CVE Vulnerability Catalog

IBM Curam Social Program Management versions 6.0 SP2 before EP26, 6.0.4 before 6.0.4.5iFix10, and 6.0.5 before 6.0.5.6 allows remote authenticated users to load arbitrary Java classes via unspecified vectors.

IBM InfoSphere Information Server versions 9.1, 11.3, and 11.5 could allow a local user to gain elevated privileges by placing arbitrary files in installation directories.

A network layer security vulnerability in InfoSphere Information Server 9.1, 11.3, and 11.5 can lead to privilege escalation or unauthorized access.

IBM WebSphere MQ Internet Pass-Thru versions 2.0 and 2.1 could allow an attacker to cause the MQIPT to stop responding due to an incorrectly configured security policy.

IBM AppScan Enterprise Edition 9.0 contains an unspecified vulnerability that could allow an attacker to hijack a valid user's session.

The vulnerability in LhaForge version 1.6.5 and earlier allows an attacker to gain privileges via a malicious DLL in an unspecified directory.

The vulnerability in NFC Port Software remover version 1.3.0.1 and earlier allows an attacker to gain privileges via a malicious DLL in an unspecified directory.

The NFC Port Software version 5.5.0.6 and earlier, along with other mentioned applications, has an untrusted search path vulnerability. This allows an attacker to gain privileges via a malicious DLL placed in an unspecified directory.

WN-G300R3 firmware version 1.0.2 and earlier uses hardcoded credentials which may allow an attacker that can access the device to execute arbitrary code on the device.

WN-AX1167GR firmware version 3.00 and earlier allows an attacker to execute arbitrary OS commands via unspecified vectors.

WN-AX1167GR firmware version 3.00 and earlier uses hardcoded credentials which may allow an attacker to execute arbitrary code on the device.

The vulnerability in Tween version 1.6.6.0 and earlier involves an untrusted search path, allowing an attacker to gain privileges via a malicious DLL in an unspecified directory.

CSRF vulnerability in CS-Cart Japanese Edition v4.3.10 and earlier (excluding v2 and v3) and CS-Cart Multivendor Japanese Edition v4.3.10 and earlier (excluding v2 and v3) allows remote attackers to hijack the authentication of administrators via unspecified vectors.

The CMS installer in Joomla! before 3.7.4 does not verify a user's ownership of a webspace, which allows remote authenticated users to gain control of the target application by leveraging Certificate Transparency logs.

Microsoft Outlook versions 2007 SP3, 2010 SP2, 2013 SP1, 2013 RT SP1, and 2016 contain a remote code execution vulnerability due to improper parsing of specially crafted email messages.

Microsoft Outlook versions 2007 SP3, 2010 SP2, 2013 SP1, 2013 RT SP1, and 2016 contain a vulnerability that allows a security feature bypass due to the way it handles input.

VMware vCenter Server (6.5 prior to 6.5 U1) contains an insecure library loading issue due to the unsafe use of the LD_LIBRARY_PATH variable. Successful exploitation of this vulnerability may allow unprivileged host users to load a shared library, potentially leading to privilege escalation.

In Trend Micro Deep Discovery Director 1.1, configuration and database backup archives are not signed or validated, which may lead to unauthorized access to data.

An issue was discovered in StashCat, versions up to 1.7.5 for Android, 0.0.80w for Web, and 0.0.86 for Desktop, where the logout mechanism does not check for authorization. An attacker only needs to know the device ID, leading to a denial of service.

An issue exists in heinekingmedia StashCat regarding the generation of encryption keys for messages. The use of AES in CBC mode with a pseudo-random secret generated by math.random() does not provide adequate security.