CVE Vulnerability Catalog

IBM Security Guardium versions 9.0, 9.1, and 9.5 supports interaction between multiple actors who negotiate which algorithm should be used as a protection mechanism, such as encryption or authentication. However, it does not select the strongest algorithm available to both parties.

Sangoma NetBorder / Vega Session Controller before 2.3.12-80-GA allows remote attackers to execute arbitrary commands via the web interface.

ISPConfig 3.x before 3.1.9 allows remote authenticated users to obtain root access by creating a crafted cron job.

Artica Web Proxy before 3.06.112911 allows remote attackers to execute arbitrary code as root by conducting a cross-site scripting (XSS) attack involving the username-form-id parameter to freeradius.users.php.

In the Linux kernel up to version 4.14.4, there is no requirement for the CAP_NET_ADMIN capability for add_callback and remove_callback operations in net/netfilter/xt_osf.c. This allows local users to bypass intended access restrictions because the xt_osf_fingers data structure is shared across all net namespaces.

In the Linux kernel up to version 4.14.4, there is no requirement for the CAP_NET_ADMIN capability for new, get, and del operations in net/netfilter/nfnetlink_cthelper.c. This allows local users to bypass intended access restrictions because the nfnl_cthelper_list data structure is shared across all net namespaces.

An issue was discovered in the software on Vaultek Gun Safe VT20i products related to the lack of encryption of the session between the Android application and the safe. Despite marketing materials claiming that this communication is encrypted, this is not true.

An issue was discovered in Vaultek Gun Safe VT20i products that allows an attacker to remotely unlock the safe without a valid PIN code. Although the mobile application requires a PIN, the safe does not verify it, enabling authorization with any value.

A cross-origin vulnerability has been discovered in the Auth0 auth0.js library affecting versions < 8.12. This vulnerability allows an attacker to acquire authenticated users' tokens and invoke services on a user's behalf if the target site or application uses a popup callback page with auth0.popup.callback().

NVIDIA mediaserver contains a vulnerability where a use after free malfunction can occur due to an incorrect bounds check, which could enable unauthorized code execution and possibly lead to elevation of privileges.

The NVIDIA driver contains a vulnerability where a use after free malfunction can occur due to improper usage of the list_for_each kernel macro. This could enable unauthorized code execution and possibly lead to elevation of privileges.

The NVIDIA driver contains a vulnerability where a use after free malfunction can occur due to a race condition, potentially enabling unauthorized code execution and possibly leading to elevation of privileges.

In Heimdal through 7.4, remote unauthenticated attackers are able to crash the KDC by sending a crafted UDP packet containing empty data fields for client name or realm. The parser would unconditionally dereference NULL pointers in that case, leading to a segmentation fault.

Versions of Puppet Agent prior to 1.6.0 included a version of the Puppet Execution Protocol (PXP) agent that passed environment variables through to Puppet runs. This could allow unauthorized code to be loaded.

CVE-2017-13175 is an information disclosure vulnerability in the NVIDIA libwilhelm affecting the Android kernel.

CVE-2017-13174 is a privilege escalation vulnerability in the Android kernel. It affects Android kernel versions and may allow unauthorized access to system resources.

There is an elevation of privilege vulnerability in the MediaTek system server. This affects the Android kernel.

CVE-2017-13172 is a privilege escalation vulnerability in the MediaTek Bluetooth driver affecting the Android kernel.

CVE-2017-13171 describes an elevation of privilege vulnerability in the MediaTek performance service on Android. It affects the Android kernel.

CVE-2017-13170 is a privilege escalation vulnerability in the MediaTek display driver in Android. It affects the Android kernel.