CVE Vulnerability Catalog

Adobe Reader and Acrobat before version 11.0.17, and Acrobat and Acrobat Reader DC Classic before version 15.006.30198, as well as Acrobat and Acrobat Reader DC Continuous before version 15.017.20050 on Windows and OS X, allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.

Adobe Reader and Acrobat before 11.0.17, Acrobat and Acrobat Reader DC Classic before 15.006.30198, and Acrobat and Acrobat Reader DC Continuous before 15.017.20050 on Windows and OS X allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.

Adobe Reader and Acrobat before version 11.0.16, and Acrobat and Acrobat Reader DC Classic before 15.006.30172, as well as Acrobat and Acrobat Reader DC Continuous before 15.016.20039 on Windows and OS X, allow attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.

A stack-based buffer overflow in dws/api/Login on D-Link DIR-850L B1, DIR-817 Ax, DIR-818LW Bx, DIR-822 C1, DIR-823 A1, DIR-895L A1, DIR-890L A1, DIR-885L A1, DIR-880L A1, and DIR-868L B1 and C1 devices before specified firmware versions allows remote attackers to execute arbitrary code via a long session cookie.

Buffer overflow in the Cookie parser in Fortinet FortiOS before version 4.1.11, 4.2.x before 4.2.13, and 4.3.x before 4.3.9 and FortiSwitch before 3.4.3 allows remote attackers to execute arbitrary code via a crafted HTTP request.

Moxa OnCell G3100V2 devices before version 2.8 and G3111, G3151, G3211, and G3251 devices before version 1.7 do not properly restrict authentication attempts, making it easier for remote attackers to gain access via a brute-force attack.

ZModo ZP-NE14-S and ZP-IBH-13W devices have a hardcoded root password, which makes it easier for remote attackers to obtain access via a TELNET session.

CVE-2016-5817 is an SQL injection vulnerability in news pages in Cargotec Navis WebAccess before 2016-08-10, allowing remote attackers to execute arbitrary SQL commands via unspecified vectors.

Citrix XenApp versions 6.x before 6.5 HRP07 and 7.x before 7.9, as well as Citrix XenDesktop before 7.9, may allow attackers to weaken an unspecified security mitigation via vectors related to memory permission.

Heap-based buffer overflow in the parse_packet function in network.c in collectd before 5.4.3 and 5.x before 5.5.2 allows remote attackers to cause a denial of service (daemon crash) or possibly execute arbitrary code via a crafted network packet.

Use-after-free vulnerability in the my_login function in DBD::mysql before 4.033_01 allows attackers to have unspecified impact by leveraging a call to mysql_errno after a failure of my_login.

A use-after-free vulnerability in DBD::mysql before version 4.029 allows attackers to cause a program crash or potentially execute arbitrary code due to a lost server connection.

A stack-based buffer overflow in the munge_other_line function in cachemgr.cgi in the squid package before version 3.1.23-16.el6_8.6 in Red Hat Enterprise Linux 6 allows remote attackers to execute arbitrary code.

The vulnerability in ActiveSyncProvider in Microsoft Windows 10 Gold and 1511 allows attackers to discover credentials by leveraging the failure of Universal Outlook to obtain a secure connection.

SQL injection vulnerability in Moxa SoftCMS before version 1.5 allows remote attackers to execute arbitrary SQL commands via unspecified fields.

The TSC driver for Linux kernel 3.x has a vulnerability that allows attackers to cause a denial of service through an invalid pointer dereference. This can be achieved via a crafted application that makes a TSC_GET_CARD_STATUS ioctl call.

The vfe31_proc_general function in the MSM-VFE31 driver for Linux kernel 3.x does not validate a certain id value, allowing attackers to gain privileges or cause a denial of service (memory corruption) via an application making a crafted ioctl call.

Multiple unspecified vulnerabilities in Google Chrome before version 52.0.2743.116 may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

The Developer Tools (aka DevTools) subsystem in Blink, as used in Google Chrome before version 52.0.2743.116, mishandles the script-path hostname, remoteBase parameter, and remoteFrontendUrl parameter. This allows remote attackers to bypass intended access restrictions via a crafted URL.

The Developer Tools (DevTools) subsystem in Blink, used in Google Chrome before version 52.0.2743.116, mishandles the script-path hostname, remoteBase, and remoteFrontendUrl parameters. This allows remote attackers to bypass intended access restrictions via a crafted URL.