CVE Vulnerability Catalog

Pulse Connect Secure 8.3R1 has a CSRF vulnerability in the diag.cgi file, which allows commands like ping, traceroute, and nslookup to be executed. The lack of CSRF protections enables an attacker to run these commands against any IP if they can trick an admin into visiting their malicious page.

An out-of-bounds write vulnerability exists in the PDF parsing functionality of Infix 7.1.5. A specially crafted PDF file can cause a vulnerability resulting in potential memory corruption.

An exploitable integer overflow vulnerability exists in the JPEG 2000 image parsing functionality of Poppler 0.53.0. Opening a specially crafted PDF file can lead to an overflow, resulting in out of bounds memory overwrite on the heap and potential arbitrary code execution.

A heap overflow vulnerability exists in the image rendering functionality of Poppler 0.53.0. A specifically crafted PDF can cause an overly large number of color components during image rendering, resulting in heap corruption.

A heap overflow vulnerability exists in the image rendering functionality of Poppler 0.53.0. A specifically crafted PDF can cause an image resizing after allocation has already occurred, leading to heap corruption and potential code execution.

AVG AntiVirus for MacOS with scan engine before version 4668 may allow remote attackers to bypass malware detection by failing to scan disk image (DMG) files.

Version 7400.12.21.30308 of disp+work in SAP NetWeaver 7.40 allows remote attackers to cause a denial of service (resource consumption) via a crafted DIAG request.

In unrar-free 0.0.1, when _DEBUG_LOG mode is enabled, a stack-based buffer overflow may occur, leading to application crash. Remote attackers can exploit a RAR archive with a long filename to trigger this issue.

CVE-2017-4057 is a privilege escalation vulnerability in the web interface of McAfee Advanced Threat Defense (ATD) versions 3.10, 3.8, 3.6, 3.4, allowing remote authenticated users to gain elevated privileges via the GUI or GUI terminal commands.

Exploitation of an authentication vulnerability in the web interface of McAfee Advanced Threat Defense (ATD) 3.10, 3.8, 3.6, 3.4 allows remote unauthenticated users to bypass ATD detection via loose enforcement of authentication and authorization.

CVE-2017-4054 describes a command injection vulnerability in the web interface of McAfee Advanced Threat Defense (ATD) versions 3.10, 3.8, 3.6, and 3.4. Remote authenticated users can execute arbitrary commands via a crafted HTTP request parameter.

The ReadDPXImage function in ImageMagick 7.0.6-0 has a large loop vulnerability that can cause CPU exhaustion via a crafted DPX file, related to lack of an EOF check.

In FineCMS through 2017-07-11, the application/core/controller/style.php file allows remote attackers to write to arbitrary files via the contents and filename parameters in a route=style action. This can lead to overwriting a .php file because the file extension is not checked.

The mq_notify function in the Linux kernel through version 4.11.9 does not set the sock pointer to NULL upon entry into the retry logic. This may lead to use-after-free vulnerabilities or other unspecified impacts.

Microsoft Edge on Windows 10 and Windows Server 2016 contains a vulnerability allowing remote code execution related to errors in scripting engines. The issue occurs when handling objects in memory.

Internet Explorer in Microsoft Windows has a vulnerability related to improper rendering of objects in memory by scripting engines, leading to memory corruption. This affects multiple versions of operating systems, including Windows 7, Windows 8.1, and Windows 10.

Microsoft Edge in Windows 10 version 1703 contains a vulnerability allowing remote code execution related to how Microsoft scripting engines render objects in memory.

A vulnerability in Microsoft Edge on Windows 10 1703 allows an attacker to execute arbitrary code in the context of the current user when the JavaScript engine fails to render objects in memory.

A vulnerability in the JavaScript engine of Microsoft Internet Explorer allows an attacker to execute arbitrary code in the context of the current user. The issue occurs in Windows 10 and Windows Server 2016 when the engine improperly handles objects in memory.

A vulnerability in Microsoft browsers on Windows allows an attacker to execute arbitrary code in the context of the current user when JavaScript engines fail to render objects in memory.