CVE Vulnerability Catalog

A remote code execution vulnerability exists in Microsoft Edge related to the way affected Microsoft scripting engines render when handling objects in memory, known as 'Microsoft Edge Memory Corruption Vulnerability.'

A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, known as 'Internet Explorer Memory Corruption Vulnerability.'

A remote code execution vulnerability exists in Microsoft Edge due to issues in how JavaScript engines render objects in memory, referred to as 'Scripting Engine Memory Corruption Vulnerability.'

A vulnerability exists when Microsoft Edge improperly accesses objects in memory, known as 'Microsoft Edge Memory Corruption Vulnerability.'

There is a privilege elevation vulnerability in Windows due to improper input validation before loading type libraries. This affects multiple versions of Windows operating systems, including Windows Server 2008, Windows 7, Windows 8.1, Windows 10, and Windows Server 2016.

Windows Hyper-V contains a vulnerability that allows for elevation of privilege when Microsoft Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 fail to properly validate vSMB packet data.

Kernel-mode drivers in Windows Server 2008 SP2, R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012, Windows RT 8.1, Windows 10, and Windows Server 2016 allow a local authenticated attacker to execute a specially crafted application to obtain information or, in Windows 7 and later, cause denial of service.

CMS Made Simple (CMSMS) version 2.1.6 allows remote authenticated administrators to execute arbitrary PHP code via the code parameter to admin/editusertag.php, related to the CreateTagFunction and CallUserTag functions.

Xen through 4.6.x on 64-bit platforms mishandles a failsafe callback, which might allow PV guest OS users to execute arbitrary code on the host OS.

Xen through 4.8.x mishandles the 'contains segment descriptors' property during GNTTABOP_transfer operations, which might allow PV guest OS users to execute arbitrary code on the host OS.

Xen versions up to 4.8.x on 64-bit platforms mishandle page tables after an IRET hypercall, which might allow PV guest OS users to execute arbitrary code on the host OS.

An issue was discovered on OnePlus devices such as the 3T related to the OTA updater that pushes the signed OTA image over HTTP without TLS. While it does not allow for installation of arbitrary OTAs, it unnecessarily increases the attack surface.

In versions 4.1.19.2 and earlier of Invision Power Services (IPS) Community Suite, there is a combination of Stored XSS and Information Disclosure vulnerabilities in the attachments feature found in User CP. This can be triggered by any Invision Power Board user and can lead to gaining access to moderator/admin accounts.

The Traffic Management Microkernel (TMM) in F5 BIG-IP LTM, AAM, AFM, APM, ASM, GTM, Link Controller, PEM, PSM, and WebSafe 11.6.0 before 11.6.0 HF6, 11.5.0 before 11.5.3 HF2, and 11.3.0 before 11.4.1 HF10 may suffer from a memory leak while handling certain types of TCP traffic. Remote attackers may cause a denial of service (DoS) by way of a crafted TCP packet.

Symantec Advanced Secure Gateway (ASG) and ProxySG versions prior to 6.6.5.13, 6.7.3.1, and 6.5.10.6 are susceptible to an information disclosure vulnerability. An attacker with local access to the client host of an authenticated administrator user can obtain sensitive authentication credential information under certain circumstances.

The management consoles of Symantec Advanced Secure Gateway (ASG) and ProxySG in versions prior to 6.6.5.8, 6.5 prior to 6.5.10.6, and 6.7 prior to 6.7.1.2 do not correctly authorize administrator users under certain circumstances. A malicious administrator with read-only access can exploit this vulnerability to access management console functionality that requires read-write access privileges.

The management console of Symantec Content Analysis (CA) versions 1.3, 2.x prior to 2.2.1.1, and Mail Threat Defense (MTD) version 1.1 is susceptible to a cross-site request forging (CSRF) vulnerability. A remote attacker can use phishing or other social engineering techniques to access the management console with the privileges of an authenticated administrator user.

A potential security vulnerability has been identified with HP Integrated Lights-Out 4 (iLO 4) firmware version 2.11 and later, but prior to version 2.30. The vulnerability could be exploited remotely resulting in Denial of Service (DoS).