CVE Vulnerability Catalog

Buffer overflow in the DecodeAdpcmImaQT function in VideoLAN VLC media player before version 2.2.4 allows remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via a crafted QuickTime IMA file.

HPE Universal CMDB versions 10.0 through 10.21, Universal CMDB Configuration Manager versions 10.0 through 10.21, and Universal Discovery versions 10.0 through 10.21 allow remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library.

HPE Systems Insight Manager (SIM) before 7.5.1 allows remote attackers to obtain sensitive information, modify data, or cause a denial of service via unspecified vectors.

The Performance Center Virtual Table Server (VTS) component in HPE LoadRunner has a vulnerability that allows remote attackers to delete arbitrary files. The issue is due to unrestricted file path access in unlink calls.

A stack-based buffer overflow in mchan.dll in the agent of HPE LoadRunner and Performance Center allows remote attackers to execute arbitrary code. This issue affects versions 11.52, 12.00, 12.01, 12.02, and 12.50, along with their respective patches.

HPE Matrix Operating Environment before 7.5.1 allows remote attackers to obtain sensitive information or modify data via unspecified vectors.

HPE Insight Control before version 7.5.1 allows remote attackers to obtain sensitive information, modify data, or cause a denial of service via unspecified vectors.

HPE Systems Insight Manager (SIM) before 7.5.1 allows remote attackers to obtain sensitive information or modify data via unspecified vectors.

Apache Struts versions 2.3.19 to 2.3.28 with Dynamic Method Invocation enabled allow remote attackers to execute arbitrary code via vectors related to an ! (exclamation mark) operator to the REST Plugin.

The PDO adapters in Zend Framework before 1.12.16 do not filter null bytes in SQL statements, allowing remote attackers to execute arbitrary SQL commands via a crafted query.

In FreeType versions before 2.5.4, functions responsible for parsing font matrices do not check return values, which can lead to uninitialized memory access and application crashes.

The J9 JVM in IBM SDK, Java Technology Edition 6 before SR16 FP20, 6 R1 before SR8 FP20, 7 before SR9 FP30, and 7 R1 before SR3 FP30 allows remote attackers to obtain sensitive information or inject data by invoking non-public interface methods.

The DrawImage function in ImageMagick before 6.9.4-0 and 7.x before 7.0.1-2 contains an incorrect function call, which may lead to buffer overflow and application crash. Remote attackers can exploit this vulnerability by sending a crafted file.

Cisco Prime Network Analysis Module (NAM) and Prime Virtual Network Analysis Module (vNAM) before version 6.1(1) patch.6.1-2-final and 6.2.x before version 6.2(1) have a vulnerability that allows remote attackers to execute arbitrary OS commands via a crafted HTTP request.

AMQP connection handling in Apache Qpid Java before version 6.0.3 may allow remote attackers to bypass authentication, enabling actions related to connection state logging.

Sixnet BT-5xxx and BT-6xxx M2M devices before 3.8.21 and 3.9.x before 3.9.8 have hardcoded credentials, allowing remote attackers to gain access via unspecified vectors.

Environmental Systems Corporation (ESC) 8832 Data Controller 3.02 and earlier mishandles sessions, allowing remote attackers to bypass authentication and make arbitrary configuration changes.

The server in HP Release Control versions 9.13, 9.20, and 9.21 allows remote attackers to execute arbitrary commands via a crafted serialized Java object, related to the Apache Commons Collections library.