Slider" vulnerability.
CVE-2013-1493 The color management (CMM) functionality in the 2D component in Oracle Java SE 7 Update 15 and earlier, 6 Update 41 and earlier, and 5.0 Update 40 and earlier allows remote attackers to execute arbitrary code or cause a denial of service (crash) via an image with crafted raster parameters, which triggers (1) an out-of-bounds read or (2) memory corruption in the JVM, as exploited in the wild in February 2013.
CVE-2013-1965 Apache Struts Showcase App 2.0.0 through 2.3.13, as used in Struts 2 before 2.3.14.1, allows remote attackers to execute arbitrary OGNL code via a crafted parameter name that is not properly handled when invoking a redirect.
CVE-2013-2068 Multiple directory traversal vulnerabilities in the AgentController in Red Hat CloudForms Management Engine 2.0 allow remote attackers to create and overwrite arbitrary files via a .. (dot dot) in the filename parameter to the (1) log, (2) upload, or (3) linuxpkgs method.
CVE-2013-2115 Apache Struts 2 before 2.3.14.2 allows remote attackers to execute arbitrary OGNL code via a crafted request that is not properly handled when using the includeParams attribute in the (1) URL or (2) A tag. NOTE: this issue is due to an incomplete fix for CVE-2013-1966.
CVE-2013-2134 Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted action name that is not properly handled during wildcard matching, a different vulnerability than CVE-2013-2135.
CVE-2013-2135 Apache Struts 2 before 2.3.14.3 allows remote attackers to execute arbitrary OGNL code via a request with a crafted value that contains both "${}" and "%{}" sequences, which causes the OGNL code to be evaluated twice.
CVE-2013-2185 ** DISPUTED ** The readObject method in the DiskFileItem class in Apache Tomcat and JBoss Web, as used in Red Hat JBoss Enterprise Application Platform 6.1.0 and Red Hat JBoss Portal 6.0.0, allows remote attackers to write to arbitrary files via a NULL byte in a file name in a serialized instance, a similar issue to CVE-2013-2186. NOTE: this issue is reportedly disputed by the Apache Tomcat team, although Red Hat considers it a vulnerability. The dispute appears to regard whether it is the responsibility of applications to avoid providing untrusted data to be deserialized, or whether this class should inherently protect against this issue.
CVE-2013-2251 Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction: prefix.
CVE-2013-2423 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 17 and earlier, and OpenJDK 7, allows remote attackers to affect integrity via unknown vectors related to HotSpot. NOTE: the previous information is from the April 2013 CPU. Oracle has not commented on claims from the original researcher that this vulnerability allows remote attackers to bypass permission checks by the MethodHandles method and modify arbitrary public final fields using reflection and type confusion, as demonstrated using integer and double fields to disable the security manager.
CVE-2013-2465 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "Incorrect image channel verification" in 2D.
CVE-2013-2471 Unspecified vulnerability in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 21 and earlier, 6 Update 45 and earlier, and 5.0 Update 45 and earlier, and OpenJDK 7, allows remote attackers to affect confidentiality, integrity, and availability via unknown vectors related to 2D. NOTE: the previous information is from the June 2013 CPU. Oracle has not commented on claims from another vendor that this issue allows remote attackers to bypass the Java sandbox via vectors related to "Incorrect IntegerComponentRaster size checks."
CVE-2013-2551 Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site that triggers access to a deleted object, as demonstrated by VUPEN during a Pwn2Own competition at CanSecWest 2013, aka "Internet Explorer Use After Free Vulnerability," a different vulnerability than CVE-2013-1308 and CVE-2013-1309.
CVE-2013-3576 ginkgosnmp.inc in HP System Management Homepage (SMH) allows remote authenticated users to execute arbitrary commands via shell metacharacters in the PATH_INFO to smhutil/snmpchp.php.en.
CVE-2013-3623 Multiple stack-based buffer overflows in cgi/close_window.cgi in the web interface in the Intelligent Platform Management Interface (IPMI) with firmware before 3.15 (SMT_X9_315) on Supermicro X9 generation motherboards allow remote attackers to execute arbitrary code via the (1) sess_sid or (2) ACT parameter.
