CVE Vulnerability Catalog

PCRE before 8.38 mishandles the /(?=di(?<=(?1))|(?=(.))))/ pattern and related patterns with an unmatched closing parenthesis, allowing remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression.

PCRE before 8.38 mishandles (?123) subroutine calls and related subroutine calls, allowing remote attackers to cause a denial of service (integer overflow) or possibly have unspecified other impact via a crafted regular expression.

PCRE before 8.38 mishandles the interaction of lookbehind assertions and mutually recursive subpatterns, allowing remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression.

The vulnerability in PCRE before version 8.38 mishandles patterns with certain forward references, which can lead to a buffer overflow and potentially other impacts via a crafted regular expression.

The vulnerability in PCRE before version 8.38 mishandles patterns with certain recursive back references, allowing a remote attacker to cause a denial of service (buffer overflow) or possibly other impacts via a crafted regular expression.

PCRE before 8.38 mishandles certain repeated conditional groups, allowing remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression.

The compile_regex function in PCRE before 8.38 and in PCRE2 before 10.2x mishandles certain group reference patterns, leading to a heap-based buffer overflow.

The pcre_exec function in PCRE before 8.38 mishandles a // pattern with a \01 string, allowing remote attackers to cause a denial of service (heap-based buffer overflow) or possibly have other impacts via a crafted regular expression, as demonstrated by a JavaScript RegExp object in Konqueror.

PCRE before 8.36 mishandles the /((?(R)a|(?1)))+/ pattern and related patterns with certain recursion, allowing remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other impact via a crafted regular expression.

PCRE before 8.36 mishandles the /(((a\2)|(a*)\g<-1>))*/ pattern and related patterns with certain internal recursive back references, allowing remote attackers to cause a denial of service (segmentation fault) or possibly have unspecified other impact via a crafted regular expression.

The publish-event feature in Cisco IOS 15.5(2)S and 15.5(3)S on Cloud Services Router 1000V devices allows local users to execute arbitrary commands with root privileges by leveraging administrative access to enter crafted environment variables.

A vulnerability has been identified in various versions of SIMATIC NET communication processors that may lead to improper enforcement of access protection levels.

In EMC Isilon OneFS versions 7.1.x before 7.1.1.5, 7.2.0.x before 7.2.0.3, and 7.2.1.x before 7.2.1.1, when the RFC 2307 feature is configured but SFU is not universally present, remote authenticated AD users can obtain root privileges via unspecified vectors.

Unspecified vulnerability in Virtual Table Server (VTS) in HP LoadRunner 11.52, 12.00, 12.01, 12.02, and 12.50 allows remote attackers to execute arbitrary code via unknown vectors.

The Jenkins CLI subsystem in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to execute arbitrary code via a crafted serialized Java object, related to a problematic webapps/ROOT/WEB-INF/lib/commons-collections-*.jar file and the 'Groovy variant in 'ysoserial'.

Jenkins before 1.638 and LTS before 1.625.2 allow attackers to bypass intended slave-to-master access restrictions by leveraging a JNLP slave.

CSL DualCom GPRS CS2300-R devices with firmware versions 1.25 through 3.53 use the same default PIN 001984 across different customers' installations, allowing remote attackers to execute commands by leveraging knowledge of this PIN and including it in an SMS message.

The PCo agent in SAP Plant Connectivity (PCo) allows remote attackers to cause a denial of service through memory corruption and agent crash via crafted xMII requests.

The built-in web server in Huawei VP9660 multi-point control unit with software before V200R001C30SPC700 allows remote administrators to obtain sensitive information or cause a denial of service via a crafted message.