CVE Vulnerability Catalog

A vulnerability in libcurl related to improper handling of IMAP FETCH responses when the data size is zero bytes. The deliver-data function may attempt to read data from a buffer that is not properly terminated, potentially leading to reading memory beyond the allocated area.

CVE-2017-10954 allows remote attackers to execute arbitrary code on vulnerable installations of Bitdefender Internet Security 2018 prior to build 7.72918. User interaction is required to exploit this vulnerability, meaning the target must visit a malicious page or open a malicious file.

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.0.14878. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.2.1.6871. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.2.1.6871. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.2.1.6871. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

CVE-2017-10945 allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.0.14878. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Foxit Reader 8.3.0.14878. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Joyent Smart Data Center prior to [email protected]. The issue exists within the docker API, which does not properly validate user-supplied data, allowing for the upload of arbitrary files.

The HashiCorp Vagrant VMware Fusion plugin version 5.0.0 is vulnerable to a local attack that allows silent subversion of the plugin update process, potentially leading to root privilege escalation.

An issue exists in Mahara before 15.04.14, 16.x before 16.04.8, 16.10.x before 16.10.5, and 17.x before 17.04.3 that allows access to a user's account after closing the browser without logging out. The value in the usr_session table is not removed, enabling access to the account by reopening the browser and adjusting the 'mahara' cookie to the old value.

An SQL Injection vulnerability exists in HP ArcSight ESM and HP ArcSight ESM Express in any 6.x version prior to 6.9.1c Patch 4 or 6.11.0 Patch 1. This vulnerability could be exploited remotely to allow SQL injection.

libvirt version 2.3.0 and later is vulnerable to a bad default configuration of 'verify-peer=no', resulting in a failure to validate SSL/TLS certificates by default.

Network Data Loss Prevention is vulnerable to MIME type sniffing, allowing older versions of Internet Explorer to perform MIME sniffing on the response body. This may lead to the response body being interpreted and displayed as a content type other than the intended content type.

Flexense SyncBreeze Enterprise version 10.1.16 is vulnerable to a buffer overflow that can be exploited for arbitrary code execution. The flaw is triggered by providing a long input into the 'Destination directory' field, either within an XML document or through use of passive mode.

Zomato Clone Script allows SQL Injection via the resid parameter in the restaurant-menu.php file.

Website Broker Script allows SQL Injection via the 'status_id' Parameter to status_list.php.

Vastal I-Tech Agent Zone (also known as The Real Estate Script) allows SQL Injection in searchCommercial.php via the property_type, city, or posted_by parameter, and in searchResidential.php via the property_type, city, or bedroom parameter.

Php Inventory & Invoice Management System allows Arbitrary File Upload via dashboard/edit_myaccountdetail/.

The Online Exam Test Application allows SQL Injection via the sort parameter in resources.php in a category action.