CVE-2013-3686 cgi-bin/operator/param in AirLive WL2600CAM and possibly other camera models allows remote attackers to obtain the administrator password via a list action.
CVE-2013-3896 Microsoft Silverlight 5 before 5.1.20913.0 does not properly validate pointers during access to Silverlight elements, which allows remote attackers to obtain sensitive information via a crafted Silverlight application, aka "Silverlight Vulnerability."
CVE-2013-3918 The InformationCardSigninHelper Class ActiveX control in icardie.dll in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows remote attackers to execute arbitrary code or cause a denial of service (out-of-bounds write) via a crafted web page that is accessed by Internet Explorer, as exploited in the wild in November 2013, aka "InformationCardSigninHelper Vulnerability."
CVE-2013-4810 HP ProCurve Manager (PCM) 3.20 and 4.0, PCM+ 3.20 and 4.0, Identity Driven Manager (IDM) 4.0, and Application Lifecycle Management allow remote attackers to execute arbitrary code via a marshalled object to (1) EJBInvokerServlet or (2) JMXInvokerServlet, aka ZDI-CAN-1760. NOTE: this is probably a duplicate of CVE-2007-1036, CVE-2010-0738, and/or CVE-2012-0874.
CVE-2013-4811 UpdateDomainControllerServlet in the SNAC registration server in HP ProCurve Manager (PCM) 3.20 and 4.0, PCM+ 3.20 and 4.0, and Identity Driven Manager (IDM) 4.0 does not properly validate the adCert argument, which allows remote attackers to upload .jsp files and consequently execute arbitrary code via unspecified vectors, aka ZDI-CAN-1743.
CVE-2013-4812 UpdateCertificatesServlet in the SNAC registration server in HP ProCurve Manager (PCM) 3.20 and 4.0, PCM+ 3.20 and 4.0, and Identity Driven Manager (IDM) 4.0 does not properly validate the fileName argument, which allows remote attackers to upload .jsp files and consequently execute arbitrary code via unspecified vectors, aka ZDI-CAN-1743.
CVE-2013-4822 Unspecified vulnerability in HP Intelligent Management Center (iMC) and HP IMC Branch Intelligent Management System Software Module (aka BIMS) allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1606.
CVE-2013-4837 Unspecified vulnerability in Virtual User Generator in HP LoadRunner before 11.52 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1832.
CVE-2013-4838 Unspecified vulnerability in Virtual User Generator in HP LoadRunner before 11.52 allows remote attackers to execute arbitrary code via unknown vectors, aka ZDI-CAN-1850.
CVE-2013-4984 The close_connections function in /opt/cma/bin/clear_keys.pl in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows local users to gain privileges via shell metacharacters in the second argument.
CVE-2013-5486 Directory traversal vulnerability in processImageSave.jsp in DCNM-SAN Server in Cisco Prime Data Center Network Manager (DCNM) before 6.2(1) allows remote attackers to write arbitrary files via the chartid parameter, aka Bug IDs CSCue77035 and CSCue77036. NOTE: this can be leveraged to execute arbitrary commands by using the JBoss autodeploy functionality.
CVE-2013-6221 Directory traversal vulnerability in CommunicationServlet in HP Service Virtualization 3.x before 3.50.1, when the AutoPass license server is enabled, allows remote attackers to create arbitrary files and consequently execute arbitrary code via unspecified vectors, aka ZDI-CAN-2031.
CVE-2013-6810 The server in Brocade Network Advisor before 12.1.0, as used in EMC Connectrix Manager Converged Network Edition (CMCNE), HP B-series SAN Network Advisor, and possibly other products, allows remote attackers to execute arbitrary code by using a servlet to upload an executable file.
