CVE Vulnerability Catalog

Simple Chatting System 1.0 allows Arbitrary File Upload via view/my_profile.php, which places files under uploads/.

Scubez Posty Readymade Classifieds has incorrect access control for the admin/user_activate_submit.php script, which may allow remote attackers to obtain sensitive information via a direct request.

Scubez Posty Readymade Classifieds has a SQL Injection vulnerability via the ID parameter in the admin/user_activate_submit.php file.

MikroTik v6.40.5 devices allow remote attackers to cause a denial of service via a flood of ICMP packets.

The tibbr user profiles components of tibbr Community and tibbr Enterprise expose a weakness in an improperly sandboxed third-party component. Affected releases are tibbr Community 5.2.1 and below; 6.0.0; 6.0.1; 7.0.0 and tibbr Enterprise 5.2.1 and below; 6.0.0; 6.0.1; 7.0.0.

The tibbr web server components of tibbr Community and tibbr Enterprise contain SAML protocol handling errors which may allow authorized users to impersonate other users and escalate their access privileges.

Version 9.32 of Micro Focus Project and Portfolio Management Center contains a Cross-Site Request Forgery (CSRF) vulnerability. An attacker could exploit this flaw to carry out a CSRF attack.

Man-In-The-Middle vulnerability in Micro Focus Project and Portfolio Management Center, version 9.32, allows for a Man-in-the-middle attack.

wolfSSL versions prior to 3.12.2 provide a weak Bleichenbacher oracle when any TLS cipher suite using RSA key exchange is negotiated. An attacker can recover the private key from a vulnerable wolfSSL application.

BouncyCastle TLS prior to version 1.0.3, when configured to use JCE, provides a weak Bleichenbacher oracle when any TLS cipher suite using RSA key exchange is negotiated. An attacker can recover the private key from a vulnerable application.

An issue was discovered in Xen through 4.9.x allowing PV guest OS users to cause a denial of service (host OS crash) or gain host OS privileges in shadow mode by mapping a certain auxiliary page.

An issue was discovered in Xen through 4.9.x allowing guest OS users to cause a denial of service (host OS crash) or gain host OS privileges by leveraging incorrect error handling for reference counting in shadow mode.

An issue was discovered in Xen through 4.9.x allowing guest OS users to cause a denial of service (host OS crash) or gain host OS privileges. The issue arises from an incorrect mask for reference-count overflow checking in shadow mode.

Microsoft SharePoint Enterprise Server 2016 contains an elevation of privilege vulnerability due to improper handling of web requests.

Microsoft Office 2016 Click-to-Run (C2R) contains a vulnerability allowing remote code execution due to the way files are handled in memory, known as 'Microsoft Excel Remote Code Execution Vulnerability'.

The vulnerability in Microsoft Exchange Server 2016 CU5 allows spoofing due to improper validation of web requests by Outlook Web Access (OWA).

The vulnerability in ChakraCore and Internet Explorer allows an attacker to execute arbitrary code in the context of the current user due to improper handling of objects in memory by the scripting engine.

ChakraCore and Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allow an attacker to gain the same user rights as the current user, due to how the scripting engine handles objects in memory, known as 'Scripting Engine Memory Corruption Vulnerability'.

ChakraCore allows an attacker to execute arbitrary code in the context of the current user, due to how the ChakraCore scripting engine handles objects in memory, known as 'Scripting Engine Memory Corruption Vulnerability'.

ChakraCore and Microsoft Edge in Windows 10 (1511, 1607, 1703, 1709) and Windows Server 2016 have a vulnerability that allows an attacker to gain the same user rights as the current user due to how the scripting engine handles objects in memory.