CVE Vulnerability Catalog

Zoho ManageEngine Applications Manager version 13 before build 13530 is vulnerable to SQL injection via the haid parameter in the /manageApplications.do?method=AddSubGroup request.

A heap-based buffer overflow in the loadbuf function in formisc.c in procmail 3.22 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted e-mail message.

Privilege escalation vulnerability in the admin portal for Intel Unite App versions 3.1.32.12, 3.1.41.18, and 3.1.45.26 allows an attacker with network access to cause a denial of service and/or information disclosure.

A vulnerability in the upgrade mechanism of Cisco collaboration products based on the Cisco Voice Operating System software platform could allow an unauthenticated, remote attacker to gain unauthorized, elevated access to an affected device. The vulnerability occurs during a refresh upgrade or Prime Collaboration Deployment migration.

In Varnish HTTP Cache versions 4.1.x before 4.1.9 and 5.x before 5.2.1, a vulnerability allows remote attackers to obtain sensitive information from process memory. This issue arises because a VFP_GetStorage buffer is larger than intended in certain circumstances involving Stevedore transient objects.

A vulnerability in the server content cache of TIBCO JasperReports Server allows remote access to all contents of the web application, including key configuration files. Affected releases are version 6.4.0 of various TIBCO JasperReports Server editions.

The camel-castor component in Apache Camel 2.x before 2.19.4 and 2.20.x before 2.20.1 is vulnerable to Java object de-serialization vulnerability. De-serializing untrusted data can lead to security flaws.

The camel-hessian component in Apache Camel versions 2.x before 2.19.4 and 2.20.x before 2.20.1 is vulnerable to a Java object de-serialization vulnerability. De-serializing untrusted data can lead to serious security flaws.

The api.php in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 has a Reflected File Download vulnerability.

An issue was discovered on Siemens SICAM RTUs SM-2556 with specific firmware variants that allows unauthenticated remote attackers to execute arbitrary code via the integrated web server.

Vulnerability in the Oracle Tuxedo component of Oracle Fusion Middleware allows low privileged attackers with network access to compromise Oracle Tuxedo. Attackers can gain unauthorized access to critical data and modify it.

Vulnerability in the Oracle Tuxedo component of Oracle Fusion Middleware allows an unauthenticated attacker with network access via Jolt to compromise Oracle Tuxedo. The attacker can gain unauthorized access to critical data and has the ability to create, delete, or modify data.

In BlackBerry QNX Software Development Platform (SDP) 6.6.0, there is an elevation of privilege vulnerability in the default configuration with QNet enabled that could allow an attacker to access local and remote files or take ownership of files on other QNX nodes.

The csnmp_read_table function in the SNMP plugin in collectd before version 5.6.3 is susceptible to a double free in a certain error case, which could lead to a crash.

In Apache CouchDB before version 1.7.0 and 2.x before version 2.1.1, a vulnerability allows submitting _users documents with duplicate 'roles' keys, which can lead to non-admin users being granted admin privileges.

CVE-2017-6274 describes an elevation of Privilege vulnerability in the thermal driver, where missing bounds checks can lead to an out-of-bounds write in the kernel. This issue is rated as moderate.

A vulnerability in the Service Assistant GUI in IBM Storwize V7000 (2076) version 8.1 could allow a remote attacker to perform a privilege escalation.

IBM Tivoli Endpoint Manager (IBM BigFix 9.2 and 9.5) does not require strong passwords by default, making it easier for attackers to compromise user accounts.

A Stack-based Buffer Overflow issue was discovered in Schneider Electric InduSoft Web Studio v8.0 SP2 Patch 1 and prior versions, and InTouch Machine Edition v8.0 SP2 Patch 1 and prior versions. This vulnerability may allow remote code execution with high privileges.

The Recurly Client .NET Library before versions 1.0.1, 1.1.10, 1.2.8, 1.3.2, 1.4.14, 1.5.3, 1.6.2, 1.7.1, 1.8.1 is vulnerable to a Server-Side Request Forgery due to incorrect use of 'Uri.EscapeUriString'. This could lead to compromise of API keys or other critical resources.