CVE-2013-6955 webman/imageSelector.cgi in Synology DiskStation Manager (DSM) 4.0 before 4.0-2259, 4.2 before 4.2-3243, and 4.3 before 4.3-3810 Update 1 allows remote attackers to append data to arbitrary files, and consequently execute arbitrary code, via a pathname in the SLICEUPLOAD X-TMP-FILE HTTP header.
CVE-2014-0497 Integer underflow in Adobe Flash Player before 11.7.700.261 and 11.8.x through 12.0.x before 12.0.0.44 on Windows and Mac OS X, and before 11.2.202.336 on Linux, allows remote attackers to execute arbitrary code via unspecified vectors.
CVE-2014-3440 The Agent Control Interface in the management server in Symantec Critical System Protection (SCSP) 5.2.9 before MP6 and Symantec Data Center Security: Server Advanced (SDCS:SA) 6.0.x before 6.0 MP1 allows remote authenticated users to execute arbitrary commands by leveraging client-system access to upload a log file.
CVE-2014-3804 The av-centerd SOAP service in AlienVault OSSIM before 4.7.0 allows remote attackers to execute arbitrary commands via a crafted (1) update_system_info_debian_package, (2) ossec_task, (3) set_ossim_setup admin_ip, (4) sync_rserver, or (5) set_ossim_setup framework_ip request, a different vulnerability than CVE-2014-3805.
CVE-2014-3805 The av-centerd SOAP service in AlienVault OSSIM before 4.7.0 allows remote attackers to execute arbitrary commands via a crafted (1) get_license, (2) get_log_line, or (3) update_system/upgrade_pro_web request, a different vulnerability than CVE-2014-3804.
CVE-2014-3828 Multiple SQL injection vulnerabilities in Centreon 2.5.1 and Centreon Enterprise Server 2.2 allow remote attackers to execute arbitrary SQL commands via (1) the index_id parameter to views/graphs/common/makeXML_ListMetrics.php, (2) the sid parameter to views/graphs/GetXmlTree.php, (3) the session_id parameter to views/graphs/graphStatus/displayServiceStatus.php, (4) the mnftr_id parameter to configuration/configObject/traps/GetXMLTrapsForVendor.php, or (5) the index parameter to common/javascript/commandGetArgs/cmdGetExample.php in include/.
CVE-2014-3829 displayServiceStatus.php in Centreon 2.5.1 and Centreon Enterprise Server 2.2 allows remote attackers to execute arbitrary commands via shell metacharacters in the (1) session_id or (2) template_id parameter, related to the command_line variable.
CVE-2014-3915 The userRequest servlet in the Admin Center for Tivoli Storage Manager in Rocket Servergraph allows remote attackers to execute arbitrary commands via a (1) auth, (2) auth_session, (3) auth_simple, (4) add, (5) add_flat, (6) remove, (7) set_pwd, (8) add_permissions, (9) revoke_permissions, (10) runAsync, or (11) tsmRequest command.
CVE-2014-3927
CVE-2014-3936 Stack-based buffer overflow in the do_hnap function in www/my_cgi.cgi in D-Link DSP-W215 (Rev. A1) with firmware 1.01b06 and earlier, DIR-505 with firmware before 1.08b10, and DIR-505L with firmware 1.01 and earlier allows remote attackers to execute arbitrary code via a long Content-Length header in a GetDeviceSettings action in an HNAP request.
CVE-2014-5210 The av-centerd SOAP service in AlienVault OSSIM before 4.7.0 allows remote attackers to execute arbitrary commands via a crafted (1) remote_task or (2) get_license request, a different vulnerability than CVE-2014-3804 and CVE-2014-3805.
CVE-2014-7169 GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or possibly have unknown other impact via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd, the mod_cgi and mod_cgid modules in the Apache HTTP Server, scripts executed by unspecified DHCP clients, and other situations in which setting the environment occurs across a privilege boundary from Bash execution. NOTE: this vulnerability exists because of an incomplete fix for CVE-2014-6271.
CVE-2014-7205 Eval injection vulnerability in the internals.batch function in lib/batch.js in the bassmaster plugin before 1.5.2 for the hapi server framework for Node.js allows remote attackers to execute arbitrary Javascript code via unspecified vectors.
