CVE Vulnerability Catalog

A flaw in the IBM J9 VM class verifier allows untrusted code to disable the security manager and elevate its privileges.

The __skb_flow_dissect function in the Linux kernel before version 4.3 does not ensure initialization of n_proto, ip_proto, and thoff, allowing remote attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a single crafted MPLS packet.

A SQL injection vulnerability in baserCMS versions 3.0.14 and earlier, 4.0.5 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

The 'Dokodemo eye Smart HD' SCR02HD firmware version 1.0.3.1000 and earlier allows remote attackers to bypass access restrictions, enabling them to view information or modify configurations via unspecified vectors.

The 'Dokodemo eye Smart HD' SCR02HD firmware version 1.0.3.1000 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors.

Buffer overflow in the 'megasas_mmio_write' function in Qemu 2.9.0 allows remote attackers to have unspecified impact via unknown vectors.

Buffer overflow in xymon version 4.3.17-1 may lead to unauthorized access or system crashes.

CVE-2015-1401 is a vulnerability related to improper authentication in the 'LDAP / SSO Authentication' (ig_ldap_sso_auth) extension version 2.0.0 for TYPO3. This may lead to unauthorized access to the system.

Multiple SQL injection vulnerabilities have been identified in SmartCMS version 2. These flaws may allow attackers to manipulate database queries.

Insecure use of temporary files in xbindkeys-config version 0.1.3-2 allows remote attackers to execute arbitrary code.

CVE-2014-8428 is a privilege escalation vulnerability in Barracuda Load Balancer 5.0.0.015 due to an improperly protected SSH key.

Version 5.0.0.015 of Barracuda Load Balancer contains hard coded weak credentials.

The 'vp3_decode_frame' function in FFmpeg 1.1.4 moves threads check out of header packet type check, which may lead to improper data processing.

CVE-2017-13707 affects Replibit Backup Manager versions earlier than 2017.08.04, allowing privilege escalation to root level via sudo command execution. Attackers can access the vi program through sudo, enabling them to navigate the filesystem and modify critical files such as /etc/passwd.

In Kaspersky Internet Security for Android version 11.12.4.1622, some exported application activities have weak permissions, which may be exploited by malware to gain unauthorized access to the product's functionality using Android IPC.

A Stack-based Buffer Overflow issue was discovered in SpiderControl SCADA MicroBrowser Versions 1.6.30.144 and prior. Opening a maliciously crafted html file may cause a stack overflow.

A stack-based buffer overflow exists in the D-Link firmware DNR-320L, DNS-320LW, DNR-322L, DNR-326, and DNS-327L in the login_mgr.cgi file. Remote attackers can execute arbitrary code by crafting malformed 'Host' and 'Referer' header values.

The check_login function in D-Link DNR-326 before version 2.10 build 03 allows remote attackers to bypass authentication and log in by setting the username cookie parameter to an arbitrary string.

D-Link DNS-320L firmware before 1.04b12, DNS-327L before 1.03b04 Build0119, DNR-326 1.40b03, DNS-320B 1.02b01, DNS-345 1.03b06, DNS-325 1.05b03, and DNS-322L 2.00b07 allow remote attackers to bypass authentication and log in with administrator permissions by passing the cgi_set_wto command in the cmd parameter and setting the spawned session's cookie to username=admin.

Directory traversal vulnerability in Zen Cart 1.5.4 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the act parameter to ajax.php.