CVE Vulnerability Catalog

SuiteCRM before 7.2.3 allows remote attackers to execute arbitrary code.

Argument injection vulnerability in devscripts before version 2.15.7 allows remote attackers to write to arbitrary files via a crafted symlink and crafted filename.

TelescopeJS before 0.15 leaks user bcrypt password hashes in websocket messages, which might allow remote attackers to obtain password hashes via a cross-site scripting attack.

Heap-based buffer overflow in libaxl 0.6.9 allows attackers to cause a denial of service (memory corruption) or execute arbitrary code via a crafted XML document.

The help window in Epicor CRS Retail Store before version 3.2.03.01.008 allows local users to execute arbitrary code by injecting Javascript into the window source to create a button that spawns a command shell.

Versions of svn-workbench 1.6.2 and earlier on systems with xeyes installed allow local users to execute arbitrary commands by using the 'Command Shell' menu item while in the directory trunk/$(xeyes).

The URI.decode_www_form_component method in Ruby before version 1.9.2-p330 allows remote attackers to cause a denial of service via a crafted string.

A size-validation issue was discovered in opj_j2k_write_sot in OpenJPEG 2.2.0, leading to an out-of-bounds write. This may result in remote denial of service or potentially remote code execution.

IBM QRadar Network Security 5.4 supports interaction between multiple actors who can negotiate which algorithm should be used as a protection mechanism, but it does not select the strongest algorithm available to both parties.

IBM QRadar Network Security 5.4 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or consume memory resources.

IBM Emptoris Strategic Supply Management Platform versions 10.0.0.x through 10.1.1.x is vulnerable to cross-site request forgery, which could allow an attacker to execute malicious and unauthorized actions transmitted from a trusted user.

An exploitable integer overflow vulnerability exists in the tiff_image_parse functionality of Gdk-Pixbuf 2.36.6 when compiled with Clang. A specially crafted tiff file can cause a heap-overflow resulting in remote code execution.

A heap overflow vulnerability exists in the gdk_pixbuf__jpeg_image_load_increment functionality of Gdk-Pixbuf 2.36.6. A specially crafted jpeg file can cause a heap overflow resulting in remote code execution.

An exploitable code execution vulnerability exists in the image rendering functionality of Lexmark Perceptive Document Filters 11.3.0.2400. A specifically crafted PDF can cause a function call on a corrupted DCTStream to occur, resulting in user controlled data being written to the stack.

An exploitable use-after-free exists in the PDF parsing functionality of Lexmark Perspective Document Filters 11.3.0.2400 and 11.4.0.2452. A crafted PDF document can lead to direct code execution.

A use-after-free vulnerability exists in the account parsing component of Ledger-CLI 3.1.1, which can be exploited by a specially crafted ledger file. This can lead to arbitrary code execution.

A buffer overflow vulnerability exists in the tag parsing functionality of Ledger-CLI 3.1.1. A specially crafted journal file can cause an integer underflow resulting in code execution.

A memory corruption vulnerability exists in the RSRC segment parsing functionality of LabVIEW 2014, 2015, 2016, and 2017. A specially crafted Virtual Instrument (VI) file can cause an attacker controlled looping condition resulting in an arbitrary null write.

Scrapy version 1.4 allows remote attackers to cause a denial of service (memory consumption) by sending large files, as an arbitrary number of files are read into memory. This issue is exacerbated when files are then written in a separate thread to a slow storage resource.

A mishandled zero case was discovered in opj_j2k_set_cinema_parameters in OpenJPEG 2.2.0. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service or possibly remote code execution.