CVE Vulnerability Catalog

The kernel driver DLMFENC.sys, bundled with the DESLock+ client application version 4.8.16 and earlier, contains a locally exploitable heap-based buffer overflow in the handling of an IOCTL message of type 0x0FA4204. The vulnerability arises from the kernel driver failing to allocate sufficient memory on the kernel heap for a user-supplied string, leading to an overflow condition in a fixed-size buffer (0x1000 bytes).

Information disclosure vulnerability in Netatmo Indoor Module firmware 100 and earlier.

Kgb-bot version 1.33-2 allows remote attackers to cause a denial of service (crash).

FreeIPA uses a default password policy that locks an account after 5 unsuccessful authentication attempts. This allows remote attackers to cause a denial of service by locking out the account in which system services run on.

The vulnerability in bash 4.3 allows remote authenticated users to execute arbitrary code by injecting shell metacharacters into the hostname, which are expanded when processing the '\h' sequence in the prompt string.

There is a directory traversal vulnerability in ES File Explorer 3.2.4.1 that may allow attackers to access files outside of intended locations.

There is an HTTP header injection vulnerability in the httpd package in fli4l before version 3.10.1 and 4.0 before January 30, 2015.

The httpd package in fli4l before version 3.10.1 and 4.0 before January 30, 2015, allows remote attackers to execute arbitrary code.

Directory traversal vulnerability in unshield 1.0-1 allows attackers to access system files.

Directory traversal vulnerability in ppmd 10.1-5 allows attackers to access files outside of permitted directories.

Multiple directory traversal vulnerabilities in ha 0.999p+dfsg-5 may allow attackers to access unauthorized system files.

CVE-2015-0974 in ZTE Datacard MF19 0V1.0.0B04 has an untrusted search path vulnerability that allows local users to gain privileges by modifying the 'Ucell Internet' directory to reference a malicious mms_dll_r.dll or mediaplayerdll.dll.

libhtp version 0.5.15 allows remote attackers to cause a denial of service via NULL pointer dereference.

There is a stack-based buffer overflow in IBM V5R4 and IBM i Access for Windows versions 6.1 and 7.1.

Emacs 24.4 allows remote attackers to bypass security restrictions.

CVE-2014-9312 is a vulnerability related to unrestricted file upload in Photo Gallery version 1.2.5. This allows attackers to upload malicious files to the server.

CVE-2014-8900 describes a Cross-site request forgery (CSRF) vulnerability in IBM UrbanCode Release versions 6.0.1.6 and earlier, 6.1.0.7 and earlier, and 6.1.1.1 and earlier.

A directory traversal vulnerability in the hybris Commerce software allows attackers to access system files, potentially leading to the disclosure of sensitive information.

Directory traversal vulnerability in ServiceDesk Plus and Plus MSP versions 5 through 9.0, AssetExplorer versions 4 to 6.1, SupportCenter versions 5 to 7.9, and IT360 versions 8 to 10.4 allows remote authenticated users to execute arbitrary code.

CVE-2014-5301 describes a directory traversal vulnerability in ServiceDesk Plus MSP, AssetExplorer, SupportCenter, and IT360 applications. It affects versions from v5 to v9.0 v9030 for ServiceDesk Plus MSP, from v4 to v6.1 for AssetExplorer, from v5 to v7.9 for SupportCenter, and from v8 to v10.4 for IT360.