CVE Vulnerability Catalog

On the Broadcom Wi-Fi HardMAC SoC with fbt firmware, a stack buffer overflow occurs when handling an 802.11r (FT) authentication response, leading to remote code execution via a crafted access point that sends a long R0KH-ID field in a Fast BSS Transition Information Element (FT-IE).

A vulnerability in the NVIDIA crypto driver allows a local malicious application to execute arbitrary code within the context of the kernel. It requires compromising a privileged process first.

CVE-2017-0332 is a vulnerability in the NVIDIA crypto driver that allows a local malicious application to execute arbitrary code within the kernel context. This issue is rated as High because it requires compromising a privileged process first.

CVE-2017-0329 describes an elevation of privilege vulnerability in the NVIDIA boot and power management processor driver, allowing a local malicious application to execute arbitrary code within the context of the processor. This issue is rated as High because it first requires compromising a privileged process.

A vulnerability in the NVIDIA crypto driver allows a local malicious application to execute arbitrary code within the context of the kernel. It requires first compromising a privileged process.

A vulnerability in the NVIDIA I2C HID driver allows a local malicious application to execute arbitrary code within the kernel context, potentially leading to privilege escalation.

In LightDM through version 1.22.0, a directory traversal issue in debian/guest-account.sh allows local attackers to own arbitrary directory path locations and escalate privileges to root when the guest user logs out.

Apache Geode before version 1.1.1, when security is enabled, allows remote authenticated users with CLUSTER:READ but not DATA:READ permission to access the data browser page in Pulse, consequently executing an OQL query that exposes data stored in the cluster.

The msm_ipc_router_close function in the ipc_router component of Linux kernel 3.x can lead to denial of service through NULL pointer dereference. Attackers can trigger a failure during the accept system call for an AF_MSM_IPC socket.

A heap-based buffer overflow in the CreateFXPDFConvertor function in ConvertToPdf_x86.dll in Foxit Reader 7.3.4.311 allows remote attackers to execute arbitrary code via a large SamplesPerPixel value in a crafted TIFF image that is mishandled during PDF conversion.

The OpenFlow plugin for OpenDaylight before Helium SR3 allows remote attackers to spoof the SDN topology, affecting the flow of data. This issue is related to the reuse of LLDP packets, known as 'LLDP Relay.'

OpenFlow plugin for OpenDaylight before Helium SR3 allows remote attackers to spoof the SDN topology and affect the flow of data, related to 'fake LLDP injection.'

In Horde_Crypt before 2.7.6, used in Horde Groupware Webmail Edition 5.x through 5.2.17, OS Command Injection can occur if the user has PGP features enabled and has the preference for automatic verification of PGP signed messages enabled. An attacker can send a maliciously crafted PGP signed email to the Horde user, who must then view or preview it.

In Horde_Crypt before 2.7.6, used in Horde Groupware Webmail Edition through 5.2.17, OS Command Injection can occur if the attacker is an authenticated Horde Webmail user, has PGP features enabled in their preferences, and attempts to encrypt an email addressed to a maliciously crafted email address.

D-Link DIR-615 HW: T1 FW:20.09 is vulnerable to Cross-Site Request Forgery (CSRF) attacks. This allows an attacker to perform unwanted actions on a wireless router for which the user/admin is currently authenticated.

An issue (known as XSA-212) was discovered in Xen, affecting versions 4.8.x, 4.7.x, 4.6.x, 4.5.x, and 4.4.x. The earlier XSA-29 fix introduced an insufficient check on XENMEM_exchange input, allowing the caller to drive hypervisor memory accesses outside of the guest provided input/output arrays.

A vulnerability in the IntelHAXM.sys driver in Intel Hardware Accelerated Execution Manager before version 6.0.6 allows a local user to gain system level access.

The Go SSH library (x/crypto/ssh) by default does not verify host keys, facilitating man-in-the-middle attacks. Default behavior changed in commit e4e2799 to require explicitly registering a hostkey verification mechanism.

The eCryptfs subsystem in the Linux kernel before version 3.18 allows local users to gain privileges via a large filesystem stack that includes an overlayfs layer.

NixOS 17.03 before version 17.03.887 has a world-writable Docker socket, allowing local users to gain privileges by executing docker commands.