CVE Vulnerability Catalog

Before version 4.8.2, WordPress was vulnerable to a directory traversal attack during unzip operations in the ZipArchive and PclZip components.

Stack-based buffer overflows in CyberLink LabelPrint 2.5 allow remote attackers to execute arbitrary code. The attack can be carried out by manipulating parameters in an lpp project file, such as author, name, artist, or default.

Foxit Reader version 8.3.2.25013 and earlier and Foxit PhantomPDF version 8.3.2.25013 and earlier, when running in single instance mode, allow attackers to execute arbitrary code or cause a denial of service via a crafted .pdf file.

DenyAll WAF before version 6.4.1 allows unauthenticated remote command execution via TCP port 3001 because shell metacharacters can be inserted into the type parameter to the tailDateFile function. An iToken authentication parameter is required but can be obtained by exploiting CVE-2017-14706.

The NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape where a value passed from a user to the driver is not correctly validated and used as the index to an array.

The NVIDIA GPU Display Driver contains a vulnerability in the kernel mode layer handler where a value passed from a user to the driver is not correctly validated and used as the index to an array. This may lead to denial of service or possible escalation of privileges.

The NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape where a pointer passed from a user to the driver is used without validation. This may lead to denial of service or possible escalation of privileges.

The NVIDIA Windows GPU Display Driver contains a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape where a value passed from a user to the driver is not correctly validated and used as the index to an array.

Trend Micro Mobile Security (Enterprise) versions before 9.7 Patch 3 have proxy command injection vulnerabilities that allow remote attackers to execute arbitrary code on vulnerable installations.

Unrestricted file uploads in Trend Micro Mobile Security (Enterprise) versions before 9.7 Patch 3 allow remote attackers to execute arbitrary code on vulnerable installations.

The vulnerability in the web service of Trend Micro Web Security Virtual Appliance 6.5 allows attackers with administrative rights to the console to perform remote code injections through improper inspection of input parameters.

CVE-2017-11395 describes a command injection vulnerability in the administration UI of Trend Micro Smart Protection Server (Standalone) versions 3.1 and 3.2. It allows authenticated attackers to execute arbitrary code on vulnerable installations.

Privilege escalation vulnerability in LXCA versions earlier than 1.3.2 that allows an authenticated user to abuse certain web interface functionality to execute privileged commands within the underlying LXCA operating system.

IrfanView version 4.44 - 32bit allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .djvu file. The issue relates to branch selection control associated with the DJVU!GetPlugInInfo function.

STDU Viewer version 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .jb2 file. The issue is related to a user mode write AV in the DllGetClassObject function.

STDU Viewer version 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .jb2 file.

STDU Viewer version 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .jb2 file. The issue relates to faulting address controls affecting subsequent write addresses.

STDU Viewer version 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .djvu file. The issue relates to the use of data from a faulting address as arguments in subsequent function calls.

STDU Viewer version 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .djvu file, related to a 'Read Access Violation'.

Artifex MuPDF version 1.11 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .xps file. The issue arises from mishandling of XML tag name comparisons.