CVE Vulnerability Catalog

In Apache httpd versions 2.2.x before 2.2.33 and 2.4.x before 2.4.26, the mod_ssl module may dereference a NULL pointer when third-party modules call ap_hook_process_connection() during an HTTP request to an HTTPS port.

In Apache httpd versions 2.2.x before 2.2.33 and 2.4.x before 2.4.26, the use of ap_get_basic_auth_pw() by third-party modules outside of the authentication phase may lead to authentication requirements being bypassed.

In Lenovo XClarity Administrator (LXCA) before version 1.3.0, downloading service data may allow non-administrative users access to password information for users who have previously authenticated to LXCA's internal LDAP server. This includes administrative accounts and service accounts with administrative privileges.

CVE-2017-3743 vulnerability allows the disclosure of user ID and clear text password when multiple users are concurrently logged into a system. When one user sends a command to a second machine using Lenovo tools, other users may see this information while the command is processing.

WiMAX routers based on the MediaTek SDK (libmtk) using a custom httpd plugin are vulnerable to an authentication bypass, allowing a remote, unauthenticated attacker to gain administrator access to the device by performing an administrator password change via a crafted POST request.

The Milwaukee ONE-KEY Android mobile application stores the master token in plaintext in the apk binary.

The grub_ext2_read_block function in GNU GRUB before 2013-11-12, as used in radare2 1.5.0, allows remote attackers to cause a denial of service via a crafted binary file, leading to excessive stack use and application crash.

The Linux Kernel running on AMD64 systems will sometimes map the contents of PIE executable, the heap or ld.so to where the stack is mapped allowing attackers to more easily manipulate the stack.

The qsort() function in NetBSD is recursive and not randomized, allowing an attacker to construct a pathological input array that causes deterministic recursion N/4 times. This enables attackers to consume arbitrary amounts of stack memory and manipulate stack memory to assist in arbitrary code execution attacks.

libffi requests an executable stack, allowing attackers to more easily trigger arbitrary code execution by overwriting the stack. It was previously stated that this affects libffi version 3.2.1, which appears to be incorrect, as the vulnerability exists in libffi versions prior to 3.1 on 32-bit x86 systems.

NetBSD maps the run-time link-editor ld.so directly below the stack region, even if ASLR is enabled, allowing attackers to more easily manipulate memory leading to arbitrary code execution.

A flaw exists in NetBSD's implementation of the stack guard page that allows attackers to bypass it resulting in arbitrary code execution using certain setuid binaries. This affects NetBSD 7.1 and possibly earlier versions.

A flaw exists in OpenBSD's implementation of the stack guard page that allows attackers to bypass it resulting in arbitrary code execution using setuid binaries such as /usr/bin/at. This affects OpenBSD 6.1 and possibly earlier versions.

The offset2lib patch used by the Linux Kernel contains a vulnerability that occurs when RLIMIT_STACK is set to RLIM_INFINITY and 1 Gigabyte of memory is allocated. As a result, the stack may grow to 0x80000000, allowing an attacker to jump over the stack guard page.

The offset2lib patch in the Linux Kernel contains a vulnerability that allows a PIE binary to be execve()'d with 1GB of arguments or environmental strings, leading to the stack occupying the address 0x80000000. The PIE binary is mapped above 0x40000000, nullifying the protection of the offset2lib patch.

glibc contains a vulnerability that allows specially crafted LD_LIBRARY_PATH values to manipulate the heap/stack, potentially resulting in arbitrary code execution. This affects glibc 2.25 and earlier.

The Linux Kernel imposes a size restriction on the arguments and environmental strings passed through RLIMIT_STACK/RLIM_INFINITY, but does not take the argument and environment pointers into account, allowing attackers to bypass this limitation. This affects Linux Kernel versions 4.11.5 and earlier.

An issue was discovered in the size of the stack guard page on Linux. A 4k stack guard page is not sufficiently large and can be 'jumped' over, affecting Linux Kernel versions 4.11.5 and earlier.

Zenbership 1.0.8 has an SQL Injection vulnerability in admin/index.php via the filters array parameter, exploitable by a privileged account.

IPFire 2.19 has a Remote Command Injection vulnerability in ids.cgi via the OINKCODE parameter, which is mishandled by a shell. This can be exploited directly by authenticated users, or through CSRF.