CVE Vulnerability Catalog

Vaultive O365 versions before 4.5.21 have an issue with handling PGP/MIME messages injected via IMAP or SMTP. The change in Content-Type header causes most mail user agents to be unable to decrypt the message correctly, leading to a denial of service.

Novell iManager 2.7.x before 2.7 SP7 Patch 10 HF1 and NetIQ iManager 3.x before 3.0.3.1 have a webshell upload vulnerability.

Gnulib before 2017-04-26 has a heap-based buffer overflow with the TZ environment variable. The error is in the save_abbr function in time_rz.c.

Pexip Infinity before version 14.2 allows remote attackers to cause a denial of service (service restart) or execute arbitrary code via vectors related to Conferencing Nodes.

Atakujący z sieci, nieposiadający uprawnień, może uzyskać uprawnienia systemowe do skonfigurowanych SKU zarządzania Intela, takich jak Intel Active Management Technology (AMT) oraz Intel Standard Manageability (ISM). Ponadto, lokalny atakujący bez uprawnień może skonfigurować funkcje zarządzania, uzyskując nieuprawnione uprawnienia sieciowe lub lokalne na SKU zarządzania Intela.

The Cloud Controller in Cloud Foundry before version 239 logs user-provided service objects at creation, allowing attackers to obtain sensitive user credential information via unspecified vectors.

TeX Live allows remote attackers to execute arbitrary commands by leveraging inclusion of mpost in shell_escape_commands in the texmf.cnf config file.

PCRE2 before 10.30 has an out-of-bounds write caused by a stack-based buffer overflow in pcre2_match.c, related to a 'pattern with very many captures.'

The vulnerability in lxc-attach in LXC before version 1.0.9 and 2.x before version 2.0.6 allows an attacker inside an unprivileged container to use an inherited file descriptor from the host's /proc to access the rest of the host's filesystem via the openat() family of syscalls.

Heap-based buffer overflow in the PdfParser::ReadObjects function in PoDoFo 0.9.5 allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact.

The mDNS responder in BOSE Soundtouch 30 incorrectly responds to IPv4 unicast queries with non-link-local source addresses. This can lead to denial of service or exposure of potentially sensitive information.

avahi-daemon in Avahi through 0.6.32 and 0.7 inadvertently responds to IPv6 unicast queries with source addresses that are not on-link, allowing remote attackers to cause a denial of service (traffic amplification) and may lead to information leakage.

The strescape function in ec_strings.c in Ettercap 0.8.2 allows remote attackers to cause a denial of service (heap-based buffer overflow and application crash) or possibly have unspecified other impact via a crafted filter that is mishandled by etterfilter.

Google gRPC before 2017-03-29 has an out-of-bounds write caused by a heap-based use-after-free related to the grpc_call_destroy function.

LibreOffice before 2017-03-17 has an out-of-bounds write caused by a heap-based buffer overflow related to the ReadJPEG function in vcl/source/filter/jpeg/jpegc.cxx.

Buffer overflow in Quest One Identity Privilege Manager for Unix before version 6.0.0.061 allows remote attackers to gain full access to the policy server via an ACT_ALERT_EVENT request that causes memory corruption in the pmmasterd daemon.

The GlobalProtect external interface in PAN-OS before version 6.1.17, 7.x before 7.0.15, 7.1.x before 7.1.9, and 8.x before 8.0.2 provides different error messages for failed login attempts depending on whether the username exists. This allows remote attackers to enumerate account names and conduct brute-force attacks.

Trend Micro Threat Discovery Appliance version 2.6.1062r1 and earlier uses predictable session values, allowing remote attackers to bypass authentication by guessing the value.

Buffer overflow in WN-G300R3 firmware Ver.1.03 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors.

smalruby-editor v0.4.0 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors.