CVE Vulnerability Catalog

Vulnerability in the Oracle WebLogic Server component of Oracle Fusion Middleware allows an unauthenticated attacker with network access to compromise the server. Affected versions are 10.3.6.0, 12.1.3.0, 12.2.1.0, and 12.2.1.1.

A vulnerability in the Java SE, Java SE Embedded, and JRockit components allows an unauthenticated attacker with network access to compromise these systems. The attacker can exploit this vulnerability by supplying data to APIs without using untrusted Java Web Start applications or untrusted Java applets.

A heap-based buffer overflow in the flx_decode_delta_fli function in the FLIC decoder in GStreamer before version 1.10.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) by providing a 'write count' that exceeds the initialized buffer.

A heap-based buffer overflow in the flx_decode_delta_fli function in the FLIC decoder in GStreamer before version 1.10.2 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) by providing a 'skip count' that goes beyond initialized buffer.

A heap-based buffer overflow in the flx_decode_delta_fli function in the FLIC decoder in GStreamer before version 1.10.2 allows remote attackers to execute arbitrary code or cause application crashes.

Vulnerability in the Oracle One-to-One Fulfillment component of Oracle E-Business Suite allows unauthenticated attackers with network access via HTTP to compromise the system. Attackers can create, delete, or modify critical data.

Vulnerability in the Oracle GlassFish Server component of Oracle Fusion Middleware allows an unauthenticated attacker with network access to compromise the server. Attacks may significantly impact additional products, potentially resulting in takeover of the Oracle GlassFish Server.

A buffer overflow vulnerability exists while processing QMI QOS TLVs in Android. It affects versions that include the qmi_qos_srvc.c file.

An exploitable stack-based buffer overflow vulnerability exists in the querying functionality of Aerospike Database Server 3.10.0.3. A specially crafted packet can cause a stack-based buffer overflow, resulting in remote code execution.

An exploitable stack-based buffer overflow vulnerability exists in the querying functionality of Aerospike Database Server 3.10.0.3. A specially crafted packet can cause a stack-based buffer overflow, resulting in remote code execution.

A double free vulnerability in the gdImageWebPtr function in the GD Graphics Library (libgd) before version 2.2.4 allows remote attackers to have unspecified impact via large width and height values.

Multiple buffer overflows in Autodesk FBX-SDK before version 2017.1 can allow attackers to execute arbitrary code when reading or converting malformed 3DS format files.

Multiple buffer overflows in Autodesk FBX-SDK before version 2017.1 can allow attackers to execute arbitrary code when reading or converting malformed DAE format files.

Improper handling in the Autodesk FBX-SDK before version 2017.1 regarding type mismatches and previously deleted objects related to reading and converting malformed FBX format files can allow attackers to gain access to uninitialized pointers.

Multiple buffer overflows in Autodesk FBX-SDK before version 2017.1 can allow attackers to execute arbitrary code or cause an infinite loop condition when reading or converting malformed FBX format files.

Off-by-one error in the phar_parse_pharfile function in PHP before 5.6.30 and 7.0.x before 7.0.15 allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via a crafted PHAR archive with an alias mismatch.

Joomla! versions 3.4.4 through 3.6.3 allow attackers to reset username, password, and user group assignments, and possibly perform other user account modifications via unspecified vectors.

Buffer overflow in the SLPFoldWhiteSpace function in OpenSLP 2.0 may allow remote attackers to have unspecified impact via a crafted string.

Versions of python-jose before 1.3.2 do not use constant time comparison for HMAC keys, which can be leveraged by attackers in unspecified ways.

ZOHO WebNMS Framework 5.2 and 5.2 SP1 allows remote attackers to bypass authentication and impersonate arbitrary users via the UserName HTTP header.