CVE Vulnerability Catalog

Type confusion exists in the WIN32OLE class in Ruby in the ole_invoke and ole_query_interface methods. An attacker passing a different type of object than assumed by developers can cause arbitrary code execution.

A remote code execution vulnerability exists in the Trane ComfortLink II firmware version 2.0.2 in the DSS service. An attacker who can connect to the DSS service on the Trane ComfortLink II device can send an overly long REG request that can overflow a fixed size stack buffer, resulting in arbitrary code execution.

A design flaw in the Trane ComfortLink II SCC firmware version 2.0.2 allows remote attackers to take complete control of the system.

Heap-based buffer overflow in MatrixSSL before version 3.8.6 allows remote attackers to execute arbitrary code via a crafted Subject Alt Name in an X.509 certificate.

In Veritas NetBackup Appliance versions 2.6.0.x through 2.6.0.4, 2.6.1.x through 2.6.1.2, 2.7.x through 2.7.3, and 3.0.x, a vulnerability allows remote attackers to execute arbitrary commands via shell metacharacters in the hostName parameter to appliancews/getLicense.

The unserialize implementation in PHP 7.x before 7.0.14 allows remote attackers to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted serialized data.

The php_wddx_push_element function in PHP before 5.6.29 and 7.x before 7.0.14 allows remote attackers to cause a denial of service via out-of-bounds read and memory corruption using an empty boolean element in a wddxPacket XML document.

PHP through 5.6.27 and 7.x through 7.0.12 mishandles property modification during __wakeup processing, allowing remote attackers to cause a denial of service or possibly have unspecified other impact via crafted serialized data.

A use-after-free vulnerability in the CURLFile implementation in PHP before 5.6.27 and 7.x before 7.0.12 allows remote attackers to cause a denial of service or possibly have unspecified other impact via crafted serialized data that is mishandled during __wakeup processing.

Integer signedness error in the dynamicGetbuf function in the GD Graphics Library (libgd) through version 2.2.3, used in PHP before 5.6.28 and 7.x before 7.0.13, allows remote attackers to cause a denial of service (stack-based buffer overflow) or possibly have unspecified other impact via a crafted imagecreatefromstring call.

The get_icu_disp_value_src_php function in PHP before 5.3.29, 5.4.x before 5.4.30, and 5.5.x before 5.5.14 does not properly restrict calls to the ICU uresbund.cpp component, which may lead to denial of service (buffer overflow) or other unspecified impacts.

A stack-based buffer overflow in the ures_getByKeyWithFallback function in ICU before version 54.1 for C/C++ allows remote attackers to cause a denial of service or possibly have unspecified other impact via a crafted uloc_getDisplayName call.

NETGEAR Arlo base stations and Arlo Q and Arlo Q Plus devices with specified firmware versions have a default password of 12345678. This makes it easier for remote attackers to gain access after a factory reset or in a factory configuration.

The 'aWeb Cart Watching System for Virtuemart' extension before version 2.6.1 for Joomla! has an SQL injection vulnerability that allows remote attackers to execute arbitrary SQL commands.

A remote command injection vulnerability as root exists in Western Digital MyCloud NAS version 2.11.142. An attacker can exploit a modified arg parameter in the POST data at the /web/google_analytics.php URL.

A remote command injection vulnerability as root exists in Western Digital MyCloud NAS version 2.11.142 via a modified Cookie header on the index.php page.

The admin/plugin.php file in Piwigo up to version 2.8.3 does not validate the sections variable when using it to include files. This can lead to information disclosure and code execution if it contains a .. sequence.

A stack-based buffer overflow in Quick Heal Internet Security, Total Security, and AntiVirus Pro allows remote attackers to execute arbitrary code. This affects version 10.1.0.316 and earlier on OS X.

A heap-based buffer overflow in LibVNCClient in LibVNCServer before version 0.9.11 can be exploited by remote servers. An attacker can cause application crashes or potentially execute arbitrary code by sending a crafted FramebufferUpdate message with the Ultra type.

A heap-based buffer overflow in LibVNCClient in LibVNCServer before version 0.9.11 allows remote servers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted FramebufferUpdate message.