CVE Vulnerability Catalog

PowerShell in Windows has a vulnerability allowing remote code execution when PSObject wraps a CIM Instance. This affects multiple versions of Windows, including Windows Server 2008 and Windows 10.

A vulnerability in Microsoft Windows allows for elevation of privilege due to Kerberos falling back to NT LAN Manager (NTLM) Authentication Protocol as the default authentication protocol.

A vulnerability in Microsoft Windows 8.1, Windows RT 8.1, Windows Server 2012 and R2, Windows 10, and Windows Server 2016 allows for elevation of privilege due to improper handling of calls to Advanced Local Procedure Call (ALPC).

The Windows kernel has a privilege escalation vulnerability due to the way it handles objects in memory. This affects multiple versions of Windows, including Windows 8.1, Windows 10, and Windows Server 2016.

In Microsoft Windows systems, including Windows Server 2008 SP2, Windows 7 SP1, Windows 8.1, Windows Server 2012, Windows 10, and Windows Server 2016, there is a vulnerability that allows elevation of privilege due to improper handling of objects in memory by the graphics component.

Microsoft Office allows a remote code execution vulnerability due to the way that it handles objects in memory, aka 'Microsoft Office Memory Corruption Vulnerability'.

Microsoft Office has a remote code execution vulnerability due to improper handling of objects in memory, known as 'Microsoft Office Memory Corruption Vulnerability'.

A vulnerability in Windows systems allows an attacker to bypass Extended Protection for Authentication when Kerberos fails to prevent tampering with the SNAME field during ticket exchange. This is known as 'Kerberos SNAME Security Feature Bypass'.

In Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016, there is a vulnerability that allows elevation of privilege due to the way it handles objects in memory.

Windows Shell in Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 has a remote code execution vulnerability due to improper handling of executable files and shares during rename operations.

Microsoft Office allows a remote code execution vulnerability due to the way it handles objects in memory, known as 'Microsoft Office Remote Code Execution Vulnerability'.

The ReadTGAImage function in ImageMagick 7.0.5-6 has a memory leak vulnerability that can cause memory exhaustion via invalid colors data in the header of a TGA or VST file.

iSmartAlarm cube devices are vulnerable to Denial of Service attacks. Sending a SYN flood on port 12345 causes the 'cube' to freeze and stop responding.

On iSmartAlarm cube devices, there is incorrect access control because a 'new key' is transmitted in cleartext.

iSmartAlarm cube devices have an SSL Certificate Validation Vulnerability.

A vulnerability in Multicast Source Discovery Protocol (MSDP) ingress packet processing for Cisco IOS XR Software could allow an unauthenticated, remote attacker to cause the MSDP session to be unexpectedly reset, leading to a short denial of service (DoS) condition. The MSDP session will restart within a few seconds.

A vulnerability in the BGP processing functionality of the Cisco StarOS operating system for Cisco ASR 5000 Series Routers and Cisco Virtualized Packet Core Software could allow an unauthenticated, remote attacker to cause the BGP process on an affected system to reload, resulting in a denial of service (DoS) condition.

A vulnerability in the CLI of Cisco IOS XR Software could allow an authenticated, local attacker to execute arbitrary code at the root privilege level on an affected system, due to Incorrect Permissions.

In Apache Impala (versions 2.7.0 to 2.8.0), a vulnerability was identified where one of the ports sent data in plaintext even when the cluster was configured to use TLS. The StatestoreSubscriber class did not use the appropriate secure Thrift transport, allowing eavesdropping on data by third parties.

The Traffic Router component of the Apache Traffic Control project is vulnerable to a Slowloris style Denial of Service attack. TCP connections made on the configured DNS port remain in the ESTABLISHED state, which can lead to exhaustion of the thread pool processing DNS requests.