CVE Vulnerability Catalog

eClinicalWorks Population Health (CCMR) has a session fixation vulnerability. The application does not assign a new session ID during user authentication, allowing the use of an existing session ID.

Splunk Web in Splunk Enterprise before version 5.0.17, 6.0.13, 6.1.12, 6.2.12, 6.3.8, and 6.4.4 is vulnerable to HTTP request injection attacks, allowing remote attackers to obtain sensitive REST API authentication-token information.

An issue was discovered in Pivotal GemFire for PCF 1.6.x versions prior to 1.6.5 and 1.7.x versions prior to 1.7.1 regarding unauthenticated access to the gfsh (Geode Shell) endpoint. This endpoint is publicly accessible, allowing attackers to execute any commands.

Multiple integer overflows in the process_bin_update function in Memcached can be exploited to cause heap overflow and lead to remote code execution.

An integer overflow in the process_bin_append_prepend function in Memcached can be exploited to cause heap overflow and lead to remote code execution.

An exploitable out-of-bounds write exists in the Bzip2 parsing of the Lexmark Perspective Document Filters conversion functionality. A crafted Bzip2 document can lead to a stack-based buffer overflow causing an out-of-bounds write which under the right circumstance could potentially be leveraged by an attacker to gain arbitrary code execution.

CVE-2016-2339 describes a heap overflow vulnerability in the 'initialize' function of Fiddle::Function.new in Ruby. A specially crafted object passed as an element of the args array can increase the size of this array after allocation, leading to a heap overflow.

Type confusion exists in the TclTkIp class method _cancel_eval in Ruby. An attacker passing a different type of object than String as the 'retval' argument can cause arbitrary code execution.

Type confusion exists in the WIN32OLE class in Ruby in the ole_invoke and ole_query_interface methods. An attacker passing a different type of object than assumed by developers can cause arbitrary code execution.

A remote code execution vulnerability exists in the Trane ComfortLink II firmware version 2.0.2 in the DSS service. An attacker who can connect to the DSS service on the Trane ComfortLink II device can send an overly long REG request that can overflow a fixed size stack buffer, resulting in arbitrary code execution.

A design flaw in the Trane ComfortLink II SCC firmware version 2.0.2 allows remote attackers to take complete control of the system.

Heap-based buffer overflow in MatrixSSL before version 3.8.6 allows remote attackers to execute arbitrary code via a crafted Subject Alt Name in an X.509 certificate.

In Veritas NetBackup Appliance versions 2.6.0.x through 2.6.0.4, 2.6.1.x through 2.6.1.2, 2.7.x through 2.7.3, and 3.0.x, a vulnerability allows remote attackers to execute arbitrary commands via shell metacharacters in the hostName parameter to appliancews/getLicense.

The unserialize implementation in PHP 7.x before 7.0.14 allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted serialized data.

The php_wddx_push_element function in PHP before 5.6.29 and 7.x before 7.0.14 allows remote attackers to cause a denial of service via out-of-bounds read and memory corruption using an empty boolean element in a wddxPacket XML document.

PHP through 5.6.27 and 7.x through 7.0.12 mishandles property modification during __wakeup processing, allowing remote attackers to cause a denial of service or possibly have unspecified other impact via crafted serialized data.

A use-after-free vulnerability in the CURLFile implementation in PHP before 5.6.27 and 7.x before 7.0.12 allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted serialized data that is mishandled during __wakeup processing.

Integer signedness error in the dynamicGetbuf function in the GD Graphics Library (libgd) through version 2.2.3, used in PHP before 5.6.28 and 7.x before 7.0.13, allows remote attackers to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact via a crafted imagecreatefromstring call.

The get_icu_disp_value_src_php function in PHP before 5.3.29, 5.4.x before 5.4.30, and 5.5.x before 5.5.14 does not properly restrict calls to the ICU uresbund.cpp component, which may lead to denial of service (buffer overflow) or other unspecified impacts.

A stack-based buffer overflow in the ures_getByKeyWithFallback function in ICU before version 54.1 for C/C++ allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted uloc_getDisplayName call.