CVE Vulnerability Catalog

The acpi_ns_terminate() function in the Linux kernel before version 4.12 does not flush the operand cache, leading to a kernel stack dump. This allows local users to obtain sensitive information from kernel memory and bypass the KASLR protection mechanism.

The get2post.php file in IDERA Uptime Monitor 7.8 has a directory traversal vulnerability in the file_name parameter.

Integer overflow in the soap_get function in Genivia gSOAP 2.7.x and 2.8.x before 2.8.48, used on Axis cameras and other devices, allows remote attackers to execute arbitrary code or cause a denial of service via a large XML document.

In dotCMS version 4.1.1, there is an arbitrary file upload vulnerability that allows remote authenticated administrators to upload .jsp files to arbitrary locations via directory traversal sequences in the fieldName parameter. This can lead to arbitrary code execution by requesting the .jsp file at an /assets URI.

A SIGFPE error occurs in the box_blur_line function of rsvg-filter.c in GNOME librsvg version 2.40.17 during an attempt to parse a crafted SVG file, due to incorrect protection against division by zero.

IBM InfoSphere Master Data Management Server versions 11.0 - 11.6 stores user credentials in plain text, which can be read by a local user.

IBM Tivoli Endpoint Manager uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.

IBM Tivoli Endpoint Manager is vulnerable to cross-site request forgery which could allow an attacker to execute malicious and unauthorized actions transmitted from a user that the website trusts.

Cross-Site Request Forgery (CSRF) vulnerability in GLPI 0.90.4 allows remote authenticated attackers to submit a request that could lead to the creation of an admin account in the application.

Geneko GWR routers allow directory traversal attacks starting with a /../ substring, enabling unauthenticated access to the configuration file.

In ImageMagick before version 7.0.6-1, there is a vulnerability in coders/jpeg.c that allows remote attackers to cause an application crash (denial of service) or possibly have unspecified other impact via JPEG data that is too short.

In ImageMagick before version 7.0.6-1, the coders/mpc.c file does not enable seekable streams, which prevents validation of blob sizes. This allows remote attackers to cause application crashes or potentially other unspecified impacts via an image received from stdin.

The Google News and Weather application before version 3.3.1 for Android allows remote attackers to read OAuth tokens by sniffing network traffic due to the lack of SSL.

In Wireshark versions through 2.0.13 and 2.2.x through 2.2.7, the openSAFETY dissector could crash or exhaust system memory. This was addressed by adding length validation.

In Wireshark versions up to 2.0.13 and 2.2.x up to 2.2.7, the WBXML dissector could enter an infinite loop triggered by packet injection or a malformed capture file. This was addressed by adding validation of the relationships between indexes and lengths.

In Wireshark versions 2.0.0 to 2.0.13, the GPRS LLC dissector could enter a large loop, leading to performance issues. This was addressed by using a different integer data type.

In Wireshark versions 2.2.0 to 2.2.7 and 2.0.0 to 2.0.13, the AMQP dissector could crash. This was addressed by checking for successful list dissection.

In Wireshark versions 2.2.0 to 2.2.7 and 2.0.0 to 2.0.13, the MQ dissector could crash. This issue was addressed by validating the fragment length before a reassembly attempt.

In Wireshark versions 2.2.0 to 2.2.7 and 2.0.0 to 2.0.13, the DOCSIS dissector could go into an infinite loop. This was addressed by rejecting invalid Frame Control parameter values.

An issue was discovered in Apport through 2.20.x, where the ExecutablePath field is set in apport/report.py. This allows remote attackers to execute arbitrary code via a crafted .crash file due to a lack of path traversal protection.