CVE Vulnerability Catalog

The IRET Handler in the kernel in FreeBSD 9.3 and 10.1 allows local users to gain privileges or cause a denial of service (kernel panic).

The niconico App for iOS before version 6.38 does not verify SSL certificates, which could allow remote attackers to execute man-in-the-middle attacks.

Rakuten card App for iOS versions 5.2.0 through 5.2.4 does not verify SSL certificates, which might allow remote attackers to execute man-in-the-middle attacks.

There is a directory traversal vulnerability in Accellion File Transfer Appliance devices before version FTA_9_11_210. Remote attackers can read arbitrary files by exploiting the .. (dot dot) sequence in the statecode cookie.

Trapeze TransitMaster is vulnerable to information disclosure (emails / hashed passwords) via a modified userID field in JSON data to ManageSubscriber.aspx/GetSubscriber.

Two four-letter commands 'wchp/wchc' are CPU intensive and can cause a spike in CPU utilization on the Apache ZooKeeper server if abused, leading to the server being unable to serve legitimate client requests.

In Asterisk 11.x before 11.25.3, 13.x before 13.17.2, and 14.x before 14.6.2, insufficient RTCP packet validation could allow reading stale buffer contents. When combined with the 'nat' and 'symmetric_rtp' options, this could allow redirecting where Asterisk sends the next RTCP report.

In X.Org Server (aka xserver and xorg-server) before 1.19.4, a local attacker authenticated to the X server could overflow a global buffer, causing crashes of the X server or potentially other problems by injecting large or malformed XKB related atoms and accessing them via xkbcomp.

Huawei FusionServer rack servers RH2288 V3, RH2288H V3, XH628 V3, RH1288 V3, RH2288A V2, RH1288A V2, RH8100 V3, CH222 V3, CH220 V3, and CH121 V3 with software before specified versions allow remote authenticated operators to change server information due to failure to verify user permissions.

InFocus Mondopad version 2.2.08 is vulnerable to authentication bypass when accessing uploaded files by entering Control-Alt-Delete, and then using Task Manager to reach a file.

The WP EasyCart plugin versions 1.1.30 through 3.0.20 contain a vulnerability that allows remote attackers to gain administrator privileges and execute arbitrary code via the option_name and option_value parameters.

Multiple cross-site request forgery (CSRF) vulnerabilities in Issuetracker phpBugTracker before version 1.7.0 allow remote attackers to hijack the authentication of users for requests that cause an unspecified impact via unknown parameters.

Multiple cross-site request forgery (CSRF) vulnerabilities in phpBugTracker before version 1.7.0 allow remote authenticated users to hijack the authentication of other users in various contexts such as projects, groups, statuses, severities, priorities, operating systems, and databases.

Directory traversal vulnerability in Cybele Software Thinfinity Remote Desktop Workstation 3.0.0.3 allows remote attackers to download arbitrary files via a .. (dot dot) in an unspecified parameter.

The Smush Image Compression and Optimization plugin before version 2.7.6 for WordPress allows directory traversal.

The Bi-directional driver in IDM 4.5 before version 4.0.3.0 could be susceptible to a denial of service attack.

CVE-2017-13068 affects the Helpdesk application in QNAP systems, allowing a remote attacker to perform an SQL injection. The attacker does not require any privileges to obtain information from the application.

Koji version 1.13.0 does not properly validate SCM paths, allowing an attacker to work around blacklisted paths for build submission.

The LDAP Authentication functionality in Foreman might allow remote attackers with knowledge of old passwords to gain access via vectors involving the password lifetime period in Active Directory.

A vulnerability in nanohttp in libcsoap allows remote attackers to cause a denial of service via a crafted Authorization header, leading to a NULL pointer dereference and application crash.