CVE Vulnerability Catalog

An illegal memory access was found in ncurses 6.0 in the _nc_save_str function in alloc_entry.c, leading to a remote denial of service attack.

In libiberty (as distributed with GNU Binutils 2.29), the C++ symbol demangler routine in cplus-dem.c allows a remote attacker to cause a denial of service (excessive memory allocation and application crash) via a crafted file. This is demonstrated through a call from the BFD library (libbfd).

In MISP before version 2.4.79, there is a persistent XSS vulnerability via the comment field. It only affects users of the same instance because the comment field is not part of MISP synchronization.

The CORS Filter in Apache Tomcat 9.0.0.M1 to 9.0.0.M21, 8.5.0 to 8.5.15, 8.0.0.RC1 to 8.0.44, and 7.0.41 to 7.0.78 did not add an HTTP Vary header indicating that the response varies depending on Origin, permitting client and server side cache poisoning in some circumstances.

In Apache Tomcat, when a SecurityManager is configured, the system property replacement feature for configuration files could be used by a malicious web application to bypass the SecurityManager and read system properties that should not be visible.

The Realm implementations in Apache Tomcat versions 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70 and 6.0.0 to 6.0.45 did not process the supplied password if the supplied user name did not exist. This made a timing attack possible to determine valid user names. Note that the default configuration includes the LockOutRealm which makes exploitation of this vulnerability harder.

Vulnerability in the Oracle Agile PLM component of Oracle Supply Chain Products Suite (subcomponent: Web Client). Affected versions are 9.3.5 and 9.3.6. Easily exploitable vulnerability allows low privileged attacker with network access via HTTP to compromise Oracle Agile PLM. Successful attacks require human interaction and may significantly impact additional products, resulting in unauthorized access to critical data or complete access to all Oracle Agile PLM accessible data. CVSS 3.0 Base Score 6.8 (Confidentiality impacts).

W urządzeniach Schneider Electric Modicon PLCs Modicon M221, M241 i M251, w wersjach oprogramowania przed odpowiednio 1.5.0.0 oraz 4.0.5.11, odkryto problem z przewidywalnym zakresem wartości. Affected products generują niewystarczająco losowe numery początkowe sekwencji TCP, co może umożliwić atakującemu przewidywanie tych numerów na podstawie wcześniejszych wartości.

Internet Explorer in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1, Windows RT 8.1, and Windows Server 2012 and R2 allow an attacker to detect specific files on the user's computer when affected Microsoft scripting engines do not properly handle objects in memory.

An issue was discovered in Pivotal Spring Web Flow through 2.4.4. Applications that do not change the value of the MvcViewFactoryCreator useSpringBinding property (disabled by default) can be vulnerable to malicious EL expressions in view states that process form submissions but do not have a sub-element to declare explicit data binding property mappings.

Vulnerability in PeopleSoft Enterprise CS Campus Community component (subcomponent: Frameworks) version 9.2. Allows a high privileged attacker with network access via HTTP to compromise the system, resulting in unauthorized creation, deletion, modification, or access to critical data.

A vulnerability in the detection engine handling SSL packets for Cisco Firepower System Software could allow an unauthenticated, remote attacker to cause a denial of service (DoS) condition because the Snort process unexpectedly restarts. This affects versions prior to the first fixed release when configured with an SSL Decrypt-Resign policy.

OpenStack Glance before Newton has an SSRF vulnerability in the 'copy_from' feature of the Image Service API v1. An attacker can create images with URLs like 'http://localhost:22' to perform masked internal port scans.

The iconv program in the GNU C Library (aka glibc or libc6) 2.31 and earlier, when invoked with multiple suffixes in the destination encoding (TRANSLATE or IGNORE) along with the -c option, enters an infinite loop when processing invalid multi-byte input sequences, leading to a denial of service.

The L2TP Client in MikroTik RouterOS versions 6.38.3 and 6.37.4 does not enable IPsec encryption after a reboot, which allows man-in-the-middle attackers to view transmitted data unencrypted and gain access to networks on the L2TP server by monitoring the packets for the transmitted data and obtaining the L2TP secret.

W OpenSSH przed wersją 7.3, gdy do haszowania haseł użytkowników używane są algorytmy SHA256 lub SHA512, sshd stosuje haszowanie BLOWFISH dla statycznego hasła, gdy nazwa użytkownika nie istnieje. To umożliwia zdalnym atakującym enumerację użytkowników poprzez wykorzystanie różnicy czasowej w odpowiedziach, gdy podane jest długie hasło.

A vulnerability in the logging subsystem of the Cisco Firepower Threat Defense (FTD) Firepower Device Manager (FDM) could allow an unauthenticated, remote attacker to add arbitrary entries to the audit log. This affects FTD Software versions 6.1.x on specific products with FDM enabled. An attacker could exploit this to manipulate the audit log, potentially hiding unauthorized actions.