CVE Vulnerability Catalog

In Creolabs Gravity version 1.0, there is a heap buffer overflow vulnerability that may lead to code execution. By creating a large loop while pushing data to a buffer, the bounds checking of that buffer can be bypassed.

In Creolabs Gravity version 1.0, a Use-After-Free vulnerability exists that may lead to code execution. The issue involves the 'sublexer' pointer being freed and then accessed in the code, resulting in unsafe memory access.

A vulnerability in Swagger-Parser's yaml parsing functionality (version <= 1.0.30) allows arbitrary code execution when a maliciously crafted yaml Open-API specification is parsed. This particularly affects the 'generate' and 'validate' commands in swagger-codegen (<= 2.2.2).

tcmu-runner versions 1.0.5 to 1.2.0 are vulnerable to a dbus triggered NULL pointer dereference in the tcmu-runner daemon's on_unregister_handler() function resulting in denial of service.

tcmu-runner versions 0.91 to 1.20 are vulnerable to information disclosure in handler_qcow.so, allowing non-privileged users to check for the existence of any file with root privileges.

The tcmu-runner daemon versions 0.9.0 to 1.2.0 is vulnerable to invalid memory references in the handler_glfs.so handler, resulting in denial of service.

October CMS version 412 is vulnerable to file path modification in asset move functionality, potentially allowing the creation of malicious files on the server.

October CMS version 412 is vulnerable to PHP code execution in the asset manager functionality, potentially leading to site compromise and possibly affecting other applications on the server.

October CMS version 412 is vulnerable to PHP object injection in asset move functionality, allowing for the deletion of files limited by file permissions on the server.

October CMS build 412 is vulnerable to Apache configuration modification via file upload functionality, potentially leading to site compromise and affecting other applications on the server.

The soyuka/pidusage module in versions <= 1.1.4 is vulnerable to command injection, allowing arbitrary command execution.

picoTCP versions 1.7.0 to 1.5.0 are vulnerable to stack buffer overflow, which may lead to code execution or denial of service attacks.

An address access exception was found in SWFTools pdf2swf in the FoFiTrueType::writeTTF() function.

All versions of windows-cpu by KyleRoss are vulnerable to command injection, which can lead to code execution as the Node.js user.

LightFTP version 1.1 is vulnerable to a buffer overflow in the 'writelogentry' function resulting in denial of service or remote code execution.

CVE-2017-0865 is a privilege escalation vulnerability in the MediaTek soc driver affecting Android, including the Android kernel.

CVE-2017-0864 is a privilege escalation vulnerability in the MediaTek ioctl (flashlight) in Android. It affects the Android kernel.

CVE-2017-0863 describes an elevation of privilege vulnerability in the Upstream kernel video driver affecting Android and its kernel.

CVE-2017-0862 is a privilege escalation vulnerability in the Android kernel. It affects unspecified versions of the Android kernel.

Use-after-free vulnerability in the snd_pcm_info function in the ALSA subsystem in the Linux kernel allows attackers to gain privileges via unspecified vectors.