CVE Vulnerability Catalog

CVE-2017-12970 in Apache2Triad 1.5.4 has a cross-site request forgery (CSRF) vulnerability that allows remote attackers to hijack the authentication of authenticated users. Attackers can send requests that add or delete user accounts via phpsftpd/users.php.

Multiple untrusted search path vulnerabilities in installer in Synology Photo Station Uploader before 1.4.2-084 on Windows allow local attackers to execute arbitrary code and conduct DLL hijacking attack via a Trojan horse.

Newsbeuter versions 0.7 through 2.9 have an improper neutralization of special elements used in OS commands in the bookmarking function. This allows remote attackers to perform user-assisted code execution by crafting an RSS item that includes shell code in its title and/or URL.

The XML-RPC server in supervisor before 3.0.1, and in versions 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated users to execute arbitrary commands via a crafted XML-RPC request, related to nested supervisord namespace lookups.

In ImageMagick before version 6.9.8-5 and 7.x before version 7.0.5-6, there is a memory leak in the ReadMATImage function in coders/mat.c.

In ImageMagick before 6.9.7-6 and 7.x before 7.0.4-6, the ReadMATImage function in coders/mat.c uses uninitialized data, which might allow remote attackers to obtain sensitive information from process memory.

mcmnm in BMC Patrol allows local users to gain privileges via a crafted libmcmclnx.so file in the current working directory, because it is setuid root and the RPATH variable begins with the .: substring.

Integer overflow in the wrestool program in icoutils before version 0.31.1 allows remote attackers to cause a denial of service (memory corruption) via a crafted executable, leading to application crash or the possibility of executing arbitrary code.

CVE-2015-5258 describes a cross-site request forgery (CSRF) vulnerability in springframework-social before version 1.1.3.

Fortinet FortiManager versions 5.0 before 5.0.11 and 5.2 before 5.2.2 allow local users to gain privileges via crafted CLI commands.

dnsdist version 1.1.0 is vulnerable to a flaw in authentication mechanism for REST API potentially allowing CSRF attack.

In CAPI-release versions after v1.6.0 and prior to v1.38.0 and cf-release versions after v244 and prior to v270, there is an incomplete fix for CVE-2017-8035. A carefully crafted CAPI request from a Space Developer can allow access to files on the Cloud Controller VM.

Symantec VIP Access for Desktop prior to version 2.2.4 is susceptible to a DLL Pre-Loading vulnerability. This vulnerability allows an attacker to inject a malicious DLL, potentially leading to unauthorized code execution within the application's context.

CVE-2017-7423 describes a Cross-Site Request Forgery (CWE-352) vulnerability in esfadmingui in Micro Focus Enterprise Developer and Enterprise Server, allowing remote unauthenticated attackers to forge requests. This can lead to the creation of new privileged credentials and privilege elevation (CWE-275).

CVE-2017-5187 describes a Cross-Site Request Forgery (CWE-352) vulnerability in the Directory Server web UI in Micro Focus Enterprise Developer and Enterprise Server versions 2.3 and earlier. This allows remote unauthenticated attackers to view and alter configuration information and inject OS commands.

A heap-based buffer overflow in the ReadSFWImage function in coders/sfw.c in ImageMagick 7.0.6-8 can be exploited by remote attackers. This may lead to application crashes or other unspecified impacts via a crafted file.

In version 3.6 of Youngzsoft CCFile (also known as CC File Transfer), it is possible to remotely crash the application by sending a crafted HTTP request. No user authentication is required.

The 'Photo Gallery by WD - Responsive Photo Gallery' plugin for WordPress before version 1.3.51 has a SQL injection vulnerability related to the bwg_edit_tag() function in photo-gallery.php and edit_tag() in admin/controllers/BWGControllerTags_bwg.php. This vulnerability can be exploited by administrators via the tag_id parameter.

git-annex before 6.20170818 allows remote attackers to execute arbitrary commands via an ssh URL with an initial dash character in the hostname.

Nimbus JOSE+JWT before 4.36 does not verify that the public x and y coordinates of the EC key are on the specified curve, allowing attackers to conduct an Invalid Curve Attack.