CVE Vulnerability Catalog

eClinicalWorks Population Health (CCMR) has a cross-site request forgery (CSRF) vulnerability in portalUserService.jsp that allows remote attackers to hijack the authentication of content administrators. This could lead to the creation, modification, and deletion of users, appointments, and employees.

eClinicalWorks Population Health (CCMR) has an SQL injection vulnerability in portalUserService.jsp, allowing remote authenticated users to inject arbitrary malicious database commands as part of user input.

Splunk Web in Splunk Enterprise before version 5.0.17, 6.0.13, 6.1.12, 6.2.12, 6.3.8, and 6.4.4 is vulnerable to HTTP request injection attacks, allowing remote attackers to obtain sensitive REST API authentication-token information.

D-Link DGS-1100 devices with Rev.B firmware 1.01.018 have a hardcoded SSL private key, allowing man-in-the-middle attackers to spoof devices by hijacking an HTTPS session.

An issue was discovered in Linux Containers (LXC) before February 22, 2016, allowing escape from the container. By using lxc-attach, a nonprivileged session can escape to the parent session via the TIOCSTI ioctl, enabling an attacker to break out of the container.

An issue was discovered in Pivotal GemFire for PCF 1.6.x versions prior to 1.6.5 and 1.7.x versions prior to 1.7.1 regarding unauthenticated access to the gfsh (Geode Shell) endpoint. This endpoint is publicly accessible, allowing attackers to execute any commands.

An issue was discovered in Pivotal Spring Security before version 3.2.10, 4.1.x before 4.1.4, and 4.2.x before 4.2.1 regarding the lack of consideration for URL path parameters when processing security constraints. An attacker may bypass these constraints by adding an encoded '/' parameter to a request.

An issue was discovered in EMC ScaleIO versions before 2.0.1.1, allowing a low-privileged local attacker to modify kernel memory in the SCINI driver. This may lead to code execution and privilege escalation to root on ScaleIO Data Client (SDC) servers.

An integer overflow in the process_bin_sasl_auth function in Memcached can be exploited to cause heap overflow and lead to remote code execution.

Multiple integer overflows in the process_bin_update function in Memcached can be exploited to cause heap overflow and lead to remote code execution.

An integer overflow in the process_bin_append_prepend function in Memcached can be exploited to cause heap overflow and lead to remote code execution.

An exploitable out-of-bounds write vulnerability exists in the XMP image handling functionality of the FreeImage library. A specially crafted XMP file can cause an arbitrary memory overwrite resulting in code execution.

There is a heap-based buffer overflow vulnerability in the handling of TIFF images in LibTIFF's TIFF2PDF tool. A crafted TIFF document can lead to remote code execution.

A heap overflow vulnerability exists in the Compound Binary File Format (CBFF) parser functionality of the Lexmark Perceptive Document Filters library. A specially crafted CBFF file can lead to code execution.

An exploitable out-of-bounds write exists in the Bzip2 parsing of the Lexmark Perspective Document Filters conversion functionality. A crafted Bzip2 document can lead to a stack-based buffer overflow causing an out-of-bounds write which under the right circumstance could potentially be leveraged by an attacker to gain arbitrary code execution.

An exploitable buffer overflow exists in the XLS parsing of the Lexmark Perspective Document Filters conversion functionality. A crafted XLS document can lead to a stack based buffer overflow resulting in remote code execution.

A vulnerability in Hancom Office 2014 allows for a buffer overflow when processing a Hangul HShow Document (.hpt) due to an integer overflow. This can lead to overwriting heap data, enabling code execution under the application's context.

A vulnerability in Hancom Office 2014 allows for heap corruption when processing a Hcell (.cell) document using the CSSValFormat object. The flaw occurs when the application incorrectly writes a null terminator outside the bounds of its destination, potentially leading to code execution.

CVE-2016-4295 affects Hancom Office 2014 and can lead to a heap overflow when processing a Hangul Hcell Document (.cell). The issue arises from an index miscalculation while processing formula data used to render a chart.

CVE-2016-4294 affects Hancom Office 2014, which can lead to a heap-based buffer overflow when opening a Hangul Hcell document (.cell). The issue occurs while processing a property record within the Workbook stream, where the application uses an incorrect size to copy user-supplied data.