CVE Vulnerability Catalog

SQL Injection exists in NexusPHP version 1.5.beta5.20120707 via the usernw array parameter to nowarn.php.

A vulnerability in the JSON library of Ruby (versions up to 2.2.7, 2.3.x through 2.3.4, and 2.4.x through 2.4.1) can expose arbitrary memory during a JSON.generate call. The issue lies in using strdup in ext/json/ext/generator/generator.c, which stops after encountering a null byte, returning a pointer to an empty string inconsistent with the actual length stored in space_len.

Integer overflow in the decode_digit function in puny_decode.c in Libidn2 before version 2.0.4 allows remote attackers to cause a denial of service or possibly have unspecified other impact.

Integer overflow in the _isBidi function in bidi.c in Libidn2 before 2.0.4 allows remote attackers to cause a denial of service or possibly have unspecified other impact.

Buffer overflow in the web server service in VX Search Enterprise 10.0.14 allows remote attackers to execute arbitrary code via a crafted GET request.

CrushFTP versions 8.x before 8.2.0 have a serialization vulnerability.

An Improper Restriction Of Operations Within The Bounds Of A Memory Buffer issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. Researchers have identified multiple vulnerabilities that allow invalid locations to be referenced for the memory buffer, which may allow an attacker to execute arbitrary code or cause the system to crash.

A stack-based buffer overflow issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. Multiple vulnerabilities were identified due to a lack of proper validation of the length of user-supplied data before copying it to a stack-based buffer.

An Improper Authentication issue was discovered in Advantech WebAccess versions prior to V8.2_20170817. Specially crafted requests allow a possible authentication bypass that could allow remote code execution.

CVE-2013-7426 identifies an insecure handling of temporary files in kamailio 4.0.1, specifically concerning the /tmp/kamailio_fifo file. This may lead to unauthorized access to data.

CVE-2017-12865 describes a stack-based buffer overflow in 'dnsproxy.c' in connman versions 1.34 and earlier. This allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted response query string passed to the 'name' variable.

Buffer overflow in the Group messages monitor (Falcon) in KNX ETS 4.1.5 (Build 3246) allows remote attackers to execute arbitrary code via a crafted KNXnet/IP UDP packet.

The Double Opt-In for Download plugin before version 2.0.9 for WordPress contains multiple SQL injection vulnerabilities that allow remote attackers to execute arbitrary SQL commands via the ver parameter in class-doifd-download.php or class-doifd-landing-page.php.

A flaw in the IBM J9 VM class verifier allows untrusted code to disable the security manager and elevate its privileges.

The __skb_flow_dissect function in the Linux kernel before version 4.3 does not ensure initialization of n_proto, ip_proto, and thoff, allowing remote attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a single crafted MPLS packet.

A SQL injection vulnerability in baserCMS versions 3.0.14 and earlier, 4.0.5 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

The 'Dokodemo eye Smart HD' SCR02HD firmware version 1.0.3.1000 and earlier allows remote attackers to bypass access restrictions, enabling them to view information or modify configurations via unspecified vectors.

The 'Dokodemo eye Smart HD' SCR02HD firmware version 1.0.3.1000 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors.

Buffer overflow in the 'megasas_mmio_write' function in Qemu 2.9.0 allows remote attackers to have unspecified impact via unknown vectors.

Buffer overflow in xymon version 4.3.17-1 may lead to unauthorized access or system crashes.