CVE Vulnerability Catalog

Dashlane might allow local users to gain privileges by placing a Trojan horse WINHTTP.dll in the %APPDATA%\Dashlane directory.

In ImageMagick version 7.0.6-1, a memory exhaustion vulnerability was found in the ReadSUNImage function in coders/sun.c, allowing attackers to cause a denial of service.

In ImageMagick version 7.0.6-1, a memory exhaustion vulnerability was found in the ReadMPCImage function in coders/mpc.c, allowing attackers to cause a denial of service.

In ImageMagick 7.0.6-1, a memory exhaustion vulnerability was found in the function ReadMIFFImage in coders/miff.c, which allows attackers to cause a denial of service.

In ImageMagick 7.0.6-1, a memory leak vulnerability was found in the function ReadWMFImage in coders/wmf.c, which allows attackers to cause a denial of service in CloneDrawInfo in draw.c.

An issue was discovered in Varnish HTTP Cache versions 4.0.1 to 4.0.4, 4.1.0 to 4.1.7, 5.0.0, and 5.1.0 to 5.1.2 related to a wrong if statement in the varnishd source code. This bug can lead to an Integer Overflow, causing the varnishd worker process to abort and lose cached content.

ImageMagick version 7.0.6-5 has memory leaks in the parse8BIMW and format8BIM functions in coders/meta.c, related to the WriteImage function in MagickCore/constitute.c.

A proxy command injection vulnerability in Trend Micro InterScan Messaging Virtual Appliance 9.0 and 9.1 allows remote attackers to execute arbitrary code on vulnerable installations. The flaw can be exploited by parsing the 'T' parameter within modTMCSS Proxy.

Proxy command injection vulnerability in Trend Micro InterScan Messaging Virtual Appliance 9.0 and 9.1 allows remote attackers to execute arbitrary code on vulnerable installations. The specific flaw can be exploited by parsing the 't' parameter within modTMCSS Proxy.

Denial of Service vulnerability in Trend Micro Deep Discovery Email Inspector 2.5.1 allows remote attackers to delete arbitrary files on vulnerable installations, thus disabling the service.

Nitro Pro version 11.0.3.173 allows remote attackers to execute arbitrary code via saveAs and launchURL calls with directory traversal sequences.

CVE-2017-11390 is a vulnerability in XML external entity (XXE) processing in Trend Micro Control Manager 6.0, which could lead to information disclosure if exploited.

Trend Micro Control Manager 6.0 has an SQL Injection vulnerability that can lead to Remote Code Execution. The issue arises from improper validation of user-provided strings before constructing SQL queries in RestfulServiceUtility.NET.dll.

CVE-2017-11387 vulnerability in Trend Micro Control Manager 6.0 allows authentication bypass, leading to information disclosure. The issue occurs when authentication validation is not performed for functionality that changes the debug logging level.

Multiple unquoted service path vulnerabilities in Sierra Wireless Windows Mobile Broadband Driver Package (MBDP) with build ID < 4657 allow local users to launch processes with elevated privileges.

The HashiCorp Vagrant VMware Fusion plugin before version 4.0.21 contains a vulnerability that allows local users to gain root privileges. The issue arises from the failure to verify the path to the encoded Ruby script and the lack of scrubbing of the PATH variable.

qemu-nbd in QEMU does not ignore SIGPIPE, allowing remote attackers to cause a denial of service (daemon crash) by disconnecting during a server-to-client reply attempt.

The vulnerability in F-Secure Online Scanner related to an untrusted search path allows remote attackers to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse DLL located in the same folder as F-SecureOnlineScanner.exe.

A race condition exists in the ioctl implementation in the Samsung Graphics 2D driver, allowing local users to trigger memory errors.

The hp-plugin utility in HP Linux Imaging and Printing (HPLIP) allows man-in-the-middle attackers to execute arbitrary code by leveraging a short GPG key id from a keyserver to verify print plugin downloads.