CVE-2014-7235 htdocs_ari/includes/login.php in the ARI Framework module/Asterisk Recording Interface (ARI) in FreePBX before 2.9.0.9, 2.10.x, and 2.11 before 2.11.1.5 allows remote attackers to execute arbitrary code via the ari_auth coockie, related to the PHP unserialize function, as exploited in the wild in September 2014.
CVE-2014-7999 Cisco-Meraki MS, MR, and MX devices with firmware before 2014-09-24 allow remote authenticated users to install arbitrary firmware by leveraging unspecified HTTP handler access on the local network, aka Cisco-Meraki defect ID 00478565.
CVE-2014-8423 Unspecified vulnerability in the management portal in ARRIS VAP2500 before FW08.41 allows remote attackers to execute arbitrary commands via unknown vectors.
CVE-2014-8687
CVE-2014-9734 Directory traversal vulnerability in the Slider Revolution (revslider) plugin before 4.2 for WordPress allows remote attackers to read arbitrary files via a .. (dot dot) in the img parameter in a revslider_show_image action to wp-admin/admin-ajax.php.
CVE-2014-9735 The ThemePunch Slider Revolution (revslider) plugin before 3.0.96 for WordPress and Showbiz Pro plugin 1.7.1 and earlier for Wordpress does not properly restrict access to administrator AJAX functionality, which allows remote attackers to (1) upload and execute arbitrary files via an update_plugin action; (2) delete arbitrary sliders via a delete_slider action; and (3) create, (4) update, (5) import, or (6) export arbitrary sliders via unspecified vectors.
CVE-2014-10021 Unrestricted file upload vulnerability in UploadHandler.php in the WP Symposium plugin 14.11 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in server/php/.
CVE-2015-0235 Heap-based buffer overflow in the __nss_hostname_digits_dots function in glibc 2.2, and other 2.x versions before 2.18, allows context-dependent attackers to execute arbitrary code via vectors related to the (1) gethostbyname or (2) gethostbyname2 function, aka "GHOST."
CVE-2015-1560 SQL injection vulnerability in the isUserAdmin function in include/common/common-Func.php in Centreon (formerly Merethis Centreon) 2.5.4 and earlier allows remote attackers to execute arbitrary SQL commands via the sid parameter to include/common/XmlTree/GetXmlTree.php.
CVE-2015-2049 Unrestricted file upload vulnerability in D-Link DCS-931L with firmware 1.04 and earlier allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension.
CVE-2015-2051 The D-Link DIR-645 Wired/Wireless Router Rev. Ax with firmware 1.04b12 and earlier allows remote attackers to execute arbitrary commands via a GetDeviceSettings action to the HNAP interface.
CVE-2015-4068 Directory traversal vulnerability in Arcserve UDP before 5.0 Update 4 allows remote attackers to obtain sensitive information or cause a denial of service via a crafted file path to the (1) reportFileServlet or (2) exportServlet servlet.
CVE-2015-5995 Mediabridge Medialink MWN-WAPR300N devices with firmware 5.07.50 and Tenda N3 Wireless N150 devices allow remote attackers to obtain administrative access via a certain admin substring in an HTTP Cookie header.
CVE-2015-6128 Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 mishandle library loading, which allows local users to gain privileges via a crafted application, aka "Windows Library Loading Remote Code Execution Vulnerability."
CVE-2015-6132 Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 Gold and 1511 mishandle library loading, which allows local users to gain privileges via a crafted application, aka "Windows Library Loading Remote Code Execution Vulnerability."
CVE-2015-6133 Microsoft Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 Gold and 1511 mishandle library loading, which allows local users to gain privileges via a crafted application, aka "Windows Library Loading Remote Code Execution Vulnerability."
CVE-2015-6456 GE Digital Energy MDS PulseNET and MDS PulseNET Enterprise before 3.1.5 have hardcoded credentials for a support account, which allows remote attackers to obtain administrative access, and consequently execute arbitrary code, by leveraging knowledge of the password.
