CVE Vulnerability Catalog

Creolabs Gravity version 1.0 is vulnerable to a heap overflow in an undisclosed component that can result in arbitrary code execution.

Creolabs Gravity version 1.0 is vulnerable to a Double Free in gravity_value, potentially leading to modification of unexpected memory locations.

In version 5.1 of EyesOfNetwork (EON), there is an unauthenticated SQL injection vulnerability in eonweb that can lead to remote root access.

Kubernetes versions 1.5.0-1.5.4 are vulnerable to a privilege escalation in the PodSecurityPolicy admission plugin, allowing the use of any existing PodSecurityPolicy object.

rbenv (all current versions) is vulnerable to Directory Traversal in the specification of Ruby version, resulting in arbitrary code execution.

gtk-vnc version 0.4.2 and older does not correctly check framebuffer boundaries when updating, which may lead to memory corruption during rendering.

Framadate version 1.0 is vulnerable to Formula Injection in the CSV Export resulting possible Information Disclosure and Code Execution.

RVM automatically loads environment variables from files in $PWD, leading to command execution vulnerabilities. RVM also executes hooks and installs gems and performs 'bundle install' based on files in $PWD, resulting in code execution.

GlassFish Server version 3.0.1 (build 22) is vulnerable to Java Key Store Password Disclosure, allowing an unauthenticated attacker to obtain the administrative user's plain text password and gain access to the web-based administration interface.

SYN Flood or FIN Flood attack in eCos 1 and other versions of embedded devices results in web Authentication Bypass. eCos Embedded Web Servers fail to validate and handle SYN and FIN packets, resulting in no authentication requirement.

Akeneo PIM CE and EE versions below 1.6.6, 1.5.15, and 1.4.28 are vulnerable to shell injection in mass editing, leading to remote code execution.

ATutor version 2.2.1 and earlier are vulnerable to SQL injection in multiple components, leading to information disclosure, database modification, or potential code execution.

ATutor versions 2.2.1 and earlier are vulnerable to an incorrect access control check vulnerability in the Social Application, Module, and Alternative Content components, resulting in privilege escalation.

ATutor versions 2.2.1 and earlier are vulnerable to a directory traversal and file extension check bypass in the Course component resulting in code execution. Additionally, these versions are vulnerable to a directory traversal vulnerability in the Course Icon component resulting in information disclosure.

A remote code execution vulnerability exists when Microsoft scripting engine improperly accesses objects in memory. This could corrupt memory in a way that enables an attacker to execute arbitrary code in the context of the current user.

The DiskFileItem class in Apache Wicket 6.x before 6.25.0 and 1.5.x before 1.5.17 allows remote attackers to cause a denial of service (infinite loop) and write to, move, and delete files with the permissions of DiskFileItem. Additionally, if running on a Java VM before 1.3.1, it can execute arbitrary code via a crafted serialized Java object.

In Apache httpd before 2.2.34 and 2.4.x before 2.4.27, the value placeholder in [Proxy-]Authorization headers of type 'Digest' was not initialized or reset before or between successive key=value assignments by mod_auth_digest. This could lead to leakage of potentially confidential information and a segfault in other cases resulting in denial of service.

IBM BigFix Inventory v9.2 uses inadequate account lockout settings that could allow a remote attacker to brute force account credentials.

In install/page_dbsettings.php in the Core distribution of XOOPS 2.5.8.1, unfiltered data passed to CREATE and ALTER SQL queries caused SQL Injection in the database settings page.

CVE-2017-4053 is a Command Injection vulnerability in the web interface of McAfee Advanced Threat Defense (ATD) versions 3.10, 3.8, 3.6, and 3.4. It allows remote unauthenticated users or attackers to execute arbitrary commands via a crafted HTTP request parameter.