CVE Vulnerability Catalog

Sanic versions before 0.5.1 allow reading arbitrary files through directory traversal, as demonstrated by the /static/..%2f substring.

In Inedo BuildMaster versions before 5.8.2, XslTransform was used where XslCompiledTransform should have been used.

Savitech driver packages for Windows silently install a self-signed certificate into the Trusted Root Certification Authorities store, which may lead to unauthorized access to the system.

In Joomla! before version 3.8.2, a bug allowed third parties to bypass a user's 2-factor authentication method.

The UserPro plugin before version 4.9.17.1 for WordPress, when used on a site with the 'admin' username, allows remote attackers to bypass authentication and gain administrative access by setting the up_auto_log parameter to 'true' in the QUERY_STRING to the default URI.

The Debut embedded http server contains a remotely exploitable denial of service vulnerability that can be triggered by a single malformed HTTP POST request. The server hangs and eventually replies after approximately 300 seconds with an HTTP 500 error.

Buffer overflow in the ViewerCtrlLib.ViewerCtrl ActiveX control in Avaya IP Office Contact Center before version 10.1.1 allows remote attackers to cause a denial of service (heap corruption and crash) or execute arbitrary code via a long string to the open method.

Buffer overflow in the SoftConsole client in Avaya IP Office before version 10.1.1 allows remote servers to execute arbitrary code via a long response.

Hola VPN version 1.34 has weak permissions (Everyone:F) under %PROGRAMFILES%, allowing local users to gain privileges via a Trojan horse 7za.exe or hola.exe file.

Red Hat JBoss and other Red Hat products allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library.

Datto Windows Agent allows unauthenticated remote command execution via a modified command in conjunction with CVE-2017-16673 exploitation. An attacker could combine this 'primary/secondary' attack with the 'rogue pairing' attack to achieve unauthenticated access to all agent machines running these older DWA versions.

A Buffer Overflow issue was discovered in Asterisk Open Source 13 before 13.18.1, 14 before 14.7.1, and 15 before 15.1.1 and Certified Asterisk 13.13 before 13.13-cert7. No size checking is done when setting the user field for Party B on a CDR, allowing for an arbitrarily large string to be written past the end of the user field storage buffer.

GraphicsMagick 1.3.26 has a vulnerability that allows remote attackers to cause a denial of service through a heap-based buffer overflow in coders/wpg.c, leading to application crash. This issue is related to the AcquireCacheNexus function in magick/pixel_cache.c.

ManageEngine ServiceDesk version 9.3.9328 is vulnerable to arbitrary file downloads due to improper restrictions of the pathname used in the name parameter for the download-snapshot URL. An unauthenticated remote attacker can exploit this vulnerability to download arbitrary files.

ManageEngine ServiceDesk version 9.3.9328 is vulnerable to arbitrary file downloads due to improper restrictions of the pathname used in the filepath parameter for the download-file URL. An unauthenticated remote attacker can exploit this vulnerability to download arbitrary files.

bgpd in FRRouting (FRR) before 2.0.2 and 3.x before 3.0.2, as used in Cumulus Linux before 3.4.3, allows remote attackers to obtain sensitive information via a malformed BGP UPDATE packet from a connected peer, leading to the transmission of unintended data.

It was discovered that the fix for CVE-2017-12163 was not properly shipped in erratum RHSA-2017:2858 for Red Hat Gluster Storage 3.3 for RHEL 6.

It was discovered that the fix for CVE-2017-12151 was not properly shipped in erratum RHSA-2017:2858 for Red Hat Gluster Storage 3.3 for RHEL 6.

Back in Time before version 1.1.24 improperly handles file paths used as arguments to the 'notify-send' command, leading to parts of file paths being executed as shell commands. This could allow an attacker to craft an unreadable file with a specific name to run arbitrary shell commands.