CVE Vulnerability Catalog

The image_alloc function in bpgenc.c in libbpg version 0.9.7 has an integer overflow, resulting in an invalid malloc and NULL pointer dereference.

A NULL Pointer Dereference exists in VideoLAN x265, used in libbpg 0.9.7 and other products, due to mishandling of memory-allocation failure in the CUData::initialize function.

In Varnish HTTP Cache versions 4.1.x before 4.1.9 and 5.x before 5.2.1, a vulnerability allows remote attackers to obtain sensitive information from process memory. This issue arises because a VFP_GetStorage buffer is larger than intended in certain circumstances involving Stevedore transient objects.

In tboot versions up to 1.9.6, certain function pointers are not validated, which can lead to arbitrary code execution. This allows local users to overwrite dynamic PCRs of the Trusted Platform Module (TPM) by hooking these function pointers.

PNP4Nagios through 0.6.26 has /usr/bin/npcd and npcd.cfg owned by an unprivileged account. Exploiting these files can lead to root code execution by local users.

A vulnerability in the server content cache of TIBCO JasperReports Server allows remote access to all contents of the web application, including key configuration files. Affected releases are version 6.4.0 of various TIBCO JasperReports Server editions.

The sctp_do_peeloff function in the Linux kernel before version 4.14 does not check whether the intended netns is used in a peel-off action, which can lead to denial of service (use-after-free and system crash) or other unspecified impacts via crafted system calls.

Livebox 1.1 allows remote authenticated users to upload arbitrary configuration files, download the configuration file, or obtain sensitive information via crafted Javascript.

Konversation versions 1.4.x, 1.5.x, 1.6.x, and 1.7.x before 1.7.3 are vulnerable to a denial of service (DoS) attack due to improper parsing of IRC color formatting codes.

The send function in the ezcMailMtaTransport class in Zeta Components Mail before version 1.8.2 does not properly restrict the set of characters used in the ezcMail returnPath property, which might allow remote attackers to execute arbitrary code via a crafted email address.

The compilation daemon in Scala before 2.10.7, 2.11.x before 2.11.12, and 2.12.x before 2.12.4 uses weak permissions for private files in /tmp/scala-devel/${USER:shared}/scalac-compile-server-port, allowing local users to write to arbitrary class files and consequently gain privileges.

The ntguard.sys driver in IKARUS anti.virus version 2.16.7 contains an Arbitrary Write vulnerability due to not validating input values from IOCtl 0x8300000c.

Cacti before 1.0.0 allows remote authenticated users to conduct PHP object injection attacks and execute arbitrary PHP code via a crafted serialized object.

The camel-castor component in Apache Camel 2.x before 2.19.4 and 2.20.x before 2.20.1 is vulnerable to Java object de-serialization vulnerability. De-serializing untrusted data can lead to security flaws.

The camel-hessian component in Apache Camel versions 2.x before 2.19.4 and 2.20.x before 2.20.1 is vulnerable to a Java object de-serialization vulnerability. De-serializing untrusted data can lead to serious security flaws.

The language converter in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows attribute injection attacks via glossary rules.

The language converter in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows attackers to replace text inside tags via a rule definition followed by 'a lot of junk.'

MediaWiki versions before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2, when a private wiki is configured, provide different error messages for failed login attempts depending on whether the username exists. This allows remote attackers to enumerate account names and conduct brute-force attacks.

The api.php in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 has a Reflected File Download vulnerability.

D-Link DCS-936L devices with firmware before version 1.05.07 have an inadequate CSRF protection mechanism that requires the device's IP address to be a substring of the HTTP Referer header.