CVE Vulnerability Catalog

A malicious DLL preload attack is possible on NwSapSetup and the self-extracting installation program for SAP Plant Connectivity 2.3 and 15.0. The program may load system DLLs like DWMAPI.dll from the folder it resides in instead of from system folders.

In SAP KERNEL 32NUC, 32Unicode, 64NUC, 64Unicode versions 7.21, 7.21EXT, 7.22, 7.22EXT, and from 7.21 to 7.22, 7.45, 7.49, a Trusted RFC connection can be established to a different client or user on the same system, even though no explicit Trusted/Trusting Relation has been defined.

SAP NetWeaver Internet Transaction Server (ITS) and SAP Basis versions from 7.00 to 7.02, 7.30, 7.31, 7.40, and from 7.50 to 7.52 allow an attacker with administrator credentials to inject code that can be executed by the application, thereby controlling its behavior.

In SAP HANA extended application services 1.0, advanced model, there are two potential vulnerabilities related to audit log injection. Missing input validation in certain HTTP/REST endpoints may allow unprivileged attackers to forge audit log lines.

A memory corruption vulnerability exists in the .PSD parsing functionality of ACDSee Ultimate 10.0.0.292. A specially crafted .PSD file can cause an out of bounds write vulnerability resulting in potential code execution.

IBM WebSphere MQ versions 7.5, 8.0, and 9.0 could allow a local user to crash the queue manager agent thread and expose some sensitive information.

IBM Financial Transaction Manager (FTM) versions 3.0.0.0 through 3.0.0.7 are vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, allowing them to view, add, modify, or delete information in the back-end database.

The Linux Kernel 2.6.32 and later are affected by a denial of service. Flooding the diagnostic port 0x80 can trigger an exception leading to a kernel panic.

Huawei USB modems EC156, EC176, and EC177 with software before UTPS-V200R003B015D02SP07C1014 and before V200R003B015D02SP08C1014 have a weak ACL for the 'Mobile Partner' directory. This allows remote attackers to gain SYSTEM privileges by compromising a low privilege account and modifying Mobile Partner.exe.

The Backup and Restore feature in Mobotap Dolphin Browser for Android 12.0.2 suffers from an arbitrary file write vulnerability when attempting to restore browser settings from a malicious Dolphin Browser backup file. This vulnerability allows an attacker to overwrite a specific executable in the Dolphin Browser's data directory.

Palo Alto Networks PAN-OS versions before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.13, and 8.0.x before 8.0.6 allow remote attackers to cause a denial of service via vectors related to the management interface.

The vulnerability in Perspective ICM Investigation & Case 5.1.1.16 allows remote authenticated users to modify access level permissions, potentially leading to unauthorized privilege escalation.

A DLL Hijacking vulnerability in QNAP Qsync for Windows (version 4.2.2.0724 and earlier) could allow remote attackers to execute arbitrary code on Windows machines.

Versions of VASA Provider for Clustered Data ONTAP prior to 7.0P1 contain a web server that accepts plain text authentication. This could allow an unauthenticated attacker to obtain authentication credentials.

Phabricator before 2017-11-10 does not block the --config and --debugger flags to the Mercurial hg program, allowing remote attackers to execute arbitrary code by using the web UI to browse a branch whose name begins with --config= or --debugger=.

lilypond-invoke-editor in LilyPond 2.19.80 does not validate strings before launching the program specified by the BROWSER environment variable, allowing remote attackers to conduct argument-injection attacks via a crafted URL.

In versions before 0.0.11 of sensible-utils, the sensible-browser program does not validate strings before launching the program specified by the BROWSER environment variable. This allows remote attackers to conduct argument-injection attacks via a crafted URL.

In Ivanti Service Desk (formerly LANDESK Management Suite) versions between 2016.3 and 2017.3, an Unrestricted Direct Object Reference allows users to access objects belonging to other users. A normal user can send requests to a specific URI with the target user's username in an HTTP payload to retrieve a key/token and use it to access/update objects belonging to other users.

In HDF5 version 1.10.1, there is an out of bounds write vulnerability in the function H5G__ent_decode_vec in H5Gcache.c in the libhdf5.a library. For example, using h5dump may crash or have unspecified other impacts when opening a crafted hdf5 file.

GraphicsMagick 1.3.26 has a vulnerability in the ReadGRAYImage function in coders/gray.c that allows for a heap-based buffer over-read via a crafted file.