CVE Vulnerability Catalog

An incorrect 'pair?' check in the 'length' procedure in CHICKEN Scheme leads to an unsafe pointer dereference. This allows an attacker to cause a denial of service by passing an improper list to an application that calls 'length'.

The regexp module in YARA 3.5.0 contains a vulnerability that allows remote attackers to cause a denial of service (stack consumption) via a crafted rule mishandled in the _yr_re_emit function.

PivotX version 2.3.11 allows remote authenticated users to execute arbitrary PHP code via vectors involving an upload of a .htaccess file.

CVE-2017-7502 is a null pointer dereference vulnerability in NSS since version 3.24.0 that occurs when the server receives empty SSLv2 messages, leading to denial of service by a remote attacker.

In Junos Space versions prior to 16.1R1, due to an insufficient authorization check, readonly users on the administrative web interface can execute code on the device.

In Junos Space versions prior to 16.1R1, there is a vulnerability due to insufficient authorization checks that allows readonly users on the administrative web interface to create privileged users, enabling privilege escalation.

Juniper Networks QFX3500, QFX3600, QFX5100, QFX5200, EX4300, and EX4600 devices running Junos OS versions 14.1X53 prior to 14.1X53-D40, 15.1X53 prior to 15.1X53-D40, and 15.1 prior to 15.1R2 do not pad Ethernet packets with zeros. As a result, some packets may contain fragments of system memory or data from previous packets.

On Juniper Networks products or platforms running Junos OS versions prior to 12.1X46-D50, 12.1X47-D40, 12.3R13, 12.3X48-D30, 13.2X51-D40, 13.3R10, 14.1R8, 14.1X53-D35, 14.1X55-D35, 14.2R5, 15.1F6, 15.1R3, 15.1X49-D30, 15.1X49-D40, 15.1X53-D35, where RIP is enabled, certain RIP advertisements may cause the RPD daemon to crash, resulting in a denial of service condition.

On Juniper Networks products running Junos OS versions prior to 12.1X46-D55, 12.1X47-D45, 12.3R13, 12.3X48-D35, 13.3R10, 14.1R8, 14.1X53-D40, 14.1X55-D35, 14.2R6, 15.1F2 or 15.1R1, where the BGP add-path feature is enabled with 'send' option or with both 'send' and 'receive' options, a network-based attacker can cause the rpd daemon to crash and restart. Repeated crashes of the rpd daemon can result in an extended denial of service condition.

On Juniper Networks products running Junos OS versions prior to 11.4R13-S3, 12.1X46-D60, 12.3R12-S2, 13.2X51-D40, 13.3R10, 14.1R8, 14.1X53-D12, 14.1X55-D35, 14.2R7, 15.1F6, 15.1R3, 15.1X49-D60, and 15.1X53-D30, when DHCPv6 is enabled, receiving a crafted DHCPv6 packet causes the jdhcpd daemon to crash and restart. Repeated crashes of the jdhcpd process may lead to an extended denial of service condition for subscribers attempting to obtain IPv6 addresses.

On Juniper Networks SRX Series Services Gateways running Junos OS 12.1X46 prior to 12.1X46-D65 and 12.3X48 prior to 12.3X48-D40 and 12.3X48 prior to 12.3X48-D60, the flowd daemon on the primary node may crash and restart when attempting to synchronize a multicast session created via crafted multicast packets.

Apache Hive (JDBC + HiveServer2) before version 1.2.2 and 2.0.x before 2.0.1 does not verify the common name attribute of the certificate during SSL connection setup. This allows a certificate issued for a different domain to be accepted, potentially leading to man-in-the-middle attacks.

The libmpgatofixed32_plugin.dll plugin in VideoLAN VLC media player version 2.2.4 allows remote attackers to cause application crashes or denial of service via a crafted file.

The libflac_plugin.dll in VideoLAN VLC media player version 2.2.4 allows remote attackers to cause a denial of service through heap corruption and application crash by using a crafted FLAC file.

The VirtueMart com_virtuemart component 3.0.14 for Joomla! allows SQL injection by remote authenticated administrators via the virtuemart_paymentmethod_id or virtuemart_shipmentmethod_id parameter to administrator/index.php.

e107 version 2.1.1 allows SQL injection by remote authenticated administrators via the pagelist parameter to e107_admin/menus.php, related to the menuSaveVisibility function.

RMI vulnerability in Hitachi Device Manager before version 8.5.2-01 allows remote attackers to execute internal commands without authentication via RMI ports.

The TLS session cache in FreeRADIUS from versions 2.1.1 to 2.1.7, 3.0.x before 3.0.14, 3.1.x before 2017-02-04, and 4.0.x before 2017-02-04 has a problem with reliably preventing the resumption of an unauthenticated session. This allows remote attackers, such as malicious 802.1X supplicants, to bypass authentication via PEAP or TTLS.

A Cross-Site Request Forgery issue was discovered in Moxa OnCell G3110-HSPA, G3110-HSDPA, G3150-HSDPA, and other versions. The application does not sufficiently verify if a request was intentionally provided by the user, which could allow an attacker to modify the device's configuration.