CVE Vulnerability Catalog

In Moodle versions 2.x and 3.x, SQL injection vulnerability can occur via user preferences.

The coders/psd.c file in ImageMagick contains a vulnerability that allows remote attackers to leverage an improper cast, leading to a heap-based buffer overflow.

Multiple heap-based buffer overflows in the read_attribute function in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allow remote attackers to have unspecified impact via a crafted OpenPGP certificate.

A stack-based buffer overflow in the cdk_pk_get_keyid function in lib/opencdk/pubkey.c in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allows remote attackers to have unspecified impact via a crafted OpenPGP certificate.

A double free vulnerability in the gnutls_x509_ext_import_proxy function in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allows remote attackers to have unspecified impact via crafted policy language information in an X.509 certificate with a Proxy Certificate Information extension.

Huawei AR3200 routers with software before V200R007C00SPC600 are vulnerable to remote attacks that can lead to denial of service or execution of arbitrary code via a crafted packet.

Off-by-one error in coders/wpg.c in ImageMagick allows remote attackers to have unspecified impact via vectors related to a string copy.

The coders/ipl.c file in ImageMagick contains a vulnerability that allows remote attackers to achieve unspecified impact due to a missing malloc check.

CVE-2016-10133 involves a heap-based buffer overflow in the js_stackoverflow function in jsrun.c in MuJS. Attackers can exploit an error when dropping extra arguments to lightweight functions, leading to unspecified impact.

Buffer overflow in the git_pkt_parse_line function in Git Smart Protocol support in libgit2 before version 0.24.6 and 0.25.x before version 0.25.1 allows remote attackers to have unspecified impact via a crafted non-flush packet.

Local privilege escalation vulnerability in the Gentoo QEMU package before version 2.5.0-r1.

SAP GUI versions 7.2 through 7.5 allow remote attackers to bypass intended security policy restrictions and execute arbitrary code via crafted ABAP code.

USB Pratirodh allows remote attackers to conduct XML External Entity (XXE) attacks via XML data in usb.xml.

Microsoft Skype version 7.16.0.102 contains a vulnerability that could allow an unauthenticated, remote attacker to execute arbitrary code on the targeted system. The issue arises from the way .dll files are loaded by Skype.

The User::randomPassword function in MediaWiki before 1.23.12, 1.24.x before 1.24.5, 1.25.x before 1.25.4, and 1.26.x before 1.26.1 generates passwords smaller than $wgMinimalPasswordLength, making it easier for remote attackers to gain access via a brute-force attack.

The Soft Access Point feature in Samsung Smart TVs X10P, X12, X14H, X14J, and NT14U and Xpress M288OFW printers generate weak WPA2 PSK keys, making it easier for remote attackers to obtain sensitive information or bypass authentication via a brute-force attack.

Cloudera Key Trustee Server before 5.4.3 does not store keys synchronously, which might allow attackers to have unspecified impact via vectors related to loss of an encryption key.

The _mediaLibraryPlayCb function in mainwindow.py in pitivi before 0.95 allows attackers to execute arbitrary code via shell metacharacters in a file path.

PHPMemcachedAdmin version 1.2.2 and earlier allows remote attackers to execute arbitrary PHP code via vectors related to serialized data and the last part of the concatenated filename, which creates a file in the webroot.

The Konke Smart Plug K does not require authentication for TELNET sessions, allowing remote attackers to obtain 'equipment management authority' via TCP traffic to port 23.