CVE Vulnerability Catalog

The qsort() function in NetBSD is recursive and not randomized, allowing an attacker to construct a pathological input array that causes deterministic recursion N/4 times. This enables attackers to consume arbitrary amounts of stack memory and manipulate stack memory to assist in arbitrary code execution attacks.

NetBSD maps the run-time link-editor ld.so directly below the stack region, even if ASLR is enabled, allowing attackers to more easily manipulate memory leading to arbitrary code execution.

A flaw exists in NetBSD's implementation of the stack guard page that allows attackers to bypass it resulting in arbitrary code execution using certain setuid binaries. This affects NetBSD 7.1 and possibly earlier versions.

A flaw exists in OpenBSD's implementation of the stack guard page that allows attackers to bypass it resulting in arbitrary code execution using setuid binaries such as /usr/bin/at. This affects OpenBSD 6.1 and possibly earlier versions.

SQL injection vulnerability in rdr.php in nuevoMailer version 6.0 and earlier allows remote attackers to execute arbitrary SQL commands via the 'r' parameter.

In EMC VNX2 versions prior to OE for File 8.1.9.211 and VNX1 versions prior to OE for File 7.1.80.8, an unauthenticated remote attacker may be able to elevate their permissions to root through a command injection. This may potentially allow an attacker to run arbitrary code with root-level privileges on the targeted VNX Control Station system.

The install/make-config.php file in ProjectSend r754 has a vulnerability that allows remote attackers to execute arbitrary PHP code via manipulation of the dbprefix parameter. This issue is related to replacing TABLES_PREFIX in the configuration file.

SPIP versions 3.1.x before 3.1.6 and 3.2.x before Beta 3 do not remove shell metacharacters from the host field, allowing a remote attacker to cause remote code execution.

In uClibc version 0.9.33.2, there is an out-of-bounds read in the get_subexp function in misc/regex/regexec.c when processing a crafted regular expression.

The KBVault Mysql Free Knowledge Base application package version 0.16a includes a file management component that allows unauthenticated users to access file upload and deletion functionalities. A user can upload an ASPX script to the Uploads/Documents/ directory, enabling the execution of arbitrary code.

In devices using Anti-Web software up to version 3.8.7, an LFI vulnerability allows a remote attacker to read or modify files through a path traversal technique. This is exemplified by the ability to read the password file or write to an arbitrary file using the template parameter in cgi-bin/write.cgi.

This command injection vulnerability in QTS allows attackers to run arbitrary commands in the compromised application.

IBM BigFix Compliance (TEMA SUAv1 SCA SCM) uses inadequate account lockout settings that could allow a remote attacker to brute force account credentials.

Podatność w systemach Microsoft Windows pozwala atakującemu na przejęcie kontroli nad systemem, gdy funkcja wyszukiwania Windows nieprawidłowo obsługuje obiekty w pamięci. Dotyczy to wielu wersji systemów operacyjnych, w tym Windows XP, Vista, 7, 8, 10 oraz serwerów Windows.

Policy resource matcher in Apache Ranger before 0.7.1 ignores characters after '*' wildcard character, which can result in unintended behavior.

New Relic .NET Agent before version 6.3.123.0 introduces SQL injection flaws to safe applications through mishandling of quotes when using the Slow Queries feature.

The engine-DC-config.py script in Red Hat QuickStart Cloud Installer (QCI) before version 1.0 GA is world readable and contains the root password of the deployed system.

A vulnerability in the update process for the dynamic JAR file of the Cisco Context Service SDK could allow an unauthenticated, remote attacker to execute arbitrary code on the affected device with the privileges of the web server.

An issue was discovered in Cloud Foundry Foundation cf-release versions prior to v261 and UAA versions prior to specified versions, allowing privilege escalation through arbitrary password resets with user invitations.

An issue was discovered in Pivotal PCF Elastic Runtime in versions 1.6.x prior to 1.6.65, 1.7.x prior to 1.7.48, 1.8.x prior to 1.8.28, and 1.9.x prior to 1.9.5, where several credentials were present in the logs for the Notifications errand.