CVE Vulnerability Catalog

The *_get_synthetic_symtab functions in the Binary File Descriptor (BFD) library in GNU Binutils 2.29 interpret a -1 value as a sorting count instead of an error flag. This can lead to denial of service (integer overflow and application crash) when processing a crafted ELF file.

Salt-api in SaltStack before version 2015.8.13, 2016.3.x before 2016.3.5, and 2016.11.x before 2016.11.2 allows arbitrary command execution on a salt-master via Salt's ssh_client.

In SaltStack Salt versions before 2015.8.13, 2016.3.x before 2016.3.5, and 2016.11.x before 2016.11.2, the local_batch client from salt-api does not respect external authentication, allowing all authentication to be bypassed.

Multiple unrestricted file upload vulnerabilities in the imageSubmit and proof_submit functions in Claydip Laravel Airbnb Clone 1.0 allow remote authenticated users to execute arbitrary code by uploading a file with an executable extension.

A vulnerability has been identified in the management interface of Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway in versions before specified builds, which could allow an attacker to gain administrative access to the appliance.

CSRF vulnerability in ZKTeco ZKTime Web 2.0.1.12280 allows remote authenticated users to hijack the authentication of administrators for requests that add administrators due to lack of anti-CSRF tokens.

Faleemi FSC-880 devices version 00.01.01.0048P2 allow unauthenticated SQL injection via the Username element in an XML document to /onvif/device_service, allowing for the reading of the admin password.

The prepare_vmcs02 function in the Linux kernel up to version 4.13.3 does not ensure that the 'CR8-load exiting' and 'CR8-store exiting' controls exist when L1 omits the 'use TPR shadow' control, allowing KVM L2 guest OS users to gain read and write access to the hardware CR8 register.

The AcquireResampleFilterThreadSet function in ImageMagick 7.0.7-4 mishandles failed memory allocation, which can lead to denial of service via NULL Pointer Dereference in DistortImage.

An OS command injection vulnerability was identified in Digium Asterisk GUI 2.1.0 and prior due to improper neutralization of special elements. An attacker may exploit this vulnerability to execute arbitrary code on the system by including OS commands in the program's URL request.

Schneider Electric's ClearSCADA versions released prior to August 2017 are susceptible to a memory allocation vulnerability, whereby malformed requests can be sent to ClearSCADA client applications to cause unexpected behavior. Affected client applications include ViewX and the Server Icon.

CVE-2017-9961 is a vulnerability in Schneider Electric's Pro-Face GP Pro EX version 4.07.000 that allows an attacker to execute arbitrary code. This requires access to the computer and the placement of a specific DLL/OCX file.

An improper access control vulnerability exists in Schneider Electric's U.motion Builder software versions 1.2.1 and prior, allowing improper handling of the system configuration. This can enable an attacker to execute arbitrary code under the context of root.

An authentication bypass vulnerability exists in Schneider Electric's U.motion Builder software versions 1.2.1 and prior, where the system contains a hard-coded valid session. An attacker can use that session ID as part of the HTTP cookie of a web request.

A cross-site request forgery (CSRF) vulnerability exists in the Secure Gateway component of PowerSCADA Anywhere v1.0 affecting multiple state-changing requests. The attack requires a legitimate user to click on a malicious link or site.

In ovirt-node 3.0.0-474-gb852fd7, the ovirt_safe_delete_config function does not properly quote input strings, allowing remote authenticated users and physically proximate attackers to execute arbitrary commands via a semicolon in an input string.

The D-Bus security policy files in fso-gsmd, fso-frameworkd, and fso-usaged do not properly filter D-Bus message paths, which may allow local users to cause a denial of service or execute arbitrary code as root.

WiFiMonitor in Android 4.4.4 and earlier versions improperly handles exceptions, allowing remote attackers to cause a denial of service (reboot) via a crafted 802.11 probe response frame.

The build_msps function in libbpg.c in libbpg 0.9.7 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted BPG file, related to hevc_decode_init1.

A vulnerability in the Qualcomm networking driver in Android allows remote attackers to execute arbitrary code via a crafted application compromising a privileged process.