CVE Vulnerability Catalog

Alcatel-Lucent Home Device Manager before version 4.1.10 and 4.2.x before version 4.2.2 allows remote attackers to spoof and make calls as target devices.

The mod_nss module before 1.0.11 in Fedora allows remote attackers to obtain cipher lists due to incorrect parsing of multi-keyword cipherstring.

In Sandstorm Cap'n Proto versions before 0.4.1.1 and 0.5.x before 0.5.1.2, the totalSize method on an object reader can be exploited by remote peers to cause a denial of service through a crafted small message, leading to high CPU consumption.

Sandstorm Cap'n Proto before 0.4.1.1 and 0.5.x before 0.5.1.1 allows remote peers to cause a denial of service via a list with a large number of elements.

In Novell ZENworks Configuration Management (ZCM), a vulnerability allows remote attackers to read arbitrary folders via the dirname variable.

The Rtrlet class in Novell ZENworks Configuration Management (ZCM) allows remote attackers to obtain Session IDs of logged in users via a value of ShowLogins for the maintenance variable.

CVE-2017-9370 is an information disclosure and elevation of privilege vulnerability in the BlackBerry Workspaces Server. An attacker with legitimate access to BlackBerry Workspaces could gain access to another user's workspace by making multiple login requests to the server.

Lemur version 0.1.4 does not use sufficient entropy in its initialization vector (IV) when encrypting AES in CBC mode, which may weaken data security.

The snapshot API in Elasticsearch before version 1.6.0 is vulnerable when another application exists on the system that can read Lucene files and execute code from them. This allows remote authenticated users to write to and create arbitrary snapshot metadata files, potentially executing arbitrary code.

The ntp-keygen program in versions 4.2.8px before 4.2.8p2-RC2 and 4.3.x before 4.3.12 does not generate MD5 keys with sufficient entropy on big endian machines, which may allow remote attackers to obtain the value of generated MD5 keys via a brute force attack.

Stack buffer overflow in httpd in Asuswrt-Merlin firmware 380.67_0RT-AC5300 and earlier for ASUS devices allows remote attackers to execute arbitrary code on the router by sending a crafted http GET request packet that includes a long delete_offline_client parameter in the url.

The console in Puppet Enterprise 2015.x and 2016.x prior to 2016.4.0 includes unsafe string reads that potentially allows for remote code execution on the console node.

Nessus 6.x before version 6.11 does not verify the manager's TLS certificate when making the initial outgoing connection. This could allow man-in-the-middle attacks.

Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allow an attacker to execute code remotely on a target system when the Windows font library fails to properly handle specially crafted embedded fonts.

Microsoft Edge in Windows 10 version 1703 allows an attacker to execute arbitrary code in the context of the current user due to the way Microsoft browser JavaScript engines render content when handling objects in memory.

Microsoft Edge in Windows 10 (1511, 1607, 1703) and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user due to the way that Microsoft browser JavaScript engines render content, known as 'Scripting Engine Memory Corruption Vulnerability'.

Microsoft Edge in Windows 10 (1511, 1607, 1703) and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user due to a flaw in the browser's JavaScript engine. This issue relates to how the engine renders content when handling objects in memory.

Microsoft Edge in Windows 10 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user due to the way that Microsoft browser JavaScript engines render content.

Microsoft browsers in Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1, Windows RT 8.1, Windows Server 2012 R2, Windows 10, and Windows Server 2016 allow an attacker to execute arbitrary code in the context of the current user due to improper handling of objects in memory while rendering content.