CVE Vulnerability Catalog

An authenticated user of Unitrends Enterprise Backup before version 9.1.2 can execute arbitrary OS commands by sending a specially crafted filename to the /api/restore/download-files endpoint, related to the downloadFiles function in api/includes/restore.php.

Drupal 8 versions before 8.2.8 and 8.3 before 8.3.1 allow critical access bypass by authenticated users if the RESTful Web Services (rest) module is enabled and the site allows PATCH requests.

The cookie feature in the packet action API in the Linux kernel 4.11.x through 4.11-rc7 mishandles the tb nlattr array, allowing local users to cause a denial of service through uninitialized memory access and refcount underflow, potentially leading to system hang or crash.

Samsung Android devices with L(5.0/5.1), M(6.0), and N(7.x) software allow attackers to obtain sensitive information by reading a world-readable log file after an unexpected reboot.

Artifex jbig2dec version 0.13 allows out-of-bounds reads and writes due to an integer overflow in the jbig2_image_compose function in jbig2_image.c during operations on a crafted .jb2 file. This can lead to application crashes or disclosure of sensitive information from process memory.

The aescrypt gem version 1.0.0 for Ruby does not randomize the initialization vector (IV) for the AESCrypt.encrypt and AESCrypt.decrypt functions, allowing attackers to defeat cryptographic protection mechanisms via a chosen plaintext attack.

Artifex jbig2dec version 0.13, used in Ghostscript, allows out-of-bounds writes due to an integer overflow in the jbig2_build_huffman_table function. This can lead to application crashes or potentially the execution of arbitrary code.

Zyxel WRE6505 devices have a default TELNET password of 1234 for the root and admin accounts, which makes it easier for remote attackers to conduct DNS hijacking attacks by reconfiguring the built-in dnshijacker process.

The GNU Multiple Precision Arithmetic Library (GMP) interfaces for PHP through 7.1.4 allow attackers to cause a denial of service (memory consumption and application crash) via operations on long strings.

The cr_tknzr_parse_rgb function in cr-tknzr.c in libcroco versions 0.6.11 and 0.6.12 has an undefined behavior issue when values exceed the range of representable values of type long. This may allow remote attackers to cause application crashes or other unspecified impacts via a crafted CSS file.

Integer overflow in the mark_curve function in Artifex Ghostscript 9.21 allows remote attackers to cause a denial of service (out-of-bounds write and application crash) or possibly have unspecified other impact via a crafted PostScript document.

Nessus 6.10.x before 6.10.5 was found to be vulnerable to a local privilege escalation issue due to insecure permissions when running in Agent Mode.

In Phusion Passenger before version 5.1.0, a known /tmp filename was used during passenger-install-nginx-module execution, which could allow local attackers to gain the privileges of the passenger user.

Apache CXF's STSClient before 3.1.11 and 3.0.13 uses a flawed way of caching tokens associated with delegation tokens. This allows an attacker to craft a token that returns an identifier corresponding to a cached token for another user.

The NFSv2/NFSv3 server in the Linux kernel through version 4.10.11 allows remote attackers to cause a system crash via a long RPC reply. The issue is related to net/sunrpc/svc.c, fs/nfsd/nfs3xdr.c, and fs/nfsd/nfsxdr.c.

In Apache Batik before version 1.9, there is a vulnerability that allows files on the server's filesystem to be revealed to users who send maliciously crafted SVG files. The types of files that can be exposed depend on the user context in which the application is running.

In Apache FOP before version 2.2, there is a vulnerability that allows files on the server's filesystem to be revealed to users sending maliciously crafted SVG files. The types of files that can be shown depend on the user context in which the exploitable application is running.

Sandstorm Cap'n Proto before 0.5.3.1 allows remote crashes related to a compiler optimization. A remote attacker can trigger a segfault in a 32-bit libcapnp application due to overflow in pointer arithmetic calculations.

In Apache Log4j 2.x before version 2.8.2, when using the TCP socket server or UDP socket server to receive log events, a specially crafted binary payload can be sent that, when deserialized, can execute arbitrary code.

IBM API Connect version 5.0.6.0 could allow a remote attacker to execute arbitrary commands on the system, caused by improper validation of URLs for the Developer Portal. An attacker could exploit this vulnerability by crafting a malicious URL.