CVE Vulnerability Catalog

The ms package before 0.7.1 for Node.js allows attackers to cause a denial of service (CPU consumption) via a long version string, aka a 'regular expression denial of service (ReDoS).'

B.A.S C2Box before 4.0.0 (r19171) relies on client-side validation, allowing remote attackers to 'corrupt the business logic' by introducing a negative value in an overdraft.

An issue was discovered in eClinicalWorks Patient Portal 7.0 build 13 related to a blind SQL injection in messageJson.jsp. Authenticated users can exploit this vulnerability to exfiltrate database data to a malicious server using an out-of-band technique.

Remote Manager in Open Enterprise Server (OES) allows unauthenticated remote attackers to read any arbitrary file via a specially crafted URL, enabling complete directory traversal and total information disclosure.

LibTIFF version 4.0.7 is vulnerable to a heap-based buffer over-read in tif_lzw.c, resulting in DoS or code execution via a crafted bmp image to tools/bmp2tiff.

The ConvertToPDF plugin in Foxit Reader before 8.2 and PhantomPDF before 8.2 on Windows, when the gflags app is enabled, allows remote attackers to cause a denial of service (out-of-bounds read and application crash) via a crafted JPEG image.

An issue was discovered in ABOOT in OnePlus 3 and 3T OxygenOS before 4.0.2, allowing an attacker to reboot the device into fastboot mode without authentication. An attacker can use ADB access to issue the reboot bootloader command and change SELinux to permissive mode.

A flaw in systemd v228 in /src/basic/fs-util.c caused world writable suid files to be created when using the systemd timers features, allowing local attackers to escalate their privileges to root.

In Hitek Software's Automize, information disclosure occurs in encryptionProfiles.jsd due to the Read attribute being set for Users. This allows an attacker to recover encrypted passwords for GPG Encryption profiles.

Hitek.jar in Hitek Software's Automize uses weak encryption for SSH/SFTP and encryption profile passwords. This allows an attacker to retrieve the encrypted passwords from sshProfiles.jsd and encryptionProfiles.jsd and decrypt them to recover cleartext passwords.

Hitek Software's Automize 10.x and 11.x has an information disclosure vulnerability in passManager.jsd. Users have the Read attribute, allowing an attacker to recover the encrypted password to access the Password Manager.

The vulnerability in mail.local in NetBSD allows local users to change ownership of or append data to arbitrary files on the target system via a symlink attack on the user mailbox.

The _TIFFFax3fillruns function in libtiff before version 4.0.6 allows remote attackers to cause a denial of service (divide-by-zero error and application crash) via a crafted Tiff image.

The VPN client in the Viprinet MultichannelVPN Router 300 version 2013070830/2013080900 does not validate the remote VPN endpoint identity before initiating the exchange, allowing remote attackers to perform a replay attack.

In Moodle versions 2.x and 3.x, web service tokens are not invalidated when the user password is changed or forced to be changed.

A vulnerability in Tiki Wiki CMS 15.2 allows a remote attacker to read arbitrary files on a targeted system via a crafted pathname in a banner URL field.

Firejail version 0.9.38.4 allows local users to execute arbitrary commands outside of the sandbox via a crafted TIOCSTI ioctl call.

Versions of sociomantic-tsunami before 0.10.3 allow remote attackers to execute arbitrary code via a crafted repository URL.

SELinux policycoreutils allows local users to execute arbitrary commands outside of the sandbox via a crafted TIOCSTI ioctl call.

Bash before 4.4 allows local users to execute arbitrary commands with root privileges via crafted SHELLOPTS and PS4 environment variables.