CVE Vulnerability Catalog

An issue was discovered in Xen through 4.9.x allowing HVM guest OS users to gain privileges on the host OS, obtain sensitive information, or cause a denial of service (BUG and host OS crash) by leveraging the mishandling of Populate on Demand (PoD) Physical-to-Machine (P2M) errors.

In YARD versions before 0.9.11, the lib/yard/core_ext/file.rb does not block relative paths starting with the ../ sequence, allowing attackers to conduct directory traversal attacks and read arbitrary files.

The files function in the administration section in CS-Cart 4.6.2 and earlier allows attackers to execute arbitrary PHP code via vectors involving a custom page.

An issue was discovered in EMC ScaleIO 2.0.1.x related to message parsers (MDM, SDS, and LIA) that could allow an unauthenticated remote attacker to send specially crafted packets. This could lead to stopping ScaleIO services and causing a denial of service situation.

An issue was discovered in EMC ScaleIO 2.0.1.x where one of the support scripts saves the credentials of the MDM user in clear text in temporary log files. These files may be read by an unprivileged user with access to the server where the script was executed.

A CSRF issue exists in the Business Analytics application in Hitachi Vantara Pentaho BA Platform through version 8.0.

Samba before 4.7.3 might allow remote attackers to obtain sensitive information by leveraging failure of the server to clear allocated heap memory.

TeamPass versions before 2.1.27.9 do not properly enforce item access control in items.queries.php. This allows an attacker to copy arbitrary items, edit them in read-only directories, delete items, and access the history and attributes of directories.

An arbitrary file upload vulnerability in TeamPass before version 2.1.27.9 allows remote authenticated users to upload arbitrary files leading to Remote Command Execution.

A vulnerability in libvirtd when configured by OSP director to use TLS transport defaults to the same certificate authority as other services. The lack of additional authentication allows these services to connect to libvirtd, which is equivalent to root access.

A Server Side Request Forgery (SSRF) vulnerability could lead to remote code execution for authenticated administrators. This issue was introduced in version 2.2.0 of Hipchat Server and version 3.0.0 of Hipchat Data Center.

In Zulip Server before 1.7.1, a vulnerability in the invitation system allows an authorized user from one realm on the server to create a user account in any other realm.

A vulnerability in Swagger-Parser's version <= 1.0.30 and Swagger codegen version <= 2.2.2 allows arbitrary code execution when parsing a maliciously crafted yaml Open-API specification. This particularly affects the 'generate' and 'validate' commands in swagger-codegen.

A command injection vulnerability has been identified in the evince application when printing to PDF using a filename. This affects versions earlier than 3.25.91.

In versions of typed-function before 0.10.6, there is a vulnerability allowing arbitrary code execution in the JavaScript engine. Creating a typed function with JavaScript code in the name may lead to unauthorized code execution.

In version 1.1.0 of Credhub-release from Cloud Foundry Foundation, access control lists (ACLs) improperly enforced permissions for the CredHub interpolate endpoint. This allowed authenticated applications to view all credentials within the CredHub installation.

In Pivotal Spring-LDAP versions 1.3.0 - 2.3.1, when connected to some LDAP servers, authentication is allowed with an arbitrary password when the username is correct. This occurs when no additional attributes are bound and using LDAP BindAuthenticator with DefaultTlsDirContextAuthenticationStrategy.

A deserialization vulnerability was discovered in Pivotal Spring Security versions 4.2.0.RELEASE through 4.2.2.RELEASE and 5.0.0.M1, which could lead to arbitrary code execution when default typing in Jackson is enabled. The issue allows the use of unknown 'deserialization gadgets' if certain conditions are met.

TP-Link TL-WVR, TL-WAR, TL-ER, and TL-R devices allow remote authenticated users to execute arbitrary commands via shell metacharacters in the t_bindif field of an admin/interface command to cgi-bin/luci, related to the get_device_byif function in /usr/lib/lua/luci/controller/admin/interface.lua in uhttpd.

TP-Link TL-WVR, TL-WAR, TL-ER, and TL-R devices allow remote authenticated users to execute arbitrary commands via shell metacharacters in the t_bindif field of an admin/bridge command to cgi-bin/luci.