CVE Vulnerability Catalog

Versions of Puppet prior to 4.10.1 deserialize data sent from the agent to the server in an attacker-specified format. This could lead to unsafe YAML deserialization, resulting in remote code execution.

Versions of Puppet Enterprise prior to 2016.4.5 and 2017.2.1 failed to mark MCollective server private keys as sensitive, which could lead to their logging and storage in PuppetDB.

IBM Security Guardium versions 10.0 and 10.1 are vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, allowing them to view, add, modify, or delete information in the back-end database.

The grub_memmove function in radare2 1.5.0 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) via a crafted binary file.

In ImageMagick 7.0.6-0, a heap-based buffer over-read in the GetNextToken function allows remote attackers to obtain sensitive information from process memory. This issue can be triggered by a crafted SVG document mishandled in the GetUserSpaceCoordinateValue function.

The grant-table feature in Xen through 4.8.x mishandles MMIO region grant references, allowing guest OS users to cause a denial of service (loss of grant trackability).

The grant-table feature in Xen through 4.8.x does not ensure sufficient type counts for GNTMAP_device_map and GNTMAP_host_map mapping, which may lead to denial of service or privileged host OS access.

The grant-table feature in Xen through 4.8.x mishandles a GNTMAP_device_map and GNTMAP_host_map mapping, which can lead to count mismanagement and memory corruption. Guest OS users can cause a denial of service or gain privileged host OS access.

Xen through 4.8.x does not validate memory allocations during certain P2M operations, allowing guest OS users to obtain privileged host OS access, known as XSA-222.

Xen versions up to 4.8.x do not validate the port numbers of polled event channel ports, allowing guest OS users to cause a denial of service (NULL pointer dereference and host OS crash) or possibly obtain sensitive information.

The vCPU context-switch implementation in Xen through 4.8.x improperly interacts with the Memory Protection Extensions (MPX) and Protection Key (PKU) features, making it easier for guest OS users to defeat ASLR and other protection mechanisms.

The shadow-paging feature in Xen through 4.8.x mismanages page references, leading to a race condition. This allows guest OS users to obtain Xen privileges, known as XSA-219.

The grant-table feature in Xen through 4.8.x has a race condition leading to a double free, allowing guest OS users to cause a denial of service (memory consumption) or possibly obtain sensitive information or gain privileges.

The grant-table feature in Xen through 4.8.x provides false mapping information in certain cases of concurrent unmap calls, allowing backend attackers to obtain sensitive information or gain privileges.

Xen through 4.8.x mishandles page transfer, which allows guest OS users to obtain privileged host OS access, aka XSA-217.

A memory leak in the virtio_gpu_object_create function in the Linux kernel through version 4.11.8 allows attackers to cause a denial of service by triggering object-initialization failures.

In Odoo 8.0, Odoo Community Edition 9.0 and 10.0, and Odoo Enterprise Edition 9.0 and 10.0, incorrect access control on OAuth tokens in the OAuth module allows remote authenticated users to hijack OAuth sessions of other users.

In Odoo 8.0, Odoo Community Edition 9.0 and 10.0, and Odoo Enterprise Edition 9.0 and 10.0, remote attackers can bypass authentication under certain circumstances because parameters containing 0x00 characters are truncated before reaching the database layer.

JabberD 2.x before version 2.6.1 allows anyone to authenticate using SASL ANONYMOUS, even when the sasl.anonymous c2s.xml option is not enabled.

An issue was discovered on Humax Digital HG100 2.0.6 devices that allows an attacker to find root credentials in the backup file, known as GatewaySettings.bin.