CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.07.24)
The daemon in rsync versions 3.1.2 and 3.1.3-development before 2017-12-03 does not check fnamecmp filenames in the daemon_filter_list data structure and does not apply the sanitize_paths protection mechanism to pathnames found in 'xname follows' strings. This allows remote attackers to bypass intended access restrictions.
The SMI-S service in Dell Storage Manager versions earlier than 16.3.20 is protected using a hard-coded password. A remote user with knowledge of the password might potentially disable the SMI-S service via HTTP requests, affecting storage management and monitoring functionality via the SMI-S interface.
In Android for MSM, Firefox OS for MSM, and QRD Android, a buffer overflow vulnerability exists during the processing of a downlink supplementary services message. This affects all Android releases using the Linux kernel.
In Android for MSM, Firefox OS for MSM, and QRD Android, there is an issue with the GPS location wireless interface that can lead to a Use After Free condition.
In Android for MSM, Firefox OS for MSM, QRD Android, with all Android releases from CAF using the Linux kernel, buffer sizes in the message passing interface are not properly validated.
In Android for MSM, Firefox OS for MSM, and QRD Android, there is an issue with improper validation of buffer sizes in the message passing interface.
In Android for MSM, Firefox OS for MSM, and QRD Android, there is an issue with handling in the global client structure, which may lead to stale handles.
In Android for MSM, Firefox OS for MSM, and QRD Android, there is an issue with improper validation of a count value read from a file.
The SafeSwitch test application in Android for MSM, Firefox OS for MSM, and QRD Android has an issue with improper validation of the number of blocks to verify.
In Android for MSM, Firefox OS for MSM, and QRD Android, a Use After Free condition can occur during positioning.
In Android for MSM, Firefox OS for MSM, and QRD Android, a Use After Free condition can occur during a deinitialization path.
In Android for MSM, Firefox OS for MSM, and QRD Android, there is a privilege escalation vulnerability in telephony affecting all Android releases from CAF using the Linux kernel.
In Android for MSM, Firefox OS for MSM, and QRD Android, a buffer overflow vulnerability exists while reading firmware logs. This affects all Android releases from CAF using the Linux kernel.
In Android for MSM, Firefox OS for MSM, and QRD Android, there is an issue with reduced cryptographic strength while deriving the disk encryption key. This affects all Android releases from CAF using the Linux kernel.
The most package in Debian wheezy before 5.0.0a-2.2, in Debian jessie before 5.0.0a-2.3+deb8u1, and in Debian unstable before 5.0.0a-3 allows remote attackers to execute arbitrary commands via shell metacharacters in the name of an LZMA-compressed file.
The remote management interface on the Claymore Dual GPU miner 10.1 allows an unauthenticated remote attacker to execute arbitrary code due to a stack-based buffer overflow in the request handler. This can be exploited via a long API request that is mishandled during logging.
The OhMiBod Remote app for Android and iOS allows remote attackers to impersonate users by sniffing network traffic for search responses from the OhMiBod API server and then editing the username, user_id, and token fields in the OMB.xml file.
Version 2.2.4.8 and earlier of iSmartAlarm CubeOne firmware has a vulnerability that allows password file exposure. Attackers can retrieve credentials from this file, enabling them to execute arbitrary commands with administrative privileges.
In Apache Qpid Broker-J versions 0.18 through 0.32, misconfiguration of ports with different authentication providers can allow a remote attacker connecting to the HTTP port to trick the broker into using an authentication provider from another port. The attacker must have valid credentials for the provider on the spoofed port.
Improper authentication issue in PTW-WMS1 firmware version 2.000.012 allows remote attackers to log in to the device with root privileges and conduct arbitrary operations via unspecified vectors.