CVE Vulnerability Catalog

Augeas versions up to and including 1.8.0 are vulnerable to heap-based buffer overflow due to improper handling of escaped strings. An attacker could send crafted strings that would cause the application using Augeas to copy past the end of a buffer, leading to a crash or possible code execution.

There is a code injection vulnerability in openSUSE when running certain source services used in open build service 2.1 before March 11, 2011.

389-ds-base versions before 1.3.5.19 and 1.3.6.7 are vulnerable to password brute-force attacks during account lockout due to different return codes returned on password attempts.

PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to an authentication flaw allowing remote attackers to gain access to database accounts with an empty password.

A buffer overflow may occur in the processing of a downlink NAS message in Qualcomm Telephony as used in Apple iPhone 5 and later, iPad 4th generation and later, iPod touch 6th generation.

An Improper Authorization issue was discovered in OSIsoft PI Integrator for Business Analytics before 2016 R2, PI Integrator for Microsoft Azure before 2016 R2 SP1, and PI Integrator for SAP HANA before 2017. An attacker is able to gain privileged access to the system while unauthorized.

A maliciously constructed svn+ssh:// URL could cause Subversion clients before 1.8.19, 1.9.x before 1.9.7, and 1.10.0.x through 1.10.0-alpha3 to run arbitrary shell commands. Such a URL could be generated by a malicious server, a malicious user, or a proxy server.

CVE-2015-3616 is an SQL injection vulnerability in Fortinet FortiManager versions 5.0.x before 5.0.11 and 5.2.x before 5.2.2, allowing remote attackers to execute arbitrary commands via unspecified parameters.

Adobe Acrobat Reader versions 2017.009.20058 and earlier, 2017.008.30051 and earlier, 2015.006.30306 and earlier, and 11.0.20 and earlier have a memory corruption vulnerability in the picture exchange (PCX) file format parsing module. Successful exploitation could lead to arbitrary code execution.

Adobe Experience Manager 6.2 and earlier has a malicious file execution vulnerability.

Adobe Digital Editions 4.5.4 and earlier has an exploitable use after free vulnerability. Successful exploitation could lead to arbitrary code execution.

A remote code execution vulnerability exists in the Chakra JavaScript engine related to improper handling of objects in memory.

In Apache Tomcat versions from 6.0.0 to 9.0.0.M9, a vulnerability allowed a malicious web application to bypass a configured SecurityManager via a Tomcat utility method accessible to web applications.

FineCMS version 1.9.5 in ContentController.php allows remote attackers to manipulate the website database.

In /drivers/isdn/i4l/isdn_net.c, a user-controlled buffer is copied into a local buffer of constant size using strcpy without a length check, which can lead to a buffer overflow.

Ganglia-web before 3.7.1 allows remote attackers to bypass authentication.

An integer underflow in Sandstorm Cap'n Proto before version 0.4.1.1 and 0.5.x before 0.5.1.1 may allow remote peers to cause a denial of service or potentially obtain sensitive information from memory or execute arbitrary code via a crafted message.

Integer overflow in layout.c++ in Sandstorm Cap'n Proto before version 0.4.1.1 and 0.5.x before version 0.5.1.1 allows remote peers to cause a denial of service or possibly obtain sensitive information from memory via a crafted message, related to pointer validation.

The REST client for Ruby (rest-client) before version 1.8.0 allows remote attackers to conduct session fixation attacks or obtain sensitive cookie information by leveraging the passage of cookies set in a response to a redirect.

A stack-based buffer overflow in the logging functionality in the Preboot Policy service in Novell ZENworks Configuration Management (ZCM) allows remote attackers to execute arbitrary code.