CVE Vulnerability Catalog

Adobe Flash Player versions before 18.0.0.352 and 19.x through 21.x before 21.0.0.242 on Windows and OS X and before 11.2.202.621 on Linux contain a vulnerability that allows attackers to execute arbitrary code or cause a denial of service (memory corruption) via unspecified vectors.

The WPAD protocol implementation in Windows has issues with proxy discovery, allowing remote attackers to redirect network traffic.

A use-after-free vulnerability in the DNS Server component in Microsoft Windows Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via crafted requests.

A stack-based buffer overflow in Huawei Honor WS851 routers with software version 1.1.21.1 and earlier allows remote attackers to execute arbitrary commands with root privileges.

OCaml before 4.03.0 does not properly handle sign extensions, allowing remote attackers to conduct buffer overflow attacks or obtain sensitive information, as demonstrated by a long string to the String.copy function.

Citrix XenServer 7.0 before Hotfix XS70E003, when upgraded from an earlier release, may allow remote attackers on the management network to 'compromise' a host by leveraging credentials for an Active Directory account.

The Framework UI permission-dialog implementation in Android 6.x before June 1, 2016, allows attackers to conduct tapjacking attacks and access arbitrary private-storage files by creating a partially overlapping window.

The Qualcomm Wi-Fi driver in Android before 2016-06-01 on Nexus 7 (2013) devices allows attackers to gain privileges via a crafted application.

The OpenBlob function in GraphicsMagick before version 1.3.24 and in ImageMagick allows remote attackers to execute arbitrary code by placing a | (pipe) character at the start of a filename.

The XXE (XML External Entity) vulnerability in XmlMapper in the Data format extension for Jackson (jackson-dataformat-xml) allows attackers to have unspecified impact via unknown vectors.

The pxp-agent component in Puppet Enterprise 2015.3.x before 2015.3.3 and Puppet Agent 1.3.x before 1.3.6 does not properly validate server certificates, which might allow remote attackers to spoof brokers and execute arbitrary commands via a crafted certificate.

Puppet Server before 2.3.2 and Ruby puppetmaster in Puppet 4.x before 4.4.2 and in Puppet Agent before 1.4.2 might allow remote attackers to bypass intended auth.conf access restrictions by leveraging incorrect URL decoding.

MEDHOST Perioperative Information Management System (PIMS or VPIMS) before version 2015R1 has hardcoded credentials, making it easier for remote attackers to obtain sensitive information via direct requests to the application database server.

The Chef Manage add-on before version 1.12.0 allows remote attackers to execute arbitrary code via crafted serialized data in a cookie.

EMC NetWorker versions 8.2.1.x and 8.2.2.x before 8.2.2.6 and 9.x before 9.0.0.6 mishandle authentication, allowing remote attackers to execute arbitrary commands by leveraging access to a different NetWorker instance.

A format string vulnerability in libxml2 before version 2.9.4 allows attackers to have unspecified impact via format string specifiers in unknown vectors.

The smartcard interaction in SPICE allows remote attackers to cause a denial of service (QEMU-KVM process crash) or possibly execute arbitrary code via vectors related to connecting to a guest VM, which triggers a heap-based buffer overflow.

CVE-2016-4532 describes a vulnerability in the WAP interface of Trihedral VTScada in versions 8.x through 11.x before 11.2.02, allowing remote attackers to read arbitrary files via a crafted pathname.

The WAP interface in Trihedral VTScada in versions 8.x through 11.x before 11.2.02 allows remote attackers to bypass authentication and read arbitrary files via unspecified vectors.

General Electric (GE) Multilink ML800, ML1200, ML1600, and ML2400 switches with firmware before 5.5.0 and ML810, ML3000, and ML3100 switches with firmware before 5.5.0k have hardcoded credentials, allowing remote attackers to modify configuration settings via the web interface.