CVE Vulnerability Catalog

There is a stack consumption vulnerability in the Parser::advanceToNextToken function in parser.cpp in LibSass 3.4.5. A crafted input may lead to remote denial of service.

There is an illegal address access in the Eval::operator function in eval.cpp in LibSass 3.4.5. A crafted input will lead to a remote denial of service.

There is a stack consumption vulnerability in the lex function in parser.hpp in LibSass version 3.4.5, which can lead to remote denial of service through crafted input.

There is an illegal address access in the extend_alias_table function in localealias.c of Exiv2 0.26. A crafted input will lead to remote denial of service.

The SdpContents::Session::Medium::parse function in reSIProcate 1.10.2 allows remote attackers to cause a denial of service by triggering many media connections, leading to memory consumption.

Directory Traversal exists in ATutor before 2.2.2 via the icon parameter to /mods/_core/courses/users/create_course.php. The attacker can read an arbitrary file by visiting get_course_icon.php?id= after the traversal attack.

Buffer overflow in WG-C10 v3.0.79 and earlier allows an attacker to execute arbitrary commands via unspecified vectors.

WG-C10 v3.0.79 and earlier allows an attacker to execute arbitrary OS commands via unspecified vectors.

The CSRF vulnerability in WMR-433 firmware Ver.1.02 and earlier, WMR-433W firmware Ver.1.40 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.

Cygwin versions 1.7.2 up to and including 1.8.0 are vulnerable to buffer overflow in wcsxfrm/wcsxfrm_l functions, leading to denial-of-service by crashing the process or potential hijack of the process running with administrative privileges triggered by specially crafted input string.

The IBM TRIRIGA Application Platform versions 3.3, 3.4, and 3.5 contain a vulnerability that could allow an authenticated user to execute a report they do not have access to.

Builder tools running in the IBM TRIRIGA Application Platform versions 3.3, 3.4, and 3.5 contain a vulnerability that could allow an authenticated user to execute Builder tool actions they do not have access to.

IBM Security Guardium versions 10.0 and 10.1 process patches, image backups, and other updates without sufficiently verifying the origin and integrity of the code.

The CSRF vulnerability in subsonic 6.1.1 allows remote attackers with knowledge of the target username to hijack user authentication for password changes via a crafted request to userSettings.view.

The panic_gate check in NTP before version 4.2.8p5 is only re-enabled after the first change to the system clock greater than 128 milliseconds. This allows remote attackers to set NTP to an arbitrary time when started with the -g option or to alter the time by up to 900 seconds otherwise by responding to an unspecified number of requests from trusted sources.

The ULOGTOD function in ntp.d in SNTP before version 4.2.7p366 does not properly perform type conversions from a precision value to a double, allowing remote attackers to cause a denial of service (infinite loop) via a crafted NTP packet.

The ntp_openssl.m4 in ntpd in NTP before version 4.2.7p112 has a vulnerability that allows remote attackers to cause a denial of service (segmentation fault) via a crafted statistics or filegen configuration command that is not enabled during compilation.

The log_config_command function in ntp_parser.y in ntpd in NTP before version 4.2.7p42 allows remote attackers to cause a denial of service (ntpd crash) via crafted logconfig commands.

A cross-site scripting (XSS) vulnerability in opac-addbybiblionumber.pl in Koha 3.14.x before 3.14.16, 3.16.x before 3.16.12, and 3.20.x before 3.20.1 allows remote attackers to inject arbitrary web script or HTML via a crafted list name.

Netlock Mokka versions before 2.7.8.1204 are vulnerable to XML signature wrapping attacks. Attackers can exploit an e-akta document with a ds:Object node that has a crafted payload prepended to a valid ds:Object.