CVE Vulnerability Catalog

TP-Link TL-WVR, TL-WAR, TL-ER, and TL-R devices allow remote authenticated users to execute arbitrary commands via shell metacharacters in the iface field of an admin/diagnostic command to cgi-bin/luci, related to the zone_get_effect_devices function in /usr/lib/lua/luci/controller/admin/diagnostic.lua in uhttpd.

The InLinks plugin version up to 1.1 for WordPress has an SQL injection vulnerability that allows authenticated users to execute arbitrary SQL commands via the 'keyword' parameter.

In version 0.35.0 of cf-deployment in Cloud Foundry Foundation, a misconfiguration with Loggregator and syslog-drain causes logs to be drained to unintended locations.

Bazaar through 2.7.0, when Subprocess SSH is used, allows remote attackers to execute arbitrary commands via a bzr+ssh URL with an initial dash character in the hostname.

A vulnerability in TG Soft Vir.IT eXplorer Lite 8.5.42 allows local users to cause a denial of service (NULL pointer dereference) or possibly have unspecified other impact via a NULL value in a 0x82730008 DeviceIoControl request to \\.\Viragtlt.

The receive_msg function in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to cause a denial of service via infinite loop and stack exhaustion using BDAT commands and an improper check for a '.' character signifying the end of the content.

October CMS through 1.0.428 does not prevent the use of .htaccess in themes, allowing remote authenticated users to execute arbitrary PHP code by downloading a theme ZIP archive from /backend/cms/themes, and then uploading and importing a modified archive with two new files: a .php file and a .htaccess file.

The XFRM dump policy implementation in the Linux kernel before version 4.13.11 allows local users to gain privileges or cause a denial of service (use-after-free) via a crafted SO_RCVBUF setsockopt system call in conjunction with XFRM_MSG_GETPOLICY Netlink messages.

A global buffer overflow in OptiPNG 0.7.6 allows remote attackers to cause a denial-of-service attack or other unspecified impact using a maliciously crafted GIF format file. The issue is related to an uncontrolled loop in the LZWReadByte function of the gifread.c file.

In Icinga 2.x through 2.8.1, the etc/initsystem/prepare-dirs script has a chown call for a filename in a user-writable directory. This allows local users to gain privileges by leveraging access to the $ICINGA2_USER account for the creation of a link.

In auth_login.php in Cacti before 1.0.0, remote authenticated users can bypass intended access restrictions by logging in as a user not in the Cacti database, because the guest user is not considered.

The parser.c file in libxml2 before version 2.9.5 does not prevent infinite recursion in parameter entities.

An issue was discovered on MOXA EDS-G512E 5.1 build 16072215 devices regarding the password encryption method. This method can be retrieved from the firmware as the chall value is sent in cleartext as a POST parameter.

An issue was discovered on MOXA EDS-G512E 5.1 build 16072215 devices, allowing an attacker to extract public and private keys from the firmware image available on the MOXA website. These keys could be used against a production switch that has the default keys embedded.

The scp_v0s_accept function in the session manager of xrdp up to version 0.9.4 uses an untrusted integer as a write length, which can lead to buffer overflow and application crash.

Versions of rpm before 4.13.0.2 use temporary files with predictable names when installing an RPM. An attacker with the ability to write in a directory where files will be installed could create symbolic links to an arbitrary location, potentially modifying content and permissions of arbitrary files.

In ncurses 6.0, a stack-based buffer overflow was found in the _nc_write_entry function of tinfo/write_entry.c. Attackers can cause a denial of service or possibly execute arbitrary code via a crafted terminfo file, as demonstrated by tic.

The driver of honor 5C and honor 6X Huawei smartphones with software versions earlier than NEM-AL10C00B356 and Berlin-L21HNC432B360 has a buffer overflow vulnerability due to lack of parameter validation. An attacker can trick a user into installing a malicious app that has root privileges of the Android system.

The driver of honor 5C and honor 6x Huawei smartphones has a buffer overflow vulnerability due to lack of parameter validation. An attacker can trick a user into installing a malicious app with root privileges of the Android system, potentially leading to system reboot or arbitrary code execution.

The driver of honor 5C and honor 6X Huawei smartphones with software versions earlier than NEM-AL10C00B356 and Berlin-L21HNC432B360 has a buffer overflow vulnerability due to lack of parameter validation. An attacker can trick a user into installing a malicious APP with root privileges of the Android system, which can lead to system reboot or arbitrary code execution.