CVE Vulnerability Catalog

A heap buffer overflow in HPE NonStop Debug Utilities could corrupt the resume-execution address and may potentially redirect execution flow. The description does not specify the attack vector or required privileges.

A heap buffer overflow in HPE NonStop Inspect Subsystem could corrupt the resume-execution address and may potentially redirect execution flow. The description does not specify the attack vector or required privileges.

A heap buffer overflow in HPE NonStop OCAX could corrupt the address space and may potentially redirect execution flow. The description does not specify the attack vector or required privileges.

A heap buffer overflow in HPE NonStop NDSREST could corrupt the resume-execution address and may potentially redirect execution flow. The description does not specify the attack vector or required privileges.

A directory traversal vulnerability in HPE NonStop Python 3.x could allow attackers to overwrite arbitrary files via a .. (dot dot) sequence in filenames inside a TAR archive. The description does not specify required privileges.

An improper link resolution before file access ('link following') vulnerability has been reported to affect Virtualization Station. A remote attacker who gains a user account can exploit the vulnerability to compromise the security of the system.

An authorization bypass through user-controlled key vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow remote attackers to obtain sensitive data.

A relative path traversal vulnerability has been reported to affect QuMagie. If a remote attacker gains an administrator account, they can then exploit the vulnerability to read the contents of unexpected files or system data.

A missing authentication for critical function vulnerability has been reported to affect HybridDesk Station. If exploited, the vulnerability could allow remote attackers to gain access to the system.

An incorrect permission assignment for critical resource vulnerability has been reported to affect Download Station. If a local attacker gains an administrator account, they can then exploit the vulnerability to compromise the security of the system.

An improper isolation or compartmentalization vulnerability has been reported to affect Notes Station 3. If a local attacker gains an administrator account, they can then exploit the vulnerability to compromise the security of the system.

An incorrect permission assignment for critical resource vulnerability has been reported to affect Notes Station 3. If a local attacker gains a user account, they can then exploit the vulnerability to compromise the security of the system.

A SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands.

A SQL injection vulnerability has been reported to affect Video Station. If a remote attacker gains a user account, they can then exploit the vulnerability to execute unauthorized code or commands.

A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit the vulnerability to read the contents of unexpected files or system data.

In Eclipse Jetty, across various versions of `jetty-server`, and `jetty-proxy`, the host whitelist/blacklist is case-sensitive, and would allow hosts through that only differ by case.

In Jetty's HttpClient, when a request is made through a forward proxy, the server may reply with a 407 (Proxy Authentication Required). The client mistakenly interprets the 407 as coming from the proxy and re-sends the request with the Proxy-Authentication header, which reaches the server and exposes the proxy credentials to it.

In Eclipse Jetty, HttpClient may receive a redirect of the form /secure/../evil. If an attacker controls the redirects, HttpClient matches authentication credentials against /secure rather than normalizing the path to /evil, and therefore follows the redirect sending the Authorization header for /secure to /evil.

The WebCTI service for Slican IPx telephone exchanges stores temporary subscriber passwords in plaintext. An attacker with access to the database can obtain the user's password and log in to the subscriber's account.

The WebCTI service for Slican IPx telephone exchanges is vulnerable to SQL Injection in the /webcti/admin_json.php endpoint. Improper neutralization of input allows an authenticated attacker to execute SQL Injection attacks.