CVE Vulnerability Catalog

The grant-table feature in Xen through 4.8.x has a race condition leading to a double free, allowing guest OS users to cause a denial of service (memory consumption) or possibly obtain sensitive information or gain privileges.

A memory leak in the virtio_gpu_object_create function in the Linux kernel through version 4.11.8 allows attackers to cause a denial of service by triggering object-initialization failures.

In Odoo 8.0, Odoo Community Edition 9.0 and 10.0, and Odoo Enterprise Edition 9.0 and 10.0, incorrect access control on OAuth tokens in the OAuth module allows remote authenticated users to hijack OAuth sessions of other users.

The dashboard subscription interface in Request Tracker (RT) 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2 might allow remote authenticated users with certain privileges to execute arbitrary code via a crafted saved search name.

Request Tracker (RT) versions 4.x before 4.0.25, 4.2.x before 4.2.14, and 4.4.x before 4.4.2 allow remote attackers to obtain sensitive information about CSRF verification tokens via a crafted URL.

NetApp OnCommand System Manager before version 9.0 allows remote attackers to obtain sensitive credentials via vectors related to cluster peering setup.

NetApp AltaVault 4.1 and earlier allows man-in-the-middle attackers to obtain sensitive information, gain privileges, or cause a denial of service via vectors related to the SMB protocol.

NetApp Clustered Data ONTAP has a vulnerability that allows man-in-the-middle attackers to obtain sensitive information, gain privileges, or cause a denial of service due to the failure to enable SMB signing enforcement in its default state.

NetApp Data ONTAP versions 8.1 and 8.2, when operating in 7-Mode, allows man-in-the-middle attackers to obtain sensitive information, gain privileges, or cause a denial of service via vectors related to the SMB protocol.

AeroAdmin 4.1 uses an insecure protocol (HTTP) to perform software updates. An attacker can hijack an update via man-in-the-middle in order to execute code on the machine.

AeroAdmin 4.1 uses a function to copy data between two pointers where the size of the data copied is taken directly from a network packet. This can cause a buffer overflow and denial of service.

The NFSv4 server in the Linux kernel before 4.11.3 does not properly validate the layout type when processing the NFSv4 pNFS GETDEVICEINFO or LAYOUTGET operand in a UDP packet from a remote attacker. This uninitialized type value leads to an OOPS and eventually a DoS of knfsd and a soft-lockup of the whole system.

Tor 0.3.x before 0.3.0.9 has a guard-selection algorithm that only considers the exit relay, not the exit relay's family. This may allow remote attackers to defeat intended anonymity properties by leveraging the existence of large families.

The _asn1_check_identifier function in GNU Libtasn1 through 4.12 causes a NULL pointer dereference and crash when reading crafted input that triggers assignment of a NULL value within an asn1_node structure.

A Predictable Value Range from Previous Values issue was discovered in Allen-Bradley MicroLogix 1100 and 1400 programmable logic controllers, related to insufficiently random TCP initial sequence numbers. An attacker may predict these numbers from previous values.

An Insufficiently Protected Credentials issue was discovered in Sierra Wireless AirLink Raven XE (all versions prior to 4.0.14) and AirLink Raven XT (all versions prior to 4.0.11). Sensitive information is insufficiently protected during transmission and vulnerable to sniffing.

A Cross-Site Request Forgery issue was discovered in Sierra Wireless AirLink Raven XE (all versions prior to 4.0.14) and AirLink Raven XT (all versions prior to 4.0.11). Affected devices do not verify if a request was intentionally sent by the logged-in user, which may allow an attacker to trick a client into making an unintentional request to the web server.

A Cross-Site Request Forgery issue was discovered in Belden Hirschmann GECKO Lite Managed switch, Version 2.0.00 and prior versions. The web application does not sufficiently verify that requests were provided by the user who submitted the request.

A Resource Exhaustion issue was found in Schneider Electric Modicon M340 PLC, which can lead to the device freezing. A remote attacker could send a specially crafted set of packets, causing the PLC to hang.

In LibTIFF version 4.0.8, there is an assertion abort in the TIFFWriteDirectoryTagCheckedLong8Array function in tif_dirwrite.c. Crafted input can lead to a remote denial of service attack.