CVE Vulnerability Catalog

picoTCP versions 1.7.0 to 1.5.0 are vulnerable to stack buffer overflow, which may lead to code execution or denial of service attacks.

All versions of windows-cpu by KyleRoss are vulnerable to command injection, which can lead to code execution as the Node.js user.

LightFTP version 1.1 is vulnerable to a buffer overflow in the 'writelogentry' function resulting in denial of service or remote code execution.

CVE-2017-0854 is an information disclosure vulnerability in the Android media framework. It affects versions 7.0, 7.1.1, 7.1.2, and 8.0 of Android.

CVE-2017-0853 is an information disclosure vulnerability in the Android media framework. It affects versions 7.0, 7.1.1, 7.1.2, and 8.0 of Android.

CVE-2017-0847 is a privilege escalation vulnerability in the Android media framework (mediaanalytics). It affects version 8.0 of Android.

The private_address_check ruby gem before 0.4.1 is vulnerable to a bypass due to an incomplete blacklist of common private/local network addresses used to prevent server-side request forgery.

Zoho ManageEngine Applications Manager version 13 before build 13530 is vulnerable to SQL injection via the widgetid parameter in /MyPage.do.

Zoho ManageEngine Applications Manager version 13 before build 13530 is vulnerable to SQL injection via the resourceid parameter in the getResourceProfiles action.

Zoho ManageEngine Applications Manager version 13 before build 13530 is vulnerable to SQL injection via the forpage parameter in the /MyPage.do?method=viewDashBoard request.

Zoho ManageEngine Applications Manager 13 is vulnerable to SQL injection via the groupname parameter in /manageConfMons.do.

Zoho ManageEngine Applications Manager version 13 before build 13530 is vulnerable to SQL injection via the resourceid parameter in a showPlasmaView action.

Zoho ManageEngine Applications Manager version 13 before build 13530 is vulnerable to SQL injection via the haid parameter in the /manageApplications.do?method=AddSubGroup request.

A heap-based buffer overflow in the loadbuf function in formisc.c in procmail 3.22 allows remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted e-mail message.

Privilege escalation vulnerability in the admin portal for Intel Unite App versions 3.1.32.12, 3.1.41.18, and 3.1.45.26 allows an attacker with network access to cause a denial of service and/or information disclosure.

A vulnerability in the upgrade mechanism of Cisco collaboration products based on the Cisco Voice Operating System software platform could allow an unauthenticated, remote attacker to gain unauthorized, elevated access to an affected device. The vulnerability occurs during a refresh upgrade or Prime Collaboration Deployment migration.

In Varnish HTTP Cache versions 4.1.x before 4.1.9 and 5.x before 5.2.1, a vulnerability allows remote attackers to obtain sensitive information from process memory. This issue arises because a VFP_GetStorage buffer is larger than intended in certain circumstances involving Stevedore transient objects.

A vulnerability in the server content cache of TIBCO JasperReports Server allows remote access to all contents of the web application, including key configuration files. Affected releases are version 6.4.0 of various TIBCO JasperReports Server editions.

The camel-castor component in Apache Camel 2.x before 2.19.4 and 2.20.x before 2.20.1 is vulnerable to Java object de-serialization vulnerability. De-serializing untrusted data can lead to security flaws.

The camel-hessian component in Apache Camel versions 2.x before 2.19.4 and 2.20.x before 2.20.1 is vulnerable to a Java object de-serialization vulnerability. De-serializing untrusted data can lead to serious security flaws.