CVE Vulnerability Catalog

The x86 emulator in Xen does not properly treat x86 NULL segments as unusable when accessing memory, which might allow local HVM guest users to gain privileges via vectors involving 'unexpected' base/limit values.

Xen, when running on a 64-bit hypervisor, allows local x86 guest OS users to modify arbitrary memory, potentially leading to sensitive information disclosure, host crash, or arbitrary code execution on the host due to broken emulation of bit test instructions.

Xen versions 4.0.x through 4.7.x mishandle x86 task switches to VM86 mode, allowing local 32-bit x86 HVM guest OS users to gain privileges or cause a denial of service (guest OS crash) by leveraging a guest operating system that uses hardware task switching.

A race condition in QEMU in Xen allows local x86 HVM guest OS administrators to gain privileges by changing certain data on shared rings, known as a 'double fetch' vulnerability.

The pygrub boot loader emulator in Xen allows local pygrub-using guest OS administrators to read or delete arbitrary files on the host via NUL bytes in the bootloader configuration file.

The pygrub boot loader emulator in Xen allows local pygrub-using guest OS administrators to read or delete arbitrary files on the host via string quotes and S-expressions in the bootloader configuration file.

Joomla! versions 3.4.4 through 3.6.3 allow attackers to reset username, password, and user group assignments, and possibly perform other user account modifications via unspecified vectors.

CloudVision Portal (CVP) before 2016.1.2.1 allows remote authenticated users to gain access to the internal configuration mechanisms via the management plane, related to a request to /web/system/console/bundle.

Ubiquiti Networks UniFi version 5.2.7 does not restrict access to the database, allowing remote attackers to modify the database by directly connecting to it.

Buffer overflow in the SLPFoldWhiteSpace function in OpenSLP 2.0 may allow remote attackers to have unspecified impact via a crafted string.

ownCloud Desktop before 2.2.3 allows local users to execute arbitrary code and possibly gain privileges via a Trojan library in a 'special path' in the C: drive.

The verify function in Encryption/Symmetric.php in Malcolm Fell jwt before 1.0.3 does not use a timing-safe function for hash comparison, which allows attackers to spoof signatures via a timing attack.

Versions of python-jose before 1.3.2 do not use constant time comparison for HMAC keys, which can be leveraged by attackers in unspecified ways.

Heap-based buffer overflow in the decode_block function in libavcodec/exr.c in FFmpeg before 3.1.3 allows remote attackers to cause an application crash.

The Hipchat Integration Plugin for Bitbucket Server and the HipChat plugins for Confluence and JIRA before specified versions allow remote attackers to obtain the secret key for communicating with HipChat instances by reading unspecified pages.

ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to bypass authentication and impersonate arbitrary users via the UserName HTTP header.

ZOHO WebNMS Framework versions 5.2 and 5.2 SP1 use a weak obfuscation algorithm to store passwords, allowing attackers to obtain cleartext passwords by accessing WEB-INF/conf/securitydbData.xml.

Directory traversal vulnerability in the file download functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to read arbitrary files via a .. (dot dot) in the fileName parameter.

Directory traversal vulnerability in the file upload functionality in ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to upload and execute arbitrary JSP files via a .. (dot dot) in the fileName parameter.

The Doorkeeper gem before version 4.2.0 for Ruby might allow remote attackers to conduct replay attacks or revoke arbitrary tokens due to failure to implement the OAuth 2.0 Token Revocation specification.