CVE Vulnerability Catalog

The ResourceLinkFactory implementation in Apache Tomcat versions 9.0.0.M1 to 9.0.0.M9, 8.5.0 to 8.5.4, 8.0.0.RC1 to 8.0.36, 7.0.0 to 7.0.70, and 6.0.0 to 6.0.45 did not limit web application access to global JNDI resources to those resources explicitly linked to the web application. Therefore, it was possible for a web application to access any global JNDI resource whether an explicit ResourceLink had been configured or not.

CVE-2017-3130 is an information disclosure vulnerability in Fortinet FortiOS 5.6.0, 5.4.4 and below, allowing an attacker to obtain FortiOS version information by inspecting IKE VendorID packets.

Microsoft Edge allows a remote code execution vulnerability due to the way it accesses objects in memory, known as 'Scripting Engine Memory Corruption Vulnerability'.

The OAuth2 Hawk and JOSE MAC Validation code in Apache CXF prior to 3.0.13 and 3.1.x prior to 3.1.10 is not using a constant time MAC signature comparison algorithm which may be exploited by sophisticated timing attacks.

The elf_read_notes function in bfd/elf.c in GNU Binutils 2.29 allows remote attackers to cause a denial of service (buffer overflow and application crash) or possibly have unspecified other impact via a crafted binary file.

The JAX-RS module in Apache CXF prior to 3.0.12 and 3.1.x prior to 3.1.9 provides several Atom JAX-RS MessageBodyReaders. These readers use the Apache Abdera Parser, which expands XML entities by default, representing a significant XXE risk.

IBM Sterling B2B Integrator version 5.2 is vulnerable to an XML External Entity Injection (XXE) attack when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume memory resources.

IBM Sterling B2B Integrator Standard Edition 5.2 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database.

Multiple buffer overflows in QEMU before 1.7.2 and 2.x before 2.0.0 allow local users to cause a denial of service (crash) or possibly execute arbitrary code via a large L1 table in the qcow2_snapshot_load_tmp in the QCOW 2 block driver or various parameters in the DMG block driver.

Multiple integer overflows in QEMU, before version 2.0.0, allow local users to cause a denial of service (crash) by providing crafted input, leading to buffer overflows and memory corruption.

An unquoted service path vulnerability was identified in the driver for the ThinkPad Compact USB Keyboard with TrackPoint versions earlier than 1.5.5.0. This could allow an attacker with local privileges to execute code with administrative privileges.

In some situations and configurations of Apache Storm 1.x before 1.0.4 and 1.1.x before 1.1.1, the owner of a topology can trick the supervisor into launching a worker as a different, non-root user.

A vulnerability has been identified in the implementation of the Open Shortest Path First (OSPF) routing protocol used on some Lenovo switches. Exploitation of these implementation flaws may allow attackers to erase or alter the routing tables of one or many routers, switches, or other devices that support OSPF within a routing domain.

In extplorer versions 2.1.9 and prior, there is a command injection vulnerability in the transfer function from another server, allowing an attacker to inject commands via the userfile[0] parameter.

An elevation of privilege vulnerability in the Upstream Linux file system. It affects Android kernels.

CVE-2017-0749 is a privilege escalation vulnerability in the Linux kernel used in Android. It affects the Android kernel versions.

CVE-2017-0747 describes an elevation of privilege vulnerability in Qualcomm proprietary components affecting the Android kernel.

CVE-2017-0746 is a privilege escalation vulnerability in the Qualcomm ipa driver affecting the Android kernel.

CVE-2017-0745 is a remote code execution vulnerability in the Android media framework, specifically in the AVC decoder. It affects Android versions from 4.4.4 to 7.1.2.

CVE-2017-0742 is a privilege escalation vulnerability in the MediaTek video driver affecting the Android kernel.