CVE Vulnerability Catalog

There exists an unauthenticated SEH based Buffer Overflow vulnerability in the HTTP server of Flexense SyncBreeze Enterprise v10.1.16. When sending a GET request with an excessive length, it is possible for a malicious user to overwrite the SEH record and execute a payload that would run under the Windows SYSTEM account.

In Tor before version 0.2.5.16 and in versions 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before 0.3.0.13, and 0.3.1 before 0.3.1.9, there is a use-after-free vulnerability in onion service v2 during intro-point expiration due to mismanagement of the expiring list in certain error cases.

In Tor before version 0.2.5.16 and in versions 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before 0.3.0.13, and 0.3.1 before 0.3.1.9, an attacker can cause a denial of service (application hang) via crafted PEM input that signifies a public key requiring a password, triggering an attempt by the OpenSSL library to ask the user for the password.

In Tor before version 0.2.5.16 and in versions 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before 0.3.0.13, and 0.3.1 before 0.3.1.9, remote attackers can cause a denial of service via a NULL pointer dereference, leading to application crash.

In Tor before version 0.2.5.16 and in versions 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before 0.3.0.13, and 0.3.1 before 0.3.1.9, the replay-cache protection mechanism is ineffective for v2 onion services. An attacker can send many INTRODUCE2 cells to trigger this issue.

The pal2rgb tool in LibTIFF 4.0.9 has a vulnerability that allows remote attackers to cause application crashes via a crafted TIFF file due to a heap-based buffer overflow.

In wp-admin/user-new.php in WordPress before version 4.9.1, the newbloguser key is set to a string that can be directly derived from the user ID. This allows remote attackers to bypass intended access restrictions by entering this string.

An issue was discovered in chan_skinny.c in Asterisk Open Source versions 13.18.2 and older, 14.7.2 and older, and 15.1.2 and older. Flooding the chan_skinny (SCCP protocol) channel driver with certain requests can cause the Asterisk process to use excessive amounts of virtual memory, eventually causing it to stop processing any requests.

The connoppp.cgi file on ZTE ZXDSL 831CII devices does not require HTTP Basic Authentication, allowing remote attackers to modify the PPPoE configuration or set up a malicious configuration via a GET request.

Helper apps in Arq 5.x before 5.10 for Mac allow local users to gain root privileges via a crafted data packet.

libXcursor before 1.1.15 has various integer overflows that could lead to heap buffer overflows when processing malicious cursors, e.g., with programs like GIMP.

The setpermissions function in the auto-updater in Arq before version 5.9.7 for Mac allows local users to gain root privileges via a symlink attack on the updater binary itself.

The Vibease Wireless Remote Vibrator app for Android and the Vibease Chat app for iOS use cleartext to exchange messages and the PLAIN SASL mechanism to send auth tokens to Vibease servers. This allows remote attackers to obtain user credentials, messages, and other sensitive information by sniffing XMPP traffic.

In iSmartAlarm CubeOne firmware version 2.2.4.8 and earlier, encryption key exposure allows attackers to decrypt log files via an exposed key.

In Apache Qpid Broker-J versions 6.1.0 through 6.1.4 (inclusive), the broker does not properly enforce a maximum frame size in AMQP 1.0 frames. A remote unauthenticated attacker could exploit this to cause the broker to exhaust all available memory and eventually terminate.

Buffer overflow in PTW-WMS1 firmware version 2.000.012 allows remote attackers to conduct denial-of-service attacks via unspecified vectors.

sDNSProxy.exe version 1.1.0.0 and earlier allows remote attackers to cause a denial of service via unspecified vectors.

StreamRelay.NET.exe version 2.14.0.7 and earlier allows remote attackers to cause a denial of service via unspecified vectors.

The Music Center for PC version 1.0.00 has an untrusted search path vulnerability that allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.

Media Go version 3.2.0.191 and earlier has an untrusted search path vulnerability that allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.