CVE Vulnerability Catalog

CVE-2017-2922 describes a memory corruption vulnerability in the Websocket protocol implementation of Cesanta Mongoose 6.8. A specially crafted websocket packet can lead to a buffer being allocated with stale pointers, resulting in a use-after-free vulnerability that can be exploited for remote code execution.

CVE-2017-2921 describes a vulnerability in the Websocket protocol implementation of Cesanta Mongoose 6.8 that can lead to heap buffer overflow. A specially crafted websocket packet can cause an integer overflow, resulting in denial of service and potential remote code execution.

CVE-2017-2894 describes a stack buffer overflow vulnerability in the MQTT packet parsing functionality of Cesanta Mongoose 6.8. A specially crafted MQTT SUBSCRIBE packet can cause a buffer overflow, leading to remote code execution.

An exploitable arbitrary memory read vulnerability exists in the MQTT packet parsing functionality of Cesanta Mongoose 6.8. A specially crafted MQTT packet can cause an arbitrary out-of-bounds memory read and write potentially resulting in information disclosure, denial of service and remote code execution.

CVE-2017-2891 describes a use-after-free vulnerability in the HTTP server implementation of Cesanta Mongoose 6.8. An ordinary HTTP POST request with a CGI target can cause a reuse of previously freed pointer, potentially leading to remote code execution.

An exploitable vulnerability exists in the authentication token generation functionality of Circle with Disney. Specially crafted network packets can cause a valid authentication token to be returned to the attacker.

An exploitable routing vulnerability exists in the Circle with Disney cloud infrastructure. A specially crafted packet can make the Circle cloud route a packet to any arbitrary Circle device.

An improper restriction of excessive authentication attempts vulnerability in Synology CardDAV Server before 6.0.7-0085 allows remote attackers to obtain user credentials via a brute-force attack.

The Gentoo net-misc/vde package before version 2.3.2-r4 may allow members of the 'qemu' group to gain root privileges by creating a hard link in a directory on which 'chown' is called recursively by the OpenRC service script.

Podatność w rsync 3.1.2 i 3.1.3-development w funkcji receive_xattr w pliku xattrs.c nie sprawdza obecności znaku null na końcu nazwy atrybutu rozszerzonego (xattr). Zdalny atakujący może wysłać spreparowane dane do demona rsync, powodując odczyt poza zakresem sterty (heap-based buffer over-read) i awarię aplikacji (DoS), a potencjalnie także inne skutki.

Zoho ManageEngine Applications Manager version 13 before build 13500 is vulnerable to SQL injection via GraphicalView.do, as demonstrated by a crafted viewProps yCanvas field or viewid parameter.

Mahara Mobile before 1.2.1 is vulnerable to passwords being sent to the Mahara access log in plain text.

Mahara versions 15.04 before 15.04.8, 15.10 before 15.10.4, and 16.04 before 16.04.2 are vulnerable to some authentication methods that do not use Mahara's built-in login form, allowing users to log in even if their institution was expired or suspended.

Mahara versions 15.04 before 15.04.10, 15.10 before 15.10.6, and 16.04 before 16.04.4 are vulnerable to incorrect access control after the password reset link is sent via email. When the user changes the default email, Mahara fails to invalidate the old link, allowing access to the user's account.

Mahara versions 15.04 before 15.04.7 and 15.10 before 15.10.3 running on PHP 5.3 are vulnerable to one user being logged in as another user on a separate computer due to the same session ID being served. This situation can occur when a user takes an action that forces another user to be logged out of Mahara.

MitraStar GPT-2541GNAC (HGU) 1.00(VNJ0)b1 and DSL-100HN-T1 ES_113WJY0b16 devices have a zyad1234 password for the zyad1234 account, which is equivalent to root and undocumented.

ChakraCore allows an attacker to gain the same user rights as the current user, due to the way that the ChakraCore scripting engine handles objects in memory.

WordPress versions before 4.8.3 are affected by an issue where $wpdb->prepare() can create unexpected and unsafe queries, leading to potential SQL injection (SQLi) in plugins and themes.

The UNIX IPC layer in WebKit, including WebKitGTK+ prior to 2.16.3, does not properly validate message size metadata, allowing a compromised secondary process to trigger an integer overflow and subsequent buffer overflow in the UI process.

The SSH Plugin stores credentials that allow jobs to access remote servers via the SSH protocol. User passwords and passphrases for encrypted SSH keys are stored in plaintext in a configuration file.