CVE Vulnerability Catalog

A boundary error in the 'foveon_load_camf()' function in LibRaw-demosaic-pack-GPL2 before version 0.18.2 can be exploited to cause a stack-based buffer overflow.

An integer overflow error in the 'foveon_load_camf()' function in LibRaw-demosaic-pack-GPL2 before version 0.18.2 can lead to a heap-based buffer overflow.

A remote code execution vulnerability exists in Microsoft Chakra Core related to the way JavaScript engines render when handling objects in memory, known as 'Scripting Engine Memory Corruption Vulnerability'.

A remote code execution vulnerability exists in Microsoft Chakra Core related to the way JavaScript engines render when handling objects in memory. This is known as 'Scripting Engine Memory Corruption Vulnerability'.

Zoho ManageEngine Desktop Central before build 100082 allows remote attackers to obtain control over all connected active desktops via unspecified vectors.

The zend_string_extend function in PHP through version 7.1.5 does not prevent changes to string objects that can lead to negative length. This allows remote attackers to cause application crashes or potentially other unspecified impacts by leveraging the .= operator with a long string.

CVE-2016-10329 is a vulnerability in login.php in Synology Photo Station before version 6.5.3-3226 that allows remote attackers to execute arbitrary code via shell metacharacters in the 'X-Forwarded-For' header.

It was found that the Keycloak Node.js adapter 2.5 - 3.0 did not handle invalid tokens correctly. An attacker could use this flaw to bypass authentication and gain access to restricted information, or to possibly conduct further attacks.

An integer underflow has been identified in the unicode_to_utf8() function in tnef 1.4.14. This might lead to invalid write operations, controlled by an attacker.

In versions 4.1.19.2 and earlier of Invision Power Services (IPS) Community Suite, there is a stored XSS vulnerability in the Announcements section, allowing privilege escalation from an Invision Power Board moderator to an admin. The attack uses the announce_content parameter in an index.php?/modcp/announcements/&action=create request.

Integer signedness error in MiniUPnP MiniUPnPc v1.4.20101221 through v2.0 allows remote attackers to cause a denial of service or possibly have unspecified other impact.

Mozilla Network Security Services (NSS) versions before 3.21.4, 3.22.x through 3.28.x before 3.28.4, 3.29.x before 3.29.5, and 3.30.x before 3.30.1 are vulnerable to remote attacks that can cause denial of service (out-of-bounds write) or possibly have unspecified other impact by leveraging incorrect base64 operations.

In Veritas Backup Exec 2014 before build 14.1.1187.1126, 15 before build 14.2.1180.3160, and 16 before FP1, there is a use-after-free vulnerability in multiple agents that can lead to a denial of service or remote code execution.

Dolibarr ERP/CRM version 4.0.4 stores passwords using the MD5 algorithm, making brute-force attacks easier.

Dolibarr ERP/CRM version 4.0.4 has an SQL Injection vulnerability in doli/theme/eldy/style.css.php via the lang parameter.

The htmlParseTryOrFinish function in HTMLparser.c in libxml2 version 2.9.4 allows attackers to cause a denial of service (buffer over-read) or information disclosure.

In Veritas NetBackup Appliance version 3.0 and earlier, unauthenticated users can execute arbitrary commands as root.

In Veritas NetBackup 8.0 and earlier and NetBackup Appliance 3.0 and earlier, there is unauthenticated privileged remote file write using the 'bprd' process.

In Veritas NetBackup 8.0 and earlier and NetBackup Appliance 3.0 and earlier, there is unauthenticated file copy and arbitrary remote command execution using the 'bprd' process.

In Veritas NetBackup 8.0 and earlier and NetBackup Appliance 3.0 and earlier, there is unauthenticated, arbitrary remote command execution using the 'bprd' process.