CVE-2015-7808 The vB_Api_Hook::decodeArguments method in vBulletin 5 Connect 5.1.2 through 5.1.9 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object in the arguments parameter to ajax/api/hook/decodeArguments.
CVE-2015-8562 Joomla! 1.5.x, 2.x, and 3.x before 3.4.6 allow remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via the HTTP User-Agent header, as exploited in the wild in December 2015.
CVE-2016-0014 Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 Gold and 1511 mishandle DLL loading, which allows local users to gain privileges via a crafted application, aka "DLL Loading Elevation of Privilege Vulnerability."
CVE-2016-0016 Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, and Windows 10 Gold and 1511 mishandle DLL loading, which allows local users to gain privileges via a crafted application, aka "DLL Loading Remote Code Execution Vulnerability."
CVE-2016-0018 Microsoft Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 R2, and Windows 10 Gold and 1511 mishandle DLL loading, which allows local users to gain privileges via a crafted application, aka "DLL Loading Remote Code Execution Vulnerability."
CVE-2016-0020 Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 mishandle DLL loading, which allows local users to gain privileges via a crafted application, aka "MAPI DLL Loading Elevation of Privilege Vulnerability."
CVE-2016-0041 Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold and 1511, and Internet Explorer 10 and 11 mishandle DLL loading, which allows local users to gain privileges via a crafted application, aka "DLL Loading Remote Code Execution Vulnerability."
CVE-2016-0042 Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and 1511 mishandle DLL loading, which allows local users to gain privileges via a crafted application, aka "Windows DLL Loading Remote Code Execution Vulnerability."
CVE-2016-0160 Microsoft Internet Explorer 11 mishandles DLL loading, which allows local users to gain privileges via a crafted application, aka "DLL Loading Remote Code Execution Vulnerability."
CVE-2016-0517 Unspecified vulnerability in the Oracle Human Resources component in Oracle E-Business Suite 11.5.10.2 allows remote attackers to affect confidentiality and integrity via unknown vectors related to General utilities, a different vulnerability than CVE-2016-0518.
CVE-2016-0792 Multiple unspecified API endpoints in CloudBees Jenkins before 1.650 and LTS before 1.642.2 allow remote authenticated users to execute arbitrary code via serialized data in an XML file, related to XStream and groovy.util.Expando.
CVE-2016-0854 Unrestricted file upload vulnerability in Advantech WebAccess before 8.1 allows remote attackers to write to files of arbitrary types via unspecified vectors.
CVE-2016-2002 The validateAdminConfig handler in the Analytics Management Console in HPE Vertica 7.0.x before 7.0.2.12, 7.1.x before 7.1.2-12, and 7.2.x before 7.2.2-1 allows remote attackers to execute arbitrary commands via the mcPort parameter, aka ZDI-CAN-3417.
CVE-2016-3081 Apache Struts 2.x before 2.3.20.2, 2.3.24.x before 2.3.24.2, and 2.3.28.x before 2.3.28.1, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via method: prefix, related to chained expressions.
CVE-2016-3082 XSLTResult in Apache Struts 2.x before 2.3.20.2, 2.3.24.x before 2.3.24.2, and 2.3.28.x before 2.3.28.1 allows remote attackers to execute arbitrary code via the stylesheet location parameter.
CVE-2016-3087 Apache Struts 2.3.20.x before 2.3.20.3, 2.3.24.x before 2.3.24.3, and 2.3.28.x before 2.3.28.1, when Dynamic Method Invocation is enabled, allow remote attackers to execute arbitrary code via vectors related to an ! (exclamation mark) operator to the REST Plugin.
CVE-2016-3364 Microsoft Visio 2016 allows remote attackers to execute arbitrary code via a crafted document, aka "Microsoft Office Memory Corruption Vulnerability."
