CVE Vulnerability Catalog

The default installation of DocuWare Fulltext Search server through 6.11 allows remote users to connect to and download searchable text from the embedded Solr service, bypassing DocuWare's access control features. An attacker can also gain privileges by modifying text.

A stack based buffer overflow vulnerability exists in the xls_getfcell function of libxls 1.3.4. A specially crafted XLS file can cause memory corruption resulting in remote code execution.

An out-of-bounds write vulnerability exists in the read_MSAT function of libxls 1.4. A specially crafted XLS file can cause memory corruption leading to remote code execution.

An out-of-bounds write vulnerability exists in the xls_mergedCells function of libxls 1.4. A specially crafted XLS file can cause memory corruption leading to remote code execution.

An out-of-bounds vulnerability exists in the xls_addCell function of libxls 1.4. A specially crafted XLS file with a formula record can cause memory corruption leading to remote code execution.

An exploitable integer overflow vulnerability exists in the xls_appendSST function of libxls 1.4. A specially crafted XLS file can cause memory corruption resulting in remote code execution.

A vulnerability in the DOC file parser in Apache OpenOffice Writer before version 4.1.4, specifically in the ImportOldFormatStyles function, allows attackers to craft malicious documents that cause application crashes and potentially enable arbitrary code execution.

A vulnerability in OpenOffice's PPT file parser before version 4.1.4, specifically in PPTStyleSheet, allows attackers to craft malicious documents that cause application crashes and memory corruption, potentially leading to arbitrary code execution.

On the Vonage VDV-23 115 home router version 3.2.11-0.9.40, sending a long string of characters in the loginPassword and/or loginUsername field to goform/login causes the router to reboot.

An array index error in the fig2dev program in Xfig 3.2.6a allows remote attackers to cause a denial-of-service attack or information disclosure with a maliciously crafted Fig format file.

A vulnerability in the DOC file parser in OpenOffice Writer before version 4.1.4, specifically in the WW8Fonts Constructor, allows attackers to craft malicious documents that can lead to application crashes and potentially arbitrary code execution.

In the add_match function in libbb/lineedit.c in BusyBox through 1.27.2, the tab autocomplete feature does not sanitize filenames, potentially leading to executing any escape sequences in the terminal.

The Apache OpenOffice installer (versions prior to 4.1.3) for Windows contains a defective operation that allows execution of arbitrary code with elevated privileges. This requires that the location in which the installer is run has been previously poisoned by a file that impersonates a dynamic-link library that the installer depends upon.

In the Laravel framework up to version 5.5.21, remote attackers can obtain sensitive information, such as passwords, via a direct request to the /.env URI. The issue concerns the writeNewEnvironmentFileWith function, which does not restrict the permissions of the .env file.

In Bftpd before version 4.7, there is a memory leak in the file rename function.

Icinga Core through version 1.14.0 initially executes bin/icinga as root but supports configuration options where this file is owned by a non-root account. This allows local users to gain privileges by leveraging access to this non-root account.

Opencast versions 2.3.2 and older are vulnerable to script injections through media and metadata in the player and media module, resulting in arbitrary code execution. This issue is fixed in versions 2.3.3 and 3.0.

The VMware Workstation (12.x before 12.5.8) installer contains a DLL hijacking issue due to improper loading of some DLL files by the application. This issue may allow an attacker to load a DLL file of their choosing, potentially executing arbitrary code.

Snap7 Server version 1.4.1 can be crashed when the ItemCount field of the ReadVar or WriteVar functions of the S7 protocol implementation in Snap7 are provided with unexpected input, resulting in a denial of service attack.

The workstation logging function in Philips IntelliSpace Cardiovascular (ISCV) version 2.3.0 and earlier and Xcelera R4.1L1 and earlier records domain authentication credentials. If accessed, this allows an attacker to use the credentials to access the application or other user entitlements.