CVE Vulnerability Catalog

Panasonic KX-HJB1000 Home unit devices with firmware GHX1YG 14.50 or HJB1000_4.47 allow an attacker to delete arbitrary files in a specific directory via unspecified vectors.

Musl libc before 1.1.17 has a buffer overflow vulnerability that can be exploited via crafted DNS replies. The dns_parse_callback function in network/lookup_name.c does not restrict the number of addresses, allowing an attacker to send an unexpected number of A records in response to an AAAA query.

An Uncontrolled Search Path Element issue was discovered in Progea Movicon Version 11.5.1181 and prior. This vulnerability may allow a remote attacker without privileges to execute arbitrary code in the form of a malicious DLL file.

In the Linux kernel before version 4.13.6, a vulnerability allows local users to gain privileges via crafted system calls. The issue arises from a race condition that leads to mishandling of packet_fanout data structures, resulting in a use-after-free error.

On FiberHome routers, Directory Traversal exists in /cgi-bin/webproc via the getpage parameter in conjunction with a crafted var:page value.

CSRF exists in Webmin 1.850, allowing an attacker to execute arbitrary commands by sending a GET request to at/create_job.cgi with dir=/&cmd= in the URI.

There is an SSRF vulnerability in Webmin 1.850 that allows an attacker to exploit the PATH_INFO parameter to make a GET request to tunnel/link.cgi with an external IP address.

An active network attacker (MiTM) can achieve remote code execution on a machine running IKARUS Anti Virus 2.16.7. The attacker exploits cleartext HTTP updates and CRC32 for file verification.

All versions prior to V2.06.00.00 of ZTE ZXDT22 SF01 are affected by a directory traversal vulnerability that allows remote attackers to read arbitrary files on the system via a full path name after the host address.

The Job Manager plugin before version 0.7.25 allows remote attackers to read arbitrary CV files via a brute force attack to the WordPress upload directory structure, related to an insecure direct object reference.

The TEEOS module in Huawei Mate 7 (Mate7-TL10) smartphones before V100R001CHNC00B126SP03 allows local users with root permissions to gain privileges or cause a denial of service (memory corruption) via a crafted application.

The tzdriver module in Huawei Mate 7 (Mate7-TL10) smartphones before V100R001CHNC00B126SP03 allows local users to gain privileges or cause a denial of service (memory corruption) via an unspecified input.

MediaWiki versions before 1.18.5 and 1.19.x before 1.19.2 allow remote attackers to bypass GlobalBlocking extension IP address blocking and create an account via unspecified vectors.

In Apache NiFi before 0.7.2 and 1.x before 1.1.2 in a cluster environment, if an anonymous user request is replicated to another node, the originating node identity is used rather than the 'anonymous' user.

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of EMC Data Protection Advisor 6.3.0. Authentication is required to exploit this vulnerability.

WordPress through version 4.8.2 uses a weak MD5-based password hashing algorithm, making it easier for attackers to determine cleartext values by leveraging access to the hash values.

Vulnerability in the Solaris Cluster component of Oracle Sun Systems Products Suite (subcomponent: HA for MySQL) allows an unauthenticated attacker with logon to the infrastructure where Solaris Cluster executes to compromise the system. It requires human interaction from a person other than the attacker.

Vulnerability in the Oracle Trade Management component of Oracle E-Business Suite allows an unauthenticated attacker with network access via HTTP to compromise the system. Successful attacks require human interaction from a person other than the attacker and may significantly impact additional products.

A vulnerability in the Oracle Trade Management component of Oracle E-Business Suite allows an unauthenticated attacker with network access via HTTP to compromise the system. It requires human interaction from a person other than the attacker, potentially leading to unauthorized access to critical data.

A vulnerability in the Oracle Trade Management component of Oracle E-Business Suite allows an unauthenticated attacker with network access via HTTP to compromise the system. It requires human interaction from a person other than the attacker, potentially leading to unauthorized access to critical data.