CVE Vulnerability Catalog

SAP SAPCAR version 721.510 has a Heap Based Buffer Overflow Vulnerability. It could be exploited with a crafted CAR archive file received from an untrusted remote source.

The inet_csk_clone_lock function in the Linux kernel up to version 4.10.15 allows attackers to cause a denial of service (double free) or possibly have unspecified other impact by leveraging the accept system call.

A Use After Free vulnerability in the pdf2swf part of swftools 0.9.2 and earlier allows remote attackers to execute arbitrary code via a malformed PDF document.

Airwatch Agent for Android contains a vulnerability that may allow a device to bypass root detection. Successful exploitation of this issue may result in an enrolled device having unrestricted access over local Airwatch security controls and data.

IBM WebSphere Application Server versions 8.0 and 8.5.5 may provide weaker than expected security. A remote attacker could exploit this weakness to obtain sensitive information and gain unauthorized access to the admin console.

IBM Team Concert (RTC) is vulnerable to a denial of service, caused by an XML External Entity Injection (XXE) error when processing XML data. A remote attacker could exploit this vulnerability to expose highly sensitive information or consume all available memory resources.

In F5 BIG-IP versions 11.2.1, 11.4.0 through 11.6.1, and 12.0.0 through 12.1.2, an unauthenticated user with access to the control plane may be able to delete arbitrary files through an undisclosed mechanism.

IBM Interact versions 8.6, 9.0, 9.1, and 10.0 are vulnerable to cross-site request forgery, which could allow an attacker to execute malicious and unauthorized actions on behalf of a trusted user.

Multiple cross-site request forgery (CSRF) vulnerabilities in Mautic 1.4.1 allow remote attackers to hijack the authentication of users for requests that can (1) delete email campaigns or (2) delete contacts.

The acp/core/files.browser.php in flatCore 1.4.7 has a vulnerability that allows file deletion via directory traversal in the delete parameter to acp/acp.php. The risk might be limited to requests submitted through CSRF.

ASUS RT-AC* and RT-N* devices with firmware before version 3.0.0.4.380.7378 allow JSONP Information Disclosure, which may include a network map.

ASUS RT-AC* and RT-N* devices with firmware before version 3.0.0.4.380.7378 are vulnerable to CSRF attacks on the login page and while saving settings.

All versions of the NVIDIA GPU Display Driver contain a vulnerability in the GPU firmware that may allow incorrect access to sensitive GPU control registers by the CPU, leading to an escalation of privileges.

All versions of the NVIDIA GPU Display Driver contain a vulnerability in the kernel mode layer handler where a NULL pointer dereference caused by invalid user input may lead to denial of service or potential escalation of privileges.

All versions of the NVIDIA GPU Display Driver contain a vulnerability in the kernel mode layer handler where a value passed from a user to the driver is not correctly validated. This may lead to denial of service or potential escalation of privileges.

All versions of the NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape where a pointer passed from a user to the driver is not correctly validated before it is dereferenced for a write operation.

All versions of the NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler that may lead to NULL pointer dereference.

All versions of the NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape where a value passed from a user to the driver is not correctly validated and used as the index to an array.

All versions of the NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgkDdiEscape where the size of an input buffer is not validated. This can lead to denial of service or potential escalation of privileges.

All versions of the NVIDIA Windows GPU Display Driver contain a vulnerability in the kernel mode layer (nvlddmkm.sys) handler for DxgDdiEscape where user provided input is not correctly validated, allowing out of bound access in kernel memory.