CVE Vulnerability Catalog

CVE-2016-4926 describes an insufficient authentication vulnerability in Junos Space before version 15.2R2, allowing remote users with access to the Junos Space web interface to perform certain administrative tasks without authentication.

Multiple SQL injection vulnerabilities in Kinsey Infor-Lawson (formerly ESBUS) allow remote attackers to execute arbitrary SQL commands. The attack can be conducted via the TABLE or QUERY parameters.

The MemcmpLowercase function in Suricata before version 2.0.6 improperly excludes the first byte from comparisons, which might allow remote attackers to bypass intrusion-prevention functionality via a crafted HTTP request.

The jng decoder in ImageMagick version 6.8.9.9 allows remote attackers to have an unspecified impact on the system.

Buffer overflow in the ReadRLEImage function in coders/rle.c in ImageMagick 6.8.9.9 allows remote attackers to have unspecified impact.

The DecodePSDPixels function in ImageMagick 6.8.9.9 allows remote attackers to have unspecified impact via unknown vectors.

The ReadPSDLayers function in ImageMagick 6.8.9.9 allows remote attackers to have unspecified impact via unknown vectors, related to 'throwing of exceptions.'

An issue was discovered in Erlang/OTP 18.x related to the generation of compiled regular expressions, which is vulnerable to a heap overflow. Regular expressions using a malformed extpattern can indirectly specify an offset used as an array index.

The user-account creation feature in Chef Manage versions 2.1.0 through 2.4.4 allows remote attackers to execute arbitrary code. This issue is fixed in version 2.4.5.

Buffer overflow in Cerberus FTP Server 8.0.10.3 allows remote attackers to cause a denial of service (daemon crash) or possibly have unspecified other impact via a long MLST command.

The distribute-cache.c file in ImageMagick has an issue with re-using objects after they have been destroyed, which may allow remote attackers to cause unspecified impact.

Pluck CMS version 4.7.2 allows remote attackers to execute arbitrary code via the blog form feature.

Wonder CMS 2014 has a PHP remote file inclusion vulnerability in editInplace.php that allows remote attackers to execute arbitrary PHP code via a URL in the hook parameter.

Directory traversal vulnerability in index.php in Wonder CMS 2014 allows remote attackers to include and execute arbitrary local files via a crafted theme.

readelf in GNU Binutils 2.28 is vulnerable to heap-based buffer over-reads while processing corrupt RL78 binaries. This vulnerability can lead to program crashes and may also result in information leaks.

Hyper-V in Microsoft Windows 10 1607 and Windows Server 2016 does not properly validate vSMB packet data, allowing attackers to execute arbitrary code on a target OS.

Heap-based buffer overflow in the PdfParser::ReadXRefSubsection function in PoDoFo allows attackers to have unspecified impact via vectors related to m_offsets.size.

A stack-based buffer overflow vulnerability has been identified in the Fatek Automation PLC Ethernet Module, which may allow remote code execution or crash the affected device. This affects the Ether_cfg software configuration tool running on specific Fatek PLC versions.

A vulnerability in the web-based GUI of Cisco Mobility Express 1800 Series Access Points could allow an unauthenticated, remote attacker to bypass authentication. The attacker could be granted full administrator privileges.