CVE Vulnerability Catalog

CVE-2017-4052 is an authentication bypass vulnerability in the web interface of McAfee Advanced Threat Defense (ATD) 3.10, 3.8, 3.6, 3.4. Remote unauthenticated users can change or update configuration settings and gain administrator functionality via a crafted HTTP request parameter.

phpMyFAQ before 2.9.8 does not properly mitigate brute-force attacks that try many passwords in attempted logins quickly.

FineCMS version 2.1.0 allows remote attackers to execute arbitrary PHP code by using a URL Manager 'Add Site' action to enter this code after a ', sequence in a domain name.

A vulnerability in ipsilon 2.0 before 2.0.2, 1.2 before 1.2.1, 1.1 before 1.1.2, and 1.0 before 1.0.3 allows an attacker to log out active sessions of other users. This issue is related to how it tracks sessions and allows an unauthenticated attacker to view and terminate active sessions from other users.

Podatność CVE-2017-11165 dotyczy urządzenia dataTaker DT80 dEX w wersji 1.50.012, które pozwala zdalnym atakującym na uzyskanie wrażliwych informacji o poświadczeniach i konfiguracji poprzez bezpośrednie żądanie do URI /services/getFile.cmd?userfile=config.xml.

A vulnerability in Windows allows remote code execution due to improper handling of objects in memory by Windows Search. This affects multiple versions of Windows operating systems, including Windows 7, 8.1, and Windows 10.

On iSmartAlarm cube devices, there is an authentication bypass leading to remote execution of commands, such as setting the alarm on/off, related to incorrect cryptography.

In Apache Impala versions 2.7.0 to 2.8.0, a vulnerability was identified that allows a malicious process to impersonate an Impala daemon. This can lead to skipping authentication checks when Kerberos is enabled but TLS is not used.

NfSen before 1.3.8 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the customfmt parameter (aka the 'Custom output format' field).

Wtyczka Struts 1 w Apache Struts w wersjach 2.1.x i 2.3.x może umożliwiać zdalne wykonanie kodu poprzez złośliwą wartość pola przekazaną w surowej wiadomości do ActionMessage.

In PHP before 5.6.30 and 7.x before 7.0.15, attackers could exploit the PHAR archive handler by supplying malicious archive files, potentially causing the PHP interpreter to crash or disclosing information due to a buffer over-read in the phar_parse_pharfile function.

GraphicsMagick version 1.3.26 has double free vulnerabilities in the ReadOneJNGImage() function in coders/png.c.

The libxar.so library in version 1.6.1 has a NULL pointer dereference in the xar_get_path function in util.c.

The libxar.so library in version 1.6.1 has a NULL pointer dereference in the xar_unserialize function in archive.c.

EMC ESRS Policy Manager prior to 6.8 contains an undocumented account (OpenDS admin) with a default password. A remote attacker with the knowledge of the default password may login to the system and gain administrator privileges to the local LDAP directory server.

The Red Hat 3scale API Management Platform (RH-3scale) before version 2.0.0 allowed the creation of access tokens without a client secret. This flaw enables attackers to bypass authentication controls and gain access to restricted APIs.

A Stack-Based Buffer Overflow issue was discovered in Schneider Electric Wonderware ArchestrA Logger, versions 2017.426.2307.1 and prior. This vulnerability may allow a remote attacker to execute arbitrary code in the context of a highly privileged account.

systemd v233 and earlier fails to safely parse usernames starting with a numeric digit, resulting in the service running with root privileges instead of the intended user privileges.

An issue was discovered in Irssi before version 1.0.4 related to updating the internal nick list. The application could incorrectly use the GHashTable interface, leading to freeing the nick during the update, resulting in use-after-free conditions on each access of the hash table.

An issue was discovered in Irssi before version 1.0.4, which occurs when receiving messages with invalid time stamps. In this case, Irssi attempts to dereference a NULL pointer.