CVE Vulnerability Catalog

The kluser is able to interact with the kav4fs-control binary in Kaspersky Anti-Virus for Linux File Server before Maintenance Pack 2 Critical Fix 4 (version 8.0.4.312). By abusing the quarantine read and write operations, it is possible to elevate the privileges to root.

The FR-GV-301 issue in FreeRADIUS 3.x before version 3.0.15 allows a buffer overflow in the 'data2vp_wimax()' function, potentially leading to a daemon crash or arbitrary code execution by remote attackers.

The FR-GV-202 issue in FreeRADIUS 2.x before version 2.2.10 allows for a buffer overflow in the rad_coalesce() function. This can lead to a daemon crash or potentially allow remote attackers to execute arbitrary code.

EMC ViPR SRM, EMC Storage M&R, EMC VNX M&R, and EMC M&R for SAS Solution Packs contain undocumented accounts with default passwords for Webservice Gateway and RMI JMX components. A remote attacker with knowledge of the default password may use these accounts to run arbitrary web service and remote procedure calls on the affected system.

Apache OpenMeetings version 1.0.0 uses weak cryptographic storage mechanisms. Additionally, the lack of captcha in registration and password reset forms, as well as missing brute force protection in authentication forms, increases the risk.

Uploaded XML documents were not correctly validated in Apache OpenMeetings 3.1.0.

A command injection vulnerability in the IDP feature of Juniper Networks Junos OS on SRX series devices potentially allows a user with login access to execute shell commands and elevate privileges.

On Junos OS devices with SNMP enabled, a network-based attacker with unfiltered access to the RE can cause the snmpd daemon to crash and restart by sending a crafted SNMP packet. Repeated crashes can lead to a partial denial of service condition and may allow for remote code execution.

The Integrated User Firewall (UserFW) feature in Junos OS version 12.1X47-D10 on Juniper SRX devices introduced integration of user profiles with existing firewall policies. During a security review, hardcoded credentials were identified and removed, which can impact both SRX devices and integrated LDAP and Active Directory points.

A reflected cross site scripting vulnerability in the NetScreen WebUI of Juniper Networks Juniper NetScreen Firewall+VPN allows an attacker to inject HTML/JavaScript content into the management session of other users, including the administrator.

In PHP 7.x before 7.0.21 and 7.1.x before 7.1.7, the msgfmt_parse_message function in msgformat_parse.c does not restrict locale length, which can lead to stack-based buffer overflow and application crash.

Fiyo CMS version 2.0.7 has an SQL injection vulnerability in sys_article.php via the name parameter when editing or adding a tag name.

dataTaker DT8x dEX w wersji 1.72.007 pozwala zdalnym atakującym na tworzenie programów lub harmonogramów, co może prowadzić do wysyłania wiadomości e-mail lub nawiązywania połączeń z serwerami FTP w celu przesyłania danych.

Zoho ManageEngine Desktop Central before build 100092 allows remote attackers to execute arbitrary code via vectors involving the upload of help desk videos.

GLPI versions before 9.1.5 are vulnerable to SQL injection via an ajax/getDropdownValue.php request with an entity_restrict parameter that is not a list of integers.

A specific device configuration can lead to a situation where a user logs in without being prompted for a password. This issue occurs due to a failure in committing configuration changes, potentially allowing unauthorized access.

The re-key admin monitor was introduced in Jenkins 1.498, re-encrypting all secrets in JENKINS_HOME with a new key and creating a backup directory with old secrets and the key used for encryption. These backups were world-readable and not removed afterwards.

ONOS version 1.9.0 is vulnerable to unauthenticated upload of applications (.oar), leading to remote code execution.

Creolabs Gravity version 1.0 is vulnerable to a stack overflow in the memcmp function.

Creolabs Gravity version 1.0 is vulnerable to a stack overflow in the string_repeat() function.