CVE Vulnerability Catalog

MediaWiki versions before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1, when $wgBlockDisablesLogin is true, may allow remote attackers to obtain sensitive information by failing to terminate sessions when a user account is blocked.

ApiParse in MediaWiki before 1.23.15, 1.26.x before 1.26.4, and 1.27.x before 1.27.1 allows remote attackers to bypass intended per-title read restrictions via a parse action to api.php.

Red Hat OpenShift Enterprise 2 does not include the HTTPOnly flag in a Set-Cookie header for the GEARID cookie, which makes it easier for remote attackers to obtain potentially sensitive information via script access to the cookies.

Heap-based buffer overflow in IOHIDFamily in Apple iOS before 9.3.2, OS X before 10.11.5, and tvOS before 9.2.1 allows attackers to execute arbitrary code in a privileged context or cause a denial of service (memory corruption) via a crafted app.

Multiple heap-based buffer overflows in the CBookBase::SetDefTableStyle and CBookBase::SetDefPivotStyle functions in Hancom Office 2014 VP allow remote attackers to execute arbitrary code via a crafted Hangul Hcell Document (.cell) file.

SquirrelMail version 1.4.22 (and other versions before 20170427_0200-SVN) allows post-authentication remote code execution via a mishandled sendmail.cf file in a popen call. Exploiting this vulnerability enables the execution of arbitrary shell commands on the remote server.

An authenticated user of Unitrends Enterprise Backup before version 9.1.2 can execute arbitrary OS commands by sending a specially crafted filename to the /api/restore/download-files endpoint, related to the downloadFiles function in api/includes/restore.php.

Drupal 8 versions before 8.2.8 and 8.3 before 8.3.1 allow critical access bypass by authenticated users if the RESTful Web Services (rest) module is enabled and the site allows PATCH requests.

The cookie feature in the packet action API in the Linux kernel 4.11.x through 4.11-rc7 mishandles the tb nlattr array, allowing local users to cause a denial of service through uninitialized memory access and refcount underflow, potentially leading to system hang or crash.

Samsung Android devices with L(5.0/5.1), M(6.0), and N(7.x) software allow attackers to obtain sensitive information by reading a world-readable log file after an unexpected reboot.

Artifex jbig2dec version 0.13 allows out-of-bounds reads and writes due to an integer overflow in the jbig2_image_compose function in jbig2_image.c during operations on a crafted .jb2 file. This can lead to application crashes or disclosure of sensitive information from process memory.

The aescrypt gem version 1.0.0 for Ruby does not randomize the initialization vector (IV) for the AESCrypt.encrypt and AESCrypt.decrypt functions, allowing attackers to defeat cryptographic protection mechanisms via a chosen plaintext attack.

Artifex jbig2dec version 0.13, used in Ghostscript, allows out-of-bounds writes due to an integer overflow in the jbig2_build_huffman_table function. This can lead to application crashes or potentially the execution of arbitrary code.

The GNU Multiple Precision Arithmetic Library (GMP) interfaces for PHP through 7.1.4 allow attackers to cause a denial of service (memory consumption and application crash) via operations on long strings.

The cr_tknzr_parse_rgb function in cr-tknzr.c in libcroco versions 0.6.11 and 0.6.12 has an undefined behavior issue when values exceed the range of representable values of type long. This may allow remote attackers to cause application crashes or other unspecified impacts via a crafted CSS file.

Integer overflow in the mark_curve function in Artifex Ghostscript 9.21 allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or possibly have unspecified other impact via a crafted PostScript document.

Nessus 6.10.x before 6.10.5 was found to be vulnerable to a local privilege escalation issue due to insecure permissions when running in Agent Mode.

In Phusion Passenger before version 5.1.0, a known /tmp filename was used during passenger-install-nginx-module execution, which could allow local attackers to gain the privileges of the passenger user.

Apache CXF's STSClient before 3.1.11 and 3.0.13 uses a flawed way of caching tokens associated with delegation tokens. This allows an attacker to craft a token that returns an identifier corresponding to a cached token for another user.

The NFSv2/NFSv3 server in the Linux kernel through version 4.10.11 allows remote attackers to cause a system crash via a long RPC reply. The issue is related to net/sunrpc/svc.c, fs/nfsd/nfs3xdr.c, and fs/nfsd/nfsxdr.c.