CVE Vulnerability Catalog

A specific device configuration can lead to a situation where a user logs in without being prompted for a password. This issue occurs due to a failure in committing configuration changes, potentially allowing unauthorized access.

The re-key admin monitor was introduced in Jenkins 1.498, re-encrypting all secrets in JENKINS_HOME with a new key and creating a backup directory with old secrets and the key used for encryption. These backups were world-readable and not removed afterwards.

ONOS version 1.9.0 is vulnerable to unauthenticated upload of applications (.oar), leading to remote code execution.

Creolabs Gravity version 1.0 is vulnerable to a stack overflow in the memcmp function.

Creolabs Gravity version 1.0 is vulnerable to a stack overflow in the string_repeat() function.

Creolabs Gravity version 1.0 is vulnerable to a heap overflow in an undisclosed component that can result in arbitrary code execution.

Creolabs Gravity version 1.0 is vulnerable to a Double Free in gravity_value, potentially leading to modification of unexpected memory locations.

In version 5.1 of EyesOfNetwork (EON), there is an unauthenticated SQL injection vulnerability in eonweb that can lead to remote root access.

Kubernetes versions 1.5.0-1.5.4 are vulnerable to a privilege escalation in the PodSecurityPolicy admission plugin, allowing the use of any existing PodSecurityPolicy object.

rbenv (all current versions) is vulnerable to Directory Traversal in the specification of Ruby version, resulting in arbitrary code execution.

gtk-vnc version 0.4.2 and older does not correctly check framebuffer boundaries when updating, which may lead to memory corruption during rendering.

Framadate version 1.0 is vulnerable to Formula Injection in the CSV Export resulting possible Information Disclosure and Code Execution.

RVM automatically loads environment variables from files in $PWD, leading to command execution vulnerabilities. RVM also executes hooks and installs gems and performs 'bundle install' based on files in $PWD, resulting in code execution.

GlassFish Server version 3.0.1 (build 22) is vulnerable to Java Key Store Password Disclosure, allowing an unauthenticated attacker to obtain the administrative user's plain text password and gain access to the web-based administration interface.

SYN Flood or FIN Flood attack in eCos 1 and other versions of embedded devices results in web Authentication Bypass. eCos Embedded Web Servers fail to validate and handle SYN and FIN packets, resulting in no authentication requirement.

Akeneo PIM CE and EE versions below 1.6.6, 1.5.15, and 1.4.28 are vulnerable to shell injection in mass editing, leading to remote code execution.

ATutor version 2.2.1 and earlier are vulnerable to SQL injection in multiple components, leading to information disclosure, database modification, or potential code execution.

ATutor versions 2.2.1 and earlier are vulnerable to an incorrect access control check vulnerability in the Social Application, Module, and Alternative Content components, resulting in privilege escalation.

ATutor versions 2.2.1 and earlier are vulnerable to a directory traversal and file extension check bypass in the Course component resulting in code execution. Additionally, these versions are vulnerable to a directory traversal vulnerability in the Course Icon component resulting in information disclosure.

A remote code execution vulnerability exists when Microsoft scripting engine improperly accesses objects in memory. This could corrupt memory in a way that enables an attacker to execute arbitrary code in the context of the current user.