CVE Vulnerability Catalog

CVE-2017-2253 describes an untrusted search path vulnerability in the installer of Yahoo! Toolbar (for Internet Explorer) version 8.0.0.6 and earlier, with a timestamp prior to June 13, 2017. This allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.

Untrusted search path vulnerability in self-extracting archive files created by File Compact in versions 5.10 and earlier, 6.02 and earlier, and 7.02 and earlier. This allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.

CVE-2017-2249 describes an untrusted search path vulnerability in self-extracting archives created by Lhaz+ version 3.4.0 and earlier. This allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.

CVE-2017-2248 describes an untrusted search path vulnerability in the Installer of Lhaz+ version 3.4.0 and earlier, allowing an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.

CVE-2017-2247 describes an untrusted search path vulnerability in self-extracting archives created by Lhaz version 2.4.0 and earlier. This allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.

CVE-2017-2246 describes an untrusted search path vulnerability in the Installer of Lhaz version 2.4.0 and earlier, allowing an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.

IBM Tivoli Monitoring Portal v6 could allow a local (network adjacent) attacker to modify SQL commands to the Portal Server, when default client-server communications, HTTP, are being used.

IBM Tivoli Monitoring Portal v6 could allow a local (network adjacent) attacker to execute arbitrary commands on the system, when default client-server communications, HTTP, are being used.

The IBM Tivoli Monitoring Portal V6 client could allow a local attacker to gain elevated privileges for IBM Tivoli Monitoring due to the default console connection not being encrypted.

CVE-2017-11347 vulnerability in MetInfo 5.3.17 allows a remote authenticated attacker to generate a PHP script containing a malicious image. This is related to admin/include/common.inc.php and admin/app/physical/physical.php.

Stack buffer overflow in networkmap in Asuswrt-Merlin firmware for ASUS devices and ASUS firmware for selected router models allows remote attackers to execute arbitrary code on the router.

A global buffer overflow in networkmap in Asuswrt-Merlin firmware for ASUS devices and ASUS firmware for selected router models allows remote attackers to write shellcode at any address in the heap. This can lead to the execution of arbitrary code on the router.

All versions of CHICKEN Scheme up to and including 4.12.0 are vulnerable to an algorithmic complexity attack due to an incomplete fix for CVE-2012-6125. An attacker can provide crafted input that will result in O(n) lookup time in the symbol table.

There is an illegal address access in ast.cpp of LibSass 3.4.5. A crafted input will lead to a remote denial of service attack.

There is a heap based buffer over-read vulnerability in LibSass version 3.4.5 that can be exploited by crafted input.

There is a heap based buffer overflow in LibTIFF 4.0.8 in tools/tiff2pdf.c triggered by a PlanarConfig=Contig image. This can lead to an out-of-bounds write and potentially to remote denial of service or arbitrary code execution attacks.

Cobian Backup 11 client allows man-in-the-middle attackers to add and execute new backup tasks when the master server is spoofed. Additionally, the attacker can execute system commands remotely by abusing pre-backup events.

OpenMPT through version 1.26.12.00 and libopenmpt before version 0.2.8461-beta26 has a heap buffer overflow that may lead to arbitrary code execution. This issue is triggered by a crafted PSM file that causes the same sample slot to be used for two samples.

On all vSRX and SRX Series devices, when DHCP or DHCP relay is configured, specially crafted packets may cause the flowd process to crash, halting or interrupting traffic through the device. Repeated crashes of the flowd process may lead to an extended denial of service condition.

An XML injection vulnerability in Junos OS CLI allows a locally authenticated user to elevate privileges and run arbitrary commands as the root user. This issue was found during internal product security testing.