CVE Vulnerability Catalog

CVE-2017-11096 affects SWFTools 0.9.2, where processing a crafted file in swfcombine can lead to a NULL Pointer Dereference in the swf_DeleteFilter() function in lib/modules/swffilter.c.

A Null Pointer Dereference issue was discovered in Schneider Electric Wonderware ArchestrA Logger, versions 2017.426.2307.1 and prior. This vulnerability could allow an attacker to crash the logger process, causing a denial of service for logging and log-viewing.

An Uncontrolled Resource Consumption issue was discovered in Schneider Electric Wonderware ArchestrA Logger, versions 2017.426.2307.1 and prior. This vulnerability could allow an attacker to exhaust the memory resources of the machine, causing a denial of service.

An Improper Authentication issue was discovered in Siemens SIMATIC CP 44x-1 RNA, all versions prior to 1.4.1. An unauthenticated remote attacker may be able to perform administrative actions on the Communication Process (CP) of the RNA series module, if network access to Port 102/TCP is available and the configuration file for the CP is stored on the RNA's CPU.

The `ares_parse_naptr_reply()` function in the c-ares library may read memory outside of the given input buffer if the passed DNS response packet is crafted in a specific way.

A race condition in the bindBackupAgent method in ActivityManagerService in Android 4.4.4 allows local users with adb shell access to execute arbitrary code or any valid package as system.

Foxit Reader before version 8.3.1 and PhantomPDF before version 8.3.1 have an Arbitrary Write vulnerability, allowing remote attackers to execute arbitrary code via a crafted document.

A directory traversal vulnerability in node/utils/Minify.js in Etherpad versions 1.1.1 through 1.5.2 allows remote attackers to read arbitrary files by manipulating the path parameter in HTTP API requests.

CVE-2017-0340 describes an elevation of privilege vulnerability in the NVIDIA Libnvparser component due to a memcpy into a fixed sized buffer with a user-controlled size, which could lead to memory corruption and possible remote code execution.

The MFC-J960DWN firmware version D and earlier has a cross-site request forgery (CSRF) vulnerability that allows remote attackers to hijack the authentication of administrators via unspecified vectors.

CVE-2017-2238 describes a CSRF vulnerability in the firmware of Toshiba Home gateway HEM-GW16A and HEM-GW26A, allowing remote attackers to hijack administrator authentication.

A vulnerability in the installer of the PDF Digital Signature Plugin (G2.30 and earlier) allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.

The vulnerability in the installer of Shinseiyo Sogo Soft (4.8A and earlier) related to an untrusted search path allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.

CVE-2017-2231 describes an untrusted search path vulnerability in the installer of the MLIT DenshiSeikabutsuSakuseiShienKensa system version 3.02 and earlier, distributed until June 20, 2017. An attacker can gain privileges via a Trojan horse DLL placed in an unspecified directory.

CVE-2017-2230 describes an untrusted search path vulnerability in Douro Kouji Kanseizutou Check Program Ver3.1 and earlier, allowing remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory.

The Douroshisetu Kihon Data Sakusei System version 1.0.2 and earlier has an untrusted search path vulnerability that allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.

CVE-2017-2227 describes an untrusted search path vulnerability in the installer of Charamin OMP Version 1.1.7.4 and earlier, Version 1.2.0.0 Beta and earlier. This allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.

CVE-2017-2226 describes an untrusted search path vulnerability in the setup file of e-Tax software (WEB version) (1.17.1) and earlier, allowing an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.

The CSRF vulnerability in TS-WPTCAM, TS-PTCAM, TS-PTCAM/POE, TS-WLC2, TS-WLCE, TS-WRLC firmware version 1.19 and earlier and TS-WPTCAM2 firmware version 1.01 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.

The vulnerability in the CASL II simulator installer related to an untrusted search path allows an attacker to gain privileges via a malicious DLL in an unspecified directory.