CVE Vulnerability Catalog

Buffer overflow in the C implementation of the apply_delta function in _pack.c in Dulwich before version 0.9.9 allows remote attackers to execute arbitrary code via a crafted pack file.

EmbedThis GoAhead versions 3.0.0 through 3.4.1 improperly handle path segments starting with a dot, allowing remote attackers to conduct directory traversal attacks, cause denial of service (heap-based buffer overflow and crash), or possibly execute arbitrary code via a crafted URI.

The build_index_from_tree function in index.py in Dulwich before version 0.9.9 allows remote attackers to execute arbitrary code via a commit with a directory path starting with .git/, which is not properly handled when checking out a working tree.

The _validaterepo function in sshpeer in Mercurial before version 3.2.4 allows remote attackers to execute arbitrary commands via a crafted repository name in a clone command.

eGroupware before 1.8.006.20140217 is vulnerable to PHP object injection attacks, allowing remote attackers to delete arbitrary files and possibly execute arbitrary code.

An unspecified vulnerability in HP Operations Orchestration 10.x allows remote attackers to bypass authentication and gain access to sensitive information or modify data.

Unspecified vulnerability in HP Integrated Lights-Out (iLO) firmware 2 before 2.27 and 4 before 2.03 and iLO Chassis Management (CM) firmware before 1.30 allows remote attackers to gain privileges, execute arbitrary code, or cause a denial of service via unknown vectors.

A directory traversal vulnerability in the FTP server on Honeywell Excel Web controllers allows remote attackers to read files under the web root. By using a crafted pathname, attackers can gain access to administrative login data.

The WPML plugin before version 3.1.9 for WordPress does not properly handle multiple actions in a request, allowing remote attackers to bypass nonce checks and perform arbitrary actions.

Middleware/SessionCookie.php in Slim before 2.6.0 allows remote attackers to conduct PHP object injection attacks and execute arbitrary PHP code via crafted session data.

The get_rpm_nvr_by_file_path_temporary function in util.py in setroubleshoot before version 3.2.22 allows remote attackers to execute arbitrary commands via shell metacharacters in a file name.

The slapi-nis plug-in before version 0.54.2 does not properly reallocate memory when processing user accounts, allowing remote attackers to cause a denial of service (infinite loop and CPU consumption) via a request for (1) a group with a large number of members or (2) a user that belongs to a large number of groups.

A use-after-free vulnerability in the process_nested_data function in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7 allows remote attackers to execute arbitrary code via a crafted unserialize call that leverages the use of the unset function within an __wakeup function.

Heap-based buffer overflow caused by integer overflow in the _zip_cdir_new function in libzip 0.11.2 and earlier, used in the ZIP extension in PHP before 5.4.39, 5.5.x before 5.5.23, and 5.6.x before 5.6.7. Remote attackers can cause application crashes or potentially execute arbitrary code via a ZIP archive containing many entries.

A use-after-free vulnerability in the phar_rename_archive function in phar_object.c in PHP before 5.5.22 and 5.6.x before 5.6.6 allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger an attempted renaming of a Phar archive to the name of an existing file.

Use-after-free vulnerability in the _zend_shared_memdup function in zend_shared_alloc.c in the OPcache extension in PHP through 5.6.7 allows remote attackers to cause a denial of service or possibly have unspecified other impact via unknown vectors.

Multiple use-after-free vulnerabilities in ext/date/php_date.c in PHP before 5.4.38, 5.5.x before 5.5.22, and 5.6.x before 5.6.6 allow remote attackers to execute arbitrary code via crafted serialized input containing a (1) R or (2) r type specifier.

A heap-based buffer overflow in the enchant_broker_request_dict function in PHP before 5.4.38, 5.5.x before 5.5.22, and 5.6.x before 5.6.6 allows remote attackers to execute arbitrary code via vectors that trigger creation of multiple dictionaries.

In readelf.c in PHP versions before 5.4.37, 5.5.x before 5.5.21, and 5.6.x before 5.6.5, there is a vulnerability that does not consider that pread calls may read only a subset of available data. This allows remote attackers to cause a denial of service (uninitialized memory access) or possibly have unspecified other impact via a crafted ELF file.

An unspecified vulnerability in MyBB (MyBulletinBoard) before version 1.8.4 is related to group join request notifications being sent to the wrong group leaders.