CVE Vulnerability Catalog

Irssi before 1.0.5 may incorrectly fail to remove destroyed channels from the query list while waiting for channel synchronization, leading to use-after-free conditions when updating the state later on.

XnView Classic version 2.43 for Windows allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .dll file that is mishandled during an attempt to render the DLL icon.

XnView Classic version 2.43 for Windows allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .dll file that is mishandled during an attempt to render the DLL icon.

XnView Classic version 2.43 for Windows allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .dll file that is mishandled during an attempt to render the DLL icon.

In phpMyFAQ before version 2.9.9, there is a Cross-Site Request Forgery (CSRF) vulnerability that allows modification of a glossary.

In phpMyFAQ before version 2.9.9, there is a Cross-Site Request Forgery (CSRF) vulnerability in admin/stat.main.php.

In phpMyFAQ before version 2.9.9, there is a Cross-Site Request Forgery (CSRF) vulnerability in admin/ajax.attachment.php and admin/att.main.php.

In phpMyFAQ before version 2.9.9, there is a Cross-Site Request Forgery (CSRF) vulnerability in admin/news.php.

In phpMyFAQ before version 2.9.9, there is a Cross-Site Request Forgery (CSRF) vulnerability in admin/stat.adminlog.php.

In phpMyFAQ before version 2.9.9, there is a Cross-Site Request Forgery (CSRF) vulnerability in admin/stat.ratings.php.

In phpMyFAQ before version 2.9.9, there is a Cross-Site Request Forgery (CSRF) vulnerability allowing the addition of glossary terms.

The Switch Configuration Tools Backend (clcmd_server) in Cumulus Linux 2.5.3 and earlier allows local users to execute arbitrary commands via shell metacharacters in a cl-rctl command label.

A double free vulnerability in the SLPDKnownDAAdd function in OpenSLP 1.2.1 allows remote attackers to cause a denial of service (crash) via a crafted package.

The VIP.com application for iOS and Android allows remote attackers to obtain sensitive information and hijack the authentication of users via a rogue access point and a man-in-the-middle attack.

apt-listbugs before 0.1.10 creates temporary files insecurely, which allows attackers to have unspecified impact via unknown vectors.

The iControl REST service in F5 BIG-IP LTM, AAM, AFM, Analytics, APM, ASM, DNS, Link Controller, PEM, and WebSafe versions 12.0.0 through 12.1.2 and 13.0.0 improperly re-validates BIGIPAuthCookie cookies when converting them to X-F5-Auth-Token tokens. This allows expired cookies to be converted into valid tokens.

In F5 BIG-IP PEM versions 12.1.0 through 12.1.2, when downloading the Type Allocation Code (TAC) database file via HTTPS, the server's certificate is not verified. This may allow attackers to perform a man-in-the-middle attack.

The embedded JMX server in Apache James is exposed to a Java deserialization issue, allowing for the execution of arbitrary commands. Since James exposes the JMX socket only on localhost by default, this vulnerability can only be used for privilege escalation.

SQL injection vulnerability in Panasonic KX-HJB1000 Home unit devices with firmware GHX1YG 14.50 or HJB1000_4.47 allows authenticated attackers to execute arbitrary SQL commands via unspecified vectors.