CVE Vulnerability Catalog

CVE-2017-10850 involves an untrusted search path vulnerability in the ART EX driver installers for ApeosPort-VI and DocuCentre-VI devices. The issue affects drivers with code signing timestamps before April 12, 2017.

Untrusted search path vulnerability in Self-extracting document generated by DocuWorks 8.0.7 and earlier allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.

CVE-2017-10848 describes an untrusted search path vulnerability in installers for DocuWorks 8.0.7 and earlier and DocuWorks Viewer Light, allowing an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.

A vulnerability in the Remote Support Tool (Enkaku Support Tool) allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory. This affects all versions distributed through the website until August 10, 2017.

The ReadJNGImage and ReadOneJNGImage functions in GraphicsMagick 1.3.26 do not properly manage image pointers after certain error conditions, allowing remote attackers to conduct use-after-free attacks via a crafted file.

A use-after-free vulnerability in the sofree function in slirp/socket.c in QEMU allows attackers to cause a denial of service (QEMU instance crash) by failing to properly clear ifq_so from pending packets.

Symantec ProxyClient 3.4 for Windows is susceptible to a privilege escalation vulnerability. A malicious local Windows user can, under certain circumstances, exploit this vulnerability to escalate their privileges on the system and execute arbitrary code with LocalSystem privileges.

The multiauth module in SimpleSAMLphp version 1.14.13 and earlier allows remote attackers to bypass authentication context restrictions and use an authentication source defined in config/authsources.php due to improper validation of user input.

MIMEDefang 2.80 and earlier creates a PID file after dropping privileges to a non-root account, which might allow local users to kill arbitrary processes by modifying this PID file before a root script executes a 'kill' command.

phpFileManager version 0.9.8 allows remote attackers to execute arbitrary commands via a crafted URL.

Soplanning 1.32 and earlier generates static links for sharing ICAL calendars with embedded login information, allowing remote attackers to obtain a calendar owner's password via a brute-force attack on the embedded password hash.

An XXE issue was discovered in Automated Logic Corporation (ALC) Liebert SiteScan Web Version 6.5 and prior, ALC WebCTRL Version 6.5 and prior, and Carrier i-Vu Version 6.5 and prior. An attacker could enter malicious input to WebCTRL, i-Vu, or SiteScan Web through a weakly configured XML parser causing the application to execute arbitrary code or disclose file contents from a server or connected network.

RubyGems version 2.6.12 and earlier is vulnerable to a DNS hijacking vulnerability that allows a MITM attacker to force the RubyGems client to download and install gems from a server that the attacker controls.

RubyGems versions 2.6.12 and earlier fail to validate specification names, allowing a maliciously crafted gem to potentially overwrite any file on the filesystem.

RubyGems versions 2.6.12 and earlier are vulnerable to maliciously crafted gem specifications that can lead to a denial of service attack against RubyGems clients who have issued a `query` command.

CVE-2016-10509 is an SQL injection vulnerability in the updateAmazonOrderTracking function in upload/admin/model/openbay/amazon.php in OpenCart before version 2.3.0.0. It allows remote authenticated administrators to execute arbitrary SQL commands via a carrier (aka courier_id) parameter to openbay.php.

Async Http Client before 2.0.35 can be tricked into connecting to a host different from the one extracted by java.net.URI if a '?' character occurs in a fragment identifier.

Multiple untrusted search path vulnerabilities in the installer in Synology Cloud Station Drive before version 4.2.5-4396 on Windows allow local attackers to execute arbitrary code and conduct DLL hijacking attacks via malicious files.

In BlackCat CMS version 1.2, the backend/addons/install.php file allows remote authenticated users to execute arbitrary PHP code via a ZIP archive containing a .php file.

BlackCat CMS version 1.2 allows remote authenticated users to inject arbitrary PHP code into info.php via a crafted new_modulename parameter to backend/addons/ajax_create.php. This can also be exploited via CSRF.