CVE Vulnerability Catalog

An off-by-one error was discovered in opj_tcd_code_block_enc_allocate_data in OpenJPEG 2.2.0, leading to an out-of-bounds write. This may result in remote denial of service or potentially remote code execution.

GoAhead versions 3.4.0 through 3.6.5 have a NULL Pointer Dereference in the websDecodeUrl function in http.c, leading to a crash for a 'POST / HTTP/1.1' request.

HelpDEZk version 1.1.1 allows remote authenticated users to execute arbitrary PHP code by uploading a .php attachment and then requesting it in the helpdezk\app\uploads\helpdezk\attachments\ directory.

In GNOME Evince before version 3.24.1, there is a vulnerability that allows remote attackers to execute arbitrary commands via a .cbt file that is a TAR archive containing a filename beginning with the '--' command-line option substring.

The ReadWEBPImage function in coders/webp.c in ImageMagick 7.0.6-5 has an issue with excessive memory allocation that depends only on a length field in a header.

Zoho ManageEngine Firewall Analyzer version 12200 has an unrestricted File Upload vulnerability in the 'Group Chat' section. Users can upload files with any extensions, allowing for the execution of malicious PHP code on the server.

Unrar 0.0.1 (also known as unrar-free or unrar-gpl) has a directory traversal vulnerability in RAR v2 archives, allowing files to be unpacked into the upper directory.

In the EyesOfNetwork web interface (eonweb) version 5.1-0, the snmpwalk.php module does not properly restrict popen calls, allowing remote attackers to execute arbitrary commands via shell metacharacters in a parameter.

The EyesOfNetwork web interface (eonweb) version 5.1-0 has a vulnerability that improperly restricts exec calls. This allows remote attackers to execute arbitrary commands via shell metacharacters in the host_list parameter to module/tool_all/select_tool.php.

The AT&T U-verse 9.2.2h0d83 firmware for the Arris NVG599 device, when IP Passthrough mode is not used, configures WAN access to a caserver https service with the tech account and an empty password. This allows remote attackers to obtain root privileges by establishing a session on port 49955 and installing new software.

The AT&T U-verse 9.2.2h0d83 firmware for the Arris NVG589 and NVG599 devices, when IP Passthrough mode is not used, configures WAN SSH logins to the remotessh account with the 5SaP9I26 password. This allows remote attackers to access a 'Terminal shell v1.0' service and subsequently obtain unrestricted root privileges.

The AT&T U-verse 9.2.2h0d83 firmware for the Arris NVG589, NVG599, and other unspecified devices, when IP Passthrough mode is not used, configures an sbdc.ha WAN TCP service on port 61001 with the bdctest account and the bdctest password. This allows remote attackers to obtain sensitive information, such as the Wi-Fi password.

In Asterisk 11.x before 11.25.2, 13.x before 13.17.1, and 14.x before 14.6.1, there is a vulnerability that allows unauthorized data disclosure, potentially leading to media takeover in the RTP stack. This issue relates to the 'strictrtp' option, which is enabled by default and can be exploited by an attacker with careful timing.

In the pjsip channel driver (res_pjsip) in Asterisk 13.x before 13.17.1 and 14.x before 14.6.1, a carefully crafted tel URI in a From, To, or Contact header could cause Asterisk to crash.

NetApp OnCommand Unified Manager for Clustered Data ONTAP before version 7.2P1 does not set the secure flag for an unspecified cookie in an HTTPS session, making it easier for remote attackers to capture this cookie by intercepting its transmission within an HTTP session.

The InfoCard module 1.0 for SimpleSAMLphp allows attackers to spoof XML messages by leveraging an incorrect check of return values in signature validation utilities.

NetApp Clustered Data ONTAP 8.3.x before 8.3.2P12 allows remote authenticated users to read data on other Storage Virtual Machines (SVMs) via unspecified vectors.

NetApp Clustered Data ONTAP versions 8.3.x before 8.3.2P12 allow remote authenticated users to execute arbitrary code on the storage controller via unspecified vectors.

HiveManager Classic through 8.1r1 allows arbitrary JSP code execution by modifying a backup archive before a restore, because the restore feature does not validate pathnames within the archive. An authenticated, local attacker - even restricted as a tenant - can add a jsp at a specified directory.

The vulnerability in the Installer for ContentsBridge Utility for Windows 7.4.0 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.