CVE Vulnerability Catalog

The buddy-ng.c file in Aircrack-ng before version 1.2 Beta 3 contains a vulnerability that allows remote attackers to cause a denial of service (segmentation fault) via a response with a crafted length parameter.

WPA and WPA2 that support IEEE 802.11r allow reinstallation of the Pairwise Transient Key (PTK) Temporal Key (TK) during the fast BSS transmission (FT) handshake, enabling an attacker within radio range to replay, decrypt, or spoof frames.

The store_versioninfo_gnu_verdef function in radare2 2.0.0 allows remote attackers to cause a denial of service via a crafted ELF file, leading to an invalid write in r_read_le16 and application crash.

CVE-2017-9368 is an information disclosure vulnerability in the BlackBerry Workspaces Server that could allow an attacker to gain access to source code for server-side applications by crafting a request for specific files.

A directory traversal vulnerability in the BlackBerry Workspaces Server could potentially allow an attacker to execute or upload arbitrary files, or reveal the content of arbitrary files anywhere on the web server by crafting a URL with a manipulated POST request.

In GeForce Experience (GFE) 3.x before 3.10.0.55, there is a vulnerability in NVIDIA Installer Framework where a value passed from a user to the driver is used without validation. This may lead to denial of service or possible escalation of privileges.

Heap-based buffer overflow in the pcnet_receive function in hw/net/pcnet.c in QEMU allows guest OS administrators to cause a denial of service (instance crash) or possibly execute arbitrary code via a series of packets in loopback mode.

A race condition in the ALSA subsystem in Linux kernel before 4.13.8 allows local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted /dev/snd/seq ioctl calls.

ASX to MP3 converter version 3.1.3.7.2010.11.05 has a buffer overflow vulnerability via a crafted M3U file, which is related to CVE-2009-1324.

A use-after-free vulnerability in OpenSMTPD before 5.7.2 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via vectors involving req_ca_vrfy_smtp and req_ca_vrfy_mta.

Aruba Networks ClearPass Policy Manager before 6.4.7 and 6.5.x before 6.5.2 allows remote attackers to gain shell access and execute arbitrary code with root privileges via unspecified vectors.

The vulnerability in Berta CMS allows unrestricted file uploads, enabling remote attackers to execute arbitrary code by uploading a crafted image file with an executable extension.

Nero 7.10.1.0 has an unquoted BINARY_PATH_NAME for NBService, allowing exploitation via a Trojan horse Nero.exe file in the %PROGRAMFILES(x86)%\Nero directory.

SAP Hostcontrol does not require authentication for the SOAP SAPControl endpoint, which may lead to unauthorized access.

The Java component in SAP CRM is vulnerable to CSRF (Cross-Site Request Forgery). This issue is documented in SAP Security Note 2478964.

Xpress Server in SAP POS does not require authentication for read/write/delete file access. This poses a serious security risk to data.

Xpress Server in SAP POS does not require authentication for file read and erase operations, daemon shutdown, terminal read operations, or certain attacks on credentials.

CVE-2017-14952 is a double free vulnerability in i18n/zonemeta.cpp in International Components for Unicode (ICU) version 59.1. It allows remote attackers to execute arbitrary code via a crafted string.

Apache Struts 2.x before version 2.3.29 allows remote attackers to execute arbitrary code via a "%{}" sequence in a tag attribute, known as forced double OGNL evaluation.

Fiyo CMS version 2.0.1.8 allows remote attackers to bypass intended access restrictions and execute the super administrator functions 'Install and Update' or 'Backup' via the view parameter in a direct request to fiyo/dapur.