CVE-2016-4010
CVE-2016-4116 Unspecified vulnerability in Adobe Flash Player 21.0.0.213 and earlier, as used in the Adobe Flash libraries in Microsoft Internet Explorer 10 and 11 and Microsoft Edge, has unknown impact and attack vectors, a different vulnerability than other CVEs listed in MS16-064.
CVE-2016-4178 Adobe Flash Player before 18.0.0.366 and 19.x through 22.x before 22.0.0.209 on Windows and OS X and before 11.2.202.632 on Linux allows attackers to bypass intended access restrictions and obtain sensitive information via unspecified vectors.
CVE-2016-4350 Multiple SQL injection vulnerabilities in the Web Services web server in SolarWinds Storage Resource Monitor (SRM) Profiler (formerly Storage Manager (STM)) before 6.2.3 allow remote attackers to execute arbitrary SQL commands via the (1) ScriptSchedule parameter in the ScriptServlet servlet; the (2) winEventId or (3) winEventLog parameter in the WindowsEventLogsServlet servlet; the (4) processOS parameter in the ProcessesServlet servlet; the (5) group, (6) groupName, or (7) clientName parameter in the BackupExceptionsServlet servlet; the (8) valDB or (9) valFS parameter in the BackupAssociationServlet servlet; the (10) orderBy or (11) orderDir parameter in the HostStorageServlet servlet; the (12) fileName, (13) sortField, or (14) sortDirection parameter in the DuplicateFilesServlet servlet; the (15) orderFld or (16) orderDir parameter in the QuantumMonitorServlet servlet; the (17) exitCode parameter in the NbuErrorMessageServlet servlet; the (18) udfName, (19) displayName, (20) udfDescription, (21) udfDataValue, (22) udfSectionName, or (23) udfId parameter in the UserDefinedFieldConfigServlet servlet; the (24) sortField or (25) sortDirection parameter in the XiotechMonitorServlet servlet; the (26) sortField or (27) sortDirection parameter in the BexDriveUsageSummaryServlet servlet; the (28) state parameter in the ScriptServlet servlet; the (29) assignedNames parameter in the FileActionAssignmentServlet servlet; the (30) winEventSource parameter in the WindowsEventLogsServlet servlet; or the (31) name, (32) ipOne, (33) ipTwo, or (34) ipThree parameter in the XiotechMonitorServlet servlet.
CVE-2016-5563 Unspecified vulnerability in the Oracle Hospitality OPERA 5 Property Services component in Oracle Hospitality Applications 5.4.0.0 through 5.4.3.0, 5.5.0.0, and 5.5.1.0 allows remote administrators to affect confidentiality, integrity, and availability via vectors related to OPERA.
CVE-2016-6304 Multiple memory leaks in t1_lib.c in OpenSSL before 1.0.1u, 1.0.2 before 1.0.2i, and 1.1.0 before 1.1.0a allow remote attackers to cause a denial of service (memory consumption) via large OCSP Status Request extensions.
CVE-2016-6435 The web console in Cisco Firepower Management Center 6.0.1 allows remote authenticated users to read arbitrary files via crafted parameters, aka Bug ID CSCva30376.
CVE-2016-6563
CVE-2016-7275 Microsoft Office 2010 SP2, 2013 SP1, 2013 RT SP1, and 2016 mishandles library loading, which allows local users to gain privileges via a crafted application, aka "Microsoft Office OLE DLL Side Loading Vulnerability."
CVE-2016-7552
CVE-2016-8719
CVE-2016-8870 The register method in the UsersModelRegistration class in controllers/user.php in the Users component in Joomla! before 3.6.4, when registration has been disabled, allows remote attackers to create user accounts by leveraging failure to check the Allow User Registration configuration setting.
CVE-2016-9682
CVE-2016-9684
CVE-2017-1092
CVE-2017-3230
CVE-2017-5638
CVE-2017-6526
CVE-2017-6971
CVE-2017-7455
CVE-2017-7456
CVE-2017-9765
CVE-2017-9788
CVE-2017-9791
CVE-2017-9805
CVE-2017-11394
CVE-2017-12611