CVE Vulnerability Catalog

In ImageMagick before version 7.0.6-1, the coders/mpc.c file does not enable seekable streams, which prevents validation of blob sizes. This allows remote attackers to cause application crashes or potentially other unspecified impacts via an image received from stdin.

Subrion CMS before 4.1.6 has a SQL injection vulnerability in /front/actions.php via the $_POST array.

Subrion CMS before 4.1.5.10 has a SQL injection vulnerability in /front/search.php via the $_GET array.

D-Link DIR-615 before v20.12PTb04 has a second admin account with a BACKDOOR value of 0x1, which might allow remote attackers to gain access via a TELNET connection.

The Humax Wi-Fi Router model HG100R-* version 2.0.6 is prone to an authentication bypass vulnerability via specially crafted requests to the management console. This vulnerability can be exploited remotely when the router is configured to expose the management console.

The Google News and Weather application before version 3.3.1 for Android allows remote attackers to read OAuth tokens by sniffing network traffic due to the lack of SSL.

In Wireshark versions through 2.0.13 and 2.2.x through 2.2.7, the openSAFETY dissector could crash or exhaust system memory. This was addressed by adding length validation.

In Wireshark versions up to 2.0.13 and 2.2.x up to 2.2.7, the WBXML dissector could enter an infinite loop triggered by packet injection or a malformed capture file. This was addressed by adding validation of the relationships between indexes and lengths.

In Wireshark versions 2.0.0 to 2.0.13, the GPRS LLC dissector could enter a large loop, leading to performance issues. This was addressed by using a different integer data type.

In Wireshark versions 2.2.0 to 2.2.7 and 2.0.0 to 2.0.13, the AMQP dissector could crash. This was addressed by checking for successful list dissection.

In Wireshark versions 2.2.0 to 2.2.7 and 2.0.0 to 2.0.13, the MQ dissector could crash. This issue was addressed by validating the fragment length before a reassembly attempt.

In Wireshark versions 2.2.0 to 2.2.7 and 2.0.0 to 2.0.13, the DOCSIS dissector could go into an infinite loop. This was addressed by rejecting invalid Frame Control parameter values.

An issue was discovered in Apport through 2.20.x, where the ExecutablePath field is set in apport/report.py. This allows remote attackers to execute arbitrary code via a crafted .crash file due to a lack of path traversal protection.

gnome-exe-thumbnailer before version 0.9.5 is prone to VBScript Injection when generating thumbnails for MSI files, known as the 'Bad Taste' issue. A local attack can occur if the victim uses the GNOME Files file manager and navigates to a directory containing an .msi file with VBScript code in its filename.

Spice versions through 0.13 are vulnerable to out-of-bounds memory access when processing specially crafted messages from authenticated attacker to the spice server, resulting in crash and/or server memory leak.

A remote command injection vulnerability exists in the Barracuda Load Balancer product line, allowing an authenticated user to execute arbitrary shell commands and gain root privileges. The issue arises from unsanitized data being processed in a system call when the delete_assessment command is issued.

REDCap before 7.5.1 has CSRF in the deletion feature of the File Repository and File Upload components.

IBM MQ Appliance versions 8.0 and 9.0 could allow an authenticated messaging administrator to execute arbitrary commands on the system, caused by command execution.

A stack-based buffer overflow in ASUSwrt-Merlin firmware and ASUS firmware for various ASUS devices allows remote attackers to execute arbitrary code by sending long device information that is mishandled during a strcat to a device list.

Fiyo CMS version 2.0.7 has SQL injection vulnerability in /apps/app_article/controller/editor.php via $_POST['id'] and $_POST['art_title'].