CVE Vulnerability Catalog

The Apache Qpid Broker for Java has a vulnerability that allows premature termination of SCRAM SASL negotiation if the provided username does not exist. This enables a remote attacker to determine the existence of user accounts.

Multiple cross-site request forgery (CSRF) vulnerabilities in Simple Invoices 2013.1.beta.8 allow remote attackers to hijack the authentication of admins for requests that can create new administrator user accounts, create regular user accounts, or change configuration parameters.

The sized_string_cmp function in libyara/sizedstr.c in YARA 3.5.0 allows remote attackers to cause a denial of service (use-after-free and application crash) via a crafted rule.

Mailcow version 0.14, used in 'mailcow: dockerized' and other products, has a CSRF vulnerability.

The ipxitf_ioctl function in the Linux kernel through version 4.11.1 mishandles reference counts, allowing local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via a failed SIOCGIFADDR ioctl call for an IPX interface.

In Ambari 2.4.x (before 2.4.3) and Ambari 2.5.0, an authorized user of the Ambari Hive View may be able to gain unauthorized read access to files on the host where the Ambari server executes.

In function msm_pcm_playback_close() in all Android releases from CAF using the Linux kernel, prtd is assigned substream->runtime->private_data. Later, prtd is freed but not sanitized or set to NULL, resulting in a dangling pointer.

All Android releases from CAF using the Linux kernel are vulnerable to an issue related to processing a voice SVC request. When a nonstandard payload size is specified that exceeds its declared size, an out of bounds memory copy occurs.

In core_info_read and inst_info_read in all Android releases from CAF, variables 'dbg_buf', 'dbg_buf->curr', and 'dbg_buf->filled_size' can be modified simultaneously by different threads, leading to a lack of protection with mutexes or locks. Buffer overflow is possible on race conditions.

CVE-2016-10331 is a vulnerability in download.php in Synology Photo Station before version 6.5.3-3226 that allows remote attackers to read arbitrary files via a full pathname in the id parameter.

Directory traversal vulnerability in synophoto_dsm_user, a SUID program, as used in Synology Photo Station before version 6.5.3-3226 allows local users to write to arbitrary files via unspecified vectors.

In FlightGear versions before 2017.2.1, the FGCommand interface allows overwriting any file the user has write access to, but only with the contents of a FlightGear flightplan (XML). A malicious resource, such as a third-party aircraft, could exploit this to damage user files.

PostgreSQL versions 8.4 - 9.6 are vulnerable to information leak in pg_user_mappings view which discloses foreign server passwords to any user having USAGE privilege on the associated foreign server.

Some selectivity estimation functions in PostgreSQL before version 9.2.21, 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before 9.5.7, and 9.6.x before 9.6.3 did not check user privileges before providing information from pg_statistic, potentially leaking data. An unprivileged attacker could exploit this flaw to steal information from tables they would otherwise not have access to.

CVE-2017-2167 describes an untrusted search path vulnerability in the Installer for PrimeDrive Desktop Application version 1.4.4 and earlier, allowing remote attackers to execute arbitrary code via a specially crafted executable file in an unspecified directory.

Directory traversal vulnerability in SOY CMS versions 1.8.1 to 1.8.12 allows authenticated attackers to read arbitrary files via shop_id.

There is an untrusted search path vulnerability in the installers for JPKI user's software for individuals that allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory.

CSRF vulnerability in Uploader plugin version 3.0.10 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.

CSRF vulnerability in baserCMS plugin Mail version 3.0.10 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors.

The baserCMS Feed plugin version 3.0.10 and earlier has a cross-site request forgery (CSRF) vulnerability that allows remote attackers to hijack the authentication of administrators via unspecified vectors.