CVE Vulnerability Catalog

A buffer overflow vulnerability in the Junos OS CLI may allow a local authenticated user with read-only privileges to execute code with root privileges. This affects specific versions of Junos OS on various Juniper Networks devices.

There is an out-of-bounds write vulnerability in the Linux system in the file drivers/char/lp.c. A missing bounds check allows an attacker with partial control over the 'secure boot' kernel command line to overflow the parport_nr array.

ONOS version 1.9.0 allows unauthenticated use of websockets, which may lead to unauthorized access to the system.

ONOS version 1.9.0, developed by the Linux Foundation, is vulnerable to a DoS attack.

Jasig phpCAS version 1.3.4 is vulnerable to an authentication bypass in the validateCAS20 function when configured to authenticate against an old CAS server.

CVE-2017-1000069 describes a CSRF vulnerability in oauth2_proxy version 2.1 that can occur during the authentication flow.

TestTrack Server versions 1.0 and earlier are vulnerable to an authentication flaw in the split disablement feature, allowing the disabling of arbitrary running splits and causing denial of service to clients.

MODX Revolution version 2.x - 2.5.6 is vulnerable to blind SQL injection caused by improper sanitization by the escape method, allowing authenticated users to access the database and possibly escalate privileges.

The entry details view function in KeePass version 1.32 inadvertently decrypts certain database entries into memory, which may result in the disclosure of sensitive information.

Kitto framework version 0.5.1 is vulnerable to memory exhaustion in the router, resulting in a DoS attack.

Kitto 0.5.1 is vulnerable to directory traversal in the router, which may lead to remote code execution.

xmlsec version 1.2.23 and earlier is vulnerable to XML External Entity Expansion when parsing crafted input documents, potentially leading to information disclosure or denial of service.

Elixir Plug before v1.0.4, v1.1.7, v1.2.3 and v1.3.2 is vulnerable to arbitrary code execution in the deserialization functions of Plug.Session.

Elixir Plug before v1.0.4, v1.1.7, v1.2.3 and v1.3.2 is vulnerable to null byte injection in the Plug.Static component, which may allow users to bypass filetype restrictions.

JasPer 2.0.12 is vulnerable to a NULL pointer exception in the function jp2_encode which failed to check to see if the image contained at least one component resulting in a denial-of-service.

The web framework using the qs module in versions older than v6.3.2, v6.2.3, v6.1.2, and v6.0.4 is vulnerable to a DoS attack. A malicious user can send an evil request causing the framework to crash.

Mautic version 2.6.1 and earlier fails to set flags on session cookies, which may lead to unauthorized access to user sessions.

Akka versions up to 2.4.16 and 2.5-M1 are vulnerable to a deserialization attack in its Remoting component, potentially leading to remote code execution in the context of the ActorSystem.

CVE-2017-1000031 is an SQL injection vulnerability in graph_templates_inputs.php in Cacti 0.8.8b that allows remote attackers to execute arbitrary SQL commands via the graph_template_input_id and graph_template_id parameters.

Oracle's GlassFish Server Open Source Edition 3.0.1 (build 22) is vulnerable to a Local File Inclusion vulnerability that allows arbitrary files to be included on the server. This vulnerability can be exploited without any prior authentication.