CVE Vulnerability Catalog

Opencast versions 2.3.2 and older are vulnerable to script injections through media and metadata in the player and media module, resulting in arbitrary code execution. This issue is fixed in versions 2.3.3 and 3.0.

The VMware Workstation (12.x before 12.5.8) installer contains a DLL hijacking issue due to improper loading of some DLL files by the application. This issue may allow an attacker to load a DLL file of their choosing, potentially executing arbitrary code.

Snap7 Server version 1.4.1 can be crashed when the ItemCount field of the ReadVar or WriteVar functions of the S7 protocol implementation in Snap7 are provided with unexpected input, resulting in a denial of service attack.

The hw/input/ps2.c file in Qemu does not validate 'rptr' and 'count' values during guest migration, leading to out-of-bounds access.

The workstation logging function in Philips IntelliSpace Cardiovascular (ISCV) version 2.3.0 and earlier and Xcelera R4.1L1 and earlier records domain authentication credentials. If accessed, this allows an attacker to use the credentials to access the application or other user entitlements.

ROOT xrootd version 4.6.0 and below is vulnerable to an unauthenticated shell command injection resulting in remote code execution.

BIG-IP versions 11.6.0-11.6.2, 12.0.0-12.1.2, and 13.0.0-13.0.0 are vulnerable to an Adaptive Chosen Ciphertext attack, also known as the Bleichenbacher attack. Exploiting this vulnerability may lead to plaintext recovery of encrypted messages and/or a Man-in-the-middle attack.

An issue was discovered on MOXA EDS-G512E 5.1 build 16072215 devices that may lead to a denial of service.

jqueryFileTree version 2.1.5 and older is vulnerable to Directory Traversal attacks, allowing access to files and directories outside of intended paths.

QuickerBB version <= 0.7.2 is vulnerable to arbitrary file writes, which can lead to remote code execution. This can result in the complete takeover of the server hosting QuickerBB.

Next.js before 2.4.1 has a directory traversal vulnerability in the /_next and /static request namespace, allowing attackers to obtain sensitive information.

Cygnux sysPass version 2.1.7 and older is vulnerable to a Local File Inclusion in the functionality of javascript files inclusion. The attacker can read the configuration files that contain the login and password from the database, as well as other sensitive information.

Jool versions 3.5.0-3.5.1 are vulnerable to a kernel crashing packet resulting in a DoS attack.

An issue was discovered in Teluu pjproject (pjlib and pjlib-util) before version 2.7.1 related to the ioqueue component, which may lead to double key unregistration after an attacker initiates a connection with specific settings. This situation can trigger an integer overflow, resulting in future key registrations being rejected by ioqueue backends.

Elixir's vim plugin, alchemist.vim is vulnerable to remote code execution in the bundled alchemist-server. A malicious website can execute requests against an ephemeral port on localhost that are then evaluated as elixir code.

The samtools htslib library version 1.4.0 and earlier is vulnerable to buffer overflow in the CRAM rANS codec, potentially leading to arbitrary code execution.

ROOT version 6.9.03 and below is vulnerable to an authenticated shell metacharacter injection in the rootd daemon resulting in remote code execution.

VMware Workstation (12.x before 12.5.8) and Horizon View Client for Windows (4.x before 4.6.1) contain an out-of-bounds read vulnerability in the JPEG2000 parser in TPView.dll. On Workstation, this may allow a guest to execute code or perform a Denial of Service on the Windows OS that runs Workstation.

VMware Workstation (12.x before 12.5.8) and Horizon View Client for Windows (4.x before 4.6.1) contain an out-of-bounds read vulnerability in JPEG2000 parser in TPView.dll. This may allow a guest to execute code or perform a Denial of Service on the Windows OS that runs Workstation or Horizon View Client.

VMware Workstation (12.x before 12.5.8) and Horizon View Client for Windows (4.x before 4.6.1) contain an out-of-bounds write vulnerability in JPEG2000 parser in TPView.dll. On Workstation, this may allow a guest to execute code or perform a Denial of Service on the Windows OS that runs Workstation.