CVE Vulnerability Catalog

A CGI handling flaw in bozohttpd in NetBSD allows remote attackers to execute arbitrary code via crafted arguments, which are handled by a non-CGI aware program.

Citrix Provisioning Services before 7.12 allows attackers to execute arbitrary code by overwriting a function pointer.

Use-after-free vulnerability in Citrix Provisioning Services before version 7.12 allows attackers to execute arbitrary code via unspecified vectors.

Buffer overflow in Citrix Provisioning Services before version 7.12 allows attackers to execute arbitrary code via unspecified vectors.

Zimbra Collaboration before version 8.7.0 allows remote attackers to conduct deserialization attacks via unspecified vectors.

Libical allows remote attackers to cause a denial of service (use-after-free) and possibly read heap memory via a crafted ics file.

A heap-based buffer overflow in the WPG format reader in GraphicsMagick 1.3.25 and earlier allows remote attackers to have unspecified impact via a colormap with a large number of entries.

GeniXCMS version 0.0.8 has an SQL injection vulnerability in Posts.class.php that allows remote attackers to execute arbitrary SQL commands via the id parameter.

GeniXCMS version 0.0.8 has an SQL injection vulnerability in author.control.php that allows remote attackers to execute arbitrary SQL commands via the type parameter.

A Directory Traversal vulnerability in DashboardFileReceiveServlet in Brocade Network Advisor versions prior to and including 14.0.2 could allow remote attackers to upload a malicious file in a section of the file system where it can be executed.

A Directory Traversal vulnerability in FileReceiveServlet in Brocade Network Advisor versions released prior to and including 14.0.2 could allow remote attackers to upload a malicious file in a section of the file system where it can be executed.

CVE-2016-2090 describes an off-by-one vulnerability in the fgetwln function in libbsd before version 0.8.2, allowing attackers to trigger a heap-based buffer overflow via unspecified vectors.

The UI daemon in Apache Storm 0.10.0 before 0.10.0-beta1 allows remote attackers to execute arbitrary code via unspecified vectors.

An integer overflow vulnerability was observed in the regemit function in regexp.c in MuJS by Artifex Software, Inc. It requires a regular expression with nested repetition, which can lead to code execution or a denial of service (buffer overflow) condition.

The remoting module in Jenkins before 2.32 and LTS before 2.19.3 allows remote attackers to execute arbitrary code via a crafted serialized Java object, which triggers an LDAP query to a third-party server.

Barco ClickShare CSC-1 devices with firmware before version 01.09.03 allow remote attackers to obtain the root password by downloading and extracting the firmware image.

Barco ClickShare CSC-1 devices with firmware before 01.09.03 and CSM-1 devices with firmware before 01.06.02 allow remote attackers to execute arbitrary code via unspecified vectors.

The REPL server (--listen) in GNU Guile 2.0.12 allows an attacker to execute arbitrary code via an HTTP inter-protocol attack.

Exponent CMS version 2.3.9 has a remote code execution vulnerability in /install/index.php. An attacker can upload a malicious 'exploit.tar.gz' file to the website and then extract it, leading to arbitrary code execution.

Exponent CMS version 2.3.9 suffers from a remote code execution vulnerability in /install/index.php. An attacker can upload a 'php' file to the website through uploader_paste.php, then overwrite /framework/conf/config.php, leading to arbitrary code execution.