CVE Vulnerability Catalog

Microsoft .NET Framework versions 2.0, 3.5, 4.5.2, 4.6, 4.6.1, 4.6.2, and 4.7 allows an attacker with access to the local system to execute malicious code, known as '.NET Remote Code Execution Vulnerability.'

An elevation of privilege vulnerability exists in Microsoft Windows 10, Windows 10 1511, Windows 8.1, Windows RT 8.1, and Windows Server 2012 R2 due to improper sanitization of handles in memory by the scripting engine.

An elevation of privilege vulnerability exists in Windows 7, 8.1, RT 8.1, 10, and Windows Server 2008 R2, 2012, 2012 R2, and 2016 due to improper handling of objects in memory by the Microsoft Graphics Component.

The Graphics component in the kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows local users to gain privileges via a crafted application.

Microsoft Excel 2007 SP3 and Microsoft Outlook 2010 SP2, 2013 SP1, and 2016 have a vulnerability that allows remote attackers to execute arbitrary code or cause a denial of service via a crafted document.

A remote code execution vulnerability in Microsoft Edge exists in the way that the Scripting Engine renders when handling objects in memory. An attacker could exploit this vulnerability to execute arbitrary code in the context of the current user.

In Wireshark 2.2.0, the NCP dissector could crash, triggered by packet injection or a malformed capture file. This was addressed by registering this dissector.

In Wireshark 2.2.0, the Bluetooth L2CAP dissector could crash, triggered by packet injection or a malformed capture file. This was addressed by avoiding use of a memcmp for potentially shorter strings.

CVE-2017-7694 vulnerability in Symphony CMS allows remote code execution through content.blueprintsdatasources.php. An authenticated attacker can enter PHP code in the datasource editor or event editor, leading to webshell access.

A heap-based buffer overflow exists in QEMU when built with the Q35-chipset-based PC system emulator. This vulnerability may lead to unauthorized memory access.

SecEmailUI in Samsung Galaxy S6 does not sanitize HTML email content, allowing remote attackers to execute arbitrary JavaScript.

Multiple SQL injection vulnerabilities in EyesOfNetwork (EON) 5.0 and earlier allow remote authenticated users to execute arbitrary SQL commands via specified parameters.

The vulnerability in setroubleshoot allows local users to bypass the intended container protection mechanism and execute arbitrary commands. This can be achieved by triggering an SELinux denial using a crafted file name or crafted fields in an XML document.

The allow_execstack plugin for setroubleshoot allows local users to execute arbitrary commands by triggering an execstack SELinux denial with a crafted filename, related to the commands.getoutput function.

The fix_lookup_id function in sealert in setroubleshoot before version 3.2.23 allows local users to execute arbitrary commands as root by triggering an SELinux denial with a crafted file name.

The allow_execmod plugin for setroubleshoot before version 3.2.23 allows local users to execute arbitrary commands by triggering an execmod SELinux denial with a crafted binary filename.

The xmlBufAttrSerializeTxtContent function in xmlsave.c in libxml2 allows context-dependent attackers to cause a denial of service (out-of-bounds read and application crash) via a non-UTF-8 attribute value, related to serialization.

An SQL injection vulnerability exists in Pivotal Cloud Foundry (PCF) before version 238 and in UAA 2.x before 2.7.4.4, 3.x before 3.3.0.2, and 3.4.x before 3.4.1. This allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.

In Apache Hadoop 2.x before 2.7.4, a user who can escalate to yarn user can possibly run arbitrary commands as root user.

Foscam networked devices use the same hardcoded SSL private key across different customers' installations, allowing remote attackers to defeat cryptographic protection mechanisms.