CVE Vulnerability Catalog

A vulnerability in the Cisco Virtual Network Function (VNF) Element Manager allows an authenticated, remote attacker to elevate privileges and run commands in the context of the root user on the server. The issue arises from command settings that permit Cisco VNF Element Manager users to specify arbitrary commands that will run as root.

Hawtio versions up to and including 1.5.3 are vulnerable to a CSRF attack that allows remote attackers to trick the user into visiting their website containing a malicious script. This script can be submitted to the Hawtio server on behalf of the user.

The _WM_ParseNewMidi function in f_midi.c in WildMIDI 0.4.2 can lead to denial of service through invalid memory read and application crash when processing a crafted mid file.

The _WM_SetupMidiEvent function in internal_midi.c in WildMIDI 0.4.2 can lead to denial of service through invalid memory reads and application crashes when processing a crafted MIDI file.

Foxit PDF Compressor installers from versions from 7.0.0.183 to 7.7.2.10 contain a DLL preloading vulnerability, allowing a malicious DLL to be loaded from the current working directory of the installer.

PostgreSQL versions before 9.4.13, 9.5.8 and 9.6.4 are vulnerable to an authorization flaw allowing remote authenticated attackers with no privileges on a large object to overwrite the entire contents of the object, resulting in a denial of service.

PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8, and 9.6.4 are vulnerable to an authorization flaw allowing remote authenticated attackers to retrieve passwords from user mappings defined by foreign server owners without actually having the privileges to do so.

All Qualcomm products with Android for MSM, Firefox OS for MSM, or QRD Android may be vulnerable to a buffer overflow when processing a firmware image file.

In the touch controller function in all Qualcomm products with Android for MSM, Firefox OS for MSM, or QRD Android, a variable may be controlled by the user and can lead to a buffer overflow.

In a sound driver in Android for MSM, Firefox OS for MSM, and QRD Android, there is a vulnerability where some variables are from userspace, allowing values to be chosen that could lead to stack overflow.

In an audio driver function in Qualcomm products with Android for MSM, Firefox OS for MSM, or QRD Android, there is a possibility of integer overflow leading to buffer overflow. Additionally, a missing lower bound check may result in out of bounds memory access.

In an ioctl handler in Qualcomm products with Android for MSM, Firefox OS for MSM, or QRD Android, several sanity checks are missing which can lead to out-of-bounds accesses.

In Qualcomm products with Android for MSM, Firefox OS for MSM, or QRD Android, there is a type casting issue that leads to kernel crashes and device restarts.

In a display driver in all Qualcomm products with Android for MSM, Firefox OS for MSM, or QRD Android, a variable controlled by userspace is used to calculate offsets and sizes for copy operations, which could result in heap overflow.

In an audio driver in all Qualcomm products with Android for MSM, Firefox OS for MSM, or QRD Android, an integer overflow could occur when a function is called with a very large length, leading to a heap buffer overflow.

In a sound driver in all Qualcomm products with Android for MSM, Firefox OS for MSM, or QRD Android, calling a function with a very large length may lead to an integer overflow followed by a buffer overflow.

In an audio driver in Qualcomm products with Android releases from CAF, there is a validation issue with length values. When a sanity check encounters a length value out of the correct range, an error message is printed, but code execution continues as if the length value were correct.

The Xamarin.iOS update component on macOS systems allows an attacker to run arbitrary code as root, known as 'Xamarin.iOS Elevation Of Privilege Vulnerability.'

In the OpenCV library, the ReadNumber function did not check the input length, leading to integer overflow. If the image is remote, this may lead to remote code execution or denial of service.

In the OpenCV library, the PxMDecoder::readData function has an integer overflow when calculating src_pitch. This may lead to remote code execution or denial of service if the image is from a remote source.