CVE Vulnerability Catalog

In FreeIPA before version 4.2.2, the ipa-kra-install script places the CA agent certificate and private key in /etc/httpd/alias/kra-agent.pem, which is world readable.

Xiph.Org libvorbis version 1.3.5 allows Remote Code Execution upon freeing uninitialized memory in the function vorbis_analysis_headerout() in info.c when vi->channels is less than or equal to 0.

In sam2p version 0.49.3, there is an integer signedness error in the pcxLoadRaster function in in_pcx.cpp, leading to a heap-based buffer overflow.

In sam2p version 0.49.3, an integer overflow exists in the pcxLoadImage24 function of the file in_pcx.cpp, leading to an invalid write operation.

In version 0.49.3 of sam2p, a heap-based buffer overflow exists in the pcxLoadImage24 function of the file in_pcx.cpp.

ImageMagick version 7.0.7-0 Q16 has a NULL Pointer Dereference vulnerability in the function sixel_decode in coders/sixel.c.

ImageMagick version 7.0.7-0 Q16 has a NULL Pointer Dereference vulnerability in the function sixel_output_create in coders/sixel.c.

ImageMagick version 7.0.7-0 Q16 has a NULL Pointer Dereference vulnerability in the function PostscriptDelegateMessage in coders/ps.c.

In Joomla! before version 3.8.0, inadequate escaping in the LDAP authentication plugin can result in a disclosure of a username and password.

A use-after-free vulnerability in Decoder.cpp in libpgf before version 6.15.32 may lead to unauthorized memory access.

In LibRaw through version 0.18.4, an out of bounds read flaw related to kodak_65000_load_raw has been reported in dcraw/dcraw.c and internal/dcraw_common.cpp. An attacker could possibly exploit this flaw to disclose potentially sensitive memory or cause an application crash.

In Apache Struts versions 2.0.0 through 2.3.33 and 2.5 through 2.5.10.1, using an unintentional expression in a Freemarker tag instead of string literals can lead to a remote code execution (RCE) attack.

The Convention plugin in Apache Struts versions 2.3.x before 2.3.31 and 2.5.x before 2.5.5 allows for the preparation of a special URL that can be used for path traversal and execution of arbitrary code on the server side.

The Helpdesk Pro plugin before version 1.4.0 for Joomla! contains multiple SQL injection vulnerabilities that allow remote attackers to execute arbitrary SQL commands via the ticket_code, email, or filter_order parameters.

On BE126 WIFI repeater 1.0 devices, an attacker can log into telnet (which is open by default) with default credentials as root (username: "root", password: "root"). After logging in, they can read, write to the file system, or execute any code.

On BE126 WIFI repeater 1.0 devices, an attacker can log into telnet (which is open by default) with default credentials as root (username: "root", password: "root"). The attacker can make a user connected to the repeater click on a malicious link that will log into the telnet and infect the device with malicious code.

Polycom RealPresence Resource Manager (RPRM) before 8.4 allows attackers to obtain sensitive information and potentially gain privileges by leveraging use of session identifiers as parameters with HTTP GET requests.

CodeIgniter before 2.2.0 makes it easier for attackers to decode session cookies by leveraging fallback to a custom XOR-based encryption scheme when the Mcrypt extension for PHP is not available.

CodeIgniter before 3.0 and Kohana 3.2.3 and earlier and 3.3.x through 3.3.2 allow remote attackers to spoof session cookies, potentially leading to PHP object injection attacks. This issue arises from the use of standard string comparison operators to compare cryptographic hashes.

A buffer overflow vulnerability was discovered in Perl before versions 5.24.3-RC1 and 5.26.1-RC1 in the S_grok_bslash_N function in regcomp.c. This allows a remote attacker to disclose sensitive information or cause a denial of service (application crash) via a crafted regular expression with an invalid '\N{U+...}' escape.