CVE Vulnerability Catalog

In Open vSwitch (OvS) 2.6.1, there is a buffer over-read issue in the firewall implementation. This occurs while parsing malformed TCP, UDP, and IPv6 packets in the functions `extract_l3_ipv6`, `extract_l4_tcp`, and `extract_l4_udp`, which can be triggered remotely.

Juju versions before 1.25.12, 2.0.x before 2.0.4, and 2.1.x before 2.1.3 use a UNIX domain socket without setting appropriate permissions, allowing privilege escalation by users on the system to root.

Picocom before 2.0 has a command injection vulnerability in the 'send and receive file' command because the command line is executed by /bin/sh unsafely.

CVE-2017-7337 describes an improper Access Control vulnerability in Fortinet FortiPortal versions 4.0.0 and below that allows an attacker to interact with unauthorized VDOMs or enumerate other ADOMs via another user's stolen session and CSRF tokens or the adomName parameter in the /fpc/sec/customer/policy/getAdomVersion request.

Urządzenia NETGEAR WNR2000v3 przed wersją 1.1.2.14, WNR2000v4 przed wersją 1.0.0.66 oraz WNR2000v5 przed wersją 1.0.0.42 umożliwiają obejście uwierzytelniania oraz zdalne wykonanie kodu poprzez przepełnienie bufora, które wykorzystuje parametr w aplikacji webowej administracji.

Yodl before 3.07.01 has a buffer over-read vulnerability in the queue_push function in queue/queuepush.c.

Trend Micro ServerProtect for Linux 3.0 before CP 1531 allows attackers to write to arbitrary files and consequently execute arbitrary code with root privileges due to failure to validate software updates.

SAP Business One for Android version 1.2.3 allows remote attackers to conduct XML External Entity (XXE) attacks via crafted XML data in a request to a specific endpoint.

CVE-2016-4435 affects an endpoint of the Agent running on the BOSH Director VM with stemcell versions prior to 3232.6 and 3146.13. It allows unauthenticated clients to read or write blobs and may lead to a denial of service attack on the Director VM.

Cloud Foundry Garden-Linux versions prior to v0.333.0 and Elastic Runtime 1.6.x versions prior to 1.6.17 contain a flaw in managing container files during Docker image preparation. This flaw could be exploited to delete, corrupt, or overwrite host files and directories, including other container filesystems on the host.

Spring Framework versions 4.2.0 to 4.2.1, 4.0.0 to 4.1.7, 3.2.0 to 3.2.14, and older unsupported versions are vulnerable to a Reflected File Download (RFD) attack. The attack involves a malicious user crafting a URL with a batch script extension that results in the response being downloaded rather than rendered and also includes some input reflected in the response.

CVE-2014-3527 affects CAS proxy ticket authentication in Spring Security versions 3.1 to 3.2.4. A malicious CAS Service could trick another CAS Service into authenticating a proxy ticket that was not associated, leading to bypassing access control restrictions.

An issue was discovered in Oniguruma 6.2.0, used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5, where a heap out-of-bounds write occurs in bitset_set_range() due to an uninitialized variable from an incorrect state transition. This can lead to memory corruption.

An issue was discovered in Oniguruma 6.2.0, used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5, related to a stack out-of-bounds read. Invalid handling of reg->dmin in forward_search_range() could lead to an invalid pointer dereference.

An issue was discovered in Oniguruma 6.2.0, used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5, where a heap out-of-bounds write or read occurs during regular expression compilation. Octal numbers larger than 0xff are not handled correctly, leading to memory corruption.

An issue was discovered in Oniguruma 6.2.0, used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5, related to a stack out-of-bounds write during regular expression compilation. A malformed regular expression could lead to a stack buffer overflow.

An issue was discovered in Oniguruma 6.2.0, as used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5, related to a stack out-of-bounds read. A logical error in match_at() during regular expression searching could lead to unauthorized reads from a stack buffer.

A specially crafted x509 certificate can cause a single out of bounds byte overwrite in wolfSSL through 3.10.2 resulting in potential certificate validation vulnerabilities, denial of service and possible remote code execution.

In Open vSwitch (OvS) 2.7.0, there is a buffer over-read issue when parsing an OFPT_QUEUE_GET_CONFIG_REPLY type OFP 1.0 message. This issue is caused by an unsigned integer underflow in the function `ofputil_pull_queue_get_config_reply10` in `lib/ofp-util.c`.

In some circumstances, an F5 BIG-IP version 12.0.0 to 12.1.2 and 13.0.0 Azure cloud instance may contain a default administrative password which could be used to remotely log into the BIG-IP system. The impacted administrative account is the Azure instance administrative user that was created at deployment.