CVE Vulnerability Catalog

In version 0.35.0 of cf-deployment in Cloud Foundry Foundation, a misconfiguration with Loggregator and syslog-drain causes logs to be drained to unintended locations.

Bazaar through 2.7.0, when Subprocess SSH is used, allows remote attackers to execute arbitrary commands via a bzr+ssh URL with an initial dash character in the hostname.

A vulnerability in TG Soft Vir.IT eXplorer Lite 8.5.42 allows local users to cause a denial of service (NULL pointer dereference) or possibly have unspecified other impact via a NULL value in a 0x82730008 DeviceIoControl request to \\.\Viragtlt.

The admin_edit function in app/Controller/UsersController.php in MISP 2.4.82 mishandles the enable_password field, allowing admins to discover a hashed password by reading the audit log.

The receive_msg function in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to cause a denial of service via infinite loop and stack exhaustion using BDAT commands and an improper check for a '.' character signifying the end of the content.

The receive_msg function in the SMTP daemon in Exim 4.88 and 4.89 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via vectors involving BDAT commands.

October CMS through 1.0.428 does not prevent the use of .htaccess in themes, allowing remote authenticated users to execute arbitrary PHP code by downloading a theme ZIP archive from /backend/cms/themes, and then uploading and importing a modified archive with two new files: a .php file and a .htaccess file.

The XFRM dump policy implementation in the Linux kernel before version 4.13.11 allows local users to gain privileges or cause a denial of service (use-after-free) via a crafted SO_RCVBUF setsockopt system call in conjunction with XFRM_MSG_GETPOLICY Netlink messages.

A global buffer overflow in OptiPNG 0.7.6 allows remote attackers to cause a denial-of-service attack or other unspecified impact using a maliciously crafted GIF format file. The issue is related to an uncontrolled loop in the LZWReadByte function of the gifread.c file.

Ametys before 4.0.3 requires authentication only for URIs containing a /cms/ substring, allowing remote attackers to bypass intended access restrictions via a direct request to /plugins/core-ui/servercomm/messages.xml.

The web server on DBL DBLTek devices allows remote attackers to execute arbitrary OS commands by obtaining the admin password via a frame.html?content=/dev/mtdblock/5 request, and then using this password for the HTTP Basic Authentication needed for a change_password.csp request, which supports a "<%%25call system.exec:" string in the passwd parameter.

In Icinga 2.x through 2.8.1, the etc/initsystem/prepare-dirs script has a chown call for a filename in a user-writable directory. This allows local users to gain privileges by leveraging access to the $ICINGA2_USER account for the creation of a link.

In auth_login.php in Cacti before 1.0.0, remote authenticated users can bypass intended access restrictions by logging in as a user not in the Cacti database, because the guest user is not considered.

The parser.c file in libxml2 before version 2.9.5 does not prevent infinite recursion in parameter entities.

In libxml2 before version 2.9.5, there is an issue with handling parameter-entity references because the NEXTL macro calls the xmlParserHandlePEReference function in the case of a '%' character in a DTD name.

An issue was discovered on MOXA EDS-G512E 5.1 build 16072215 devices regarding the storage of backup files. These files contain sensitive information insecurely, as passwords are stored without encryption and without salt for hashing.

An issue was discovered on MOXA EDS-G512E 5.1 build 16072215 devices regarding the password encryption method. This method can be retrieved from the firmware as the chall value is sent in cleartext as a POST parameter.

An issue was discovered on MOXA EDS-G512E 5.1 build 16072215 devices, allowing an attacker to extract public and private keys from the firmware image available on the MOXA website. These keys could be used against a production switch that has the default keys embedded.

The MIT Kerberos 5 (krb5) library up to version 1.15.2 mishandles Distinguished Name (DN) fields, allowing remote attackers to execute arbitrary code or cause application crashes via buffer overflow.

The scp_v0s_accept function in the session manager of xrdp up to version 0.9.4 uses an untrusted integer as a write length, which can lead to buffer overflow and application crash.