CVE Vulnerability Catalog

The BasicJsonStringifier::SerializeJSArray function in json-stringifier.h in the JSON stringifier in Google V8, as used in Google Chrome before version 47.0.2526.73, improperly loads array elements. This allows remote attackers to cause a denial of service (out-of-bounds memory access) or possibly have unspecified other impact via crafted JavaScript code.

PCRE before 8.38 mishandles the (?(<digits>) and (?(R<digits>) conditions, allowing remote attackers to cause a denial of service (integer overflow) or possibly have unspecified other impact via a crafted regular expression.

The pcre_compile function in PCRE before 8.38 mishandles certain [: nesting, which can lead to denial of service (CPU consumption) or other unspecified impacts via a crafted regular expression.

PCRE before 8.38 mishandles the [: and \ substrings in character classes, allowing remote attackers to cause a denial of service (uninitialized memory read) or possibly have unspecified other impact via a crafted regular expression.

PCRE before 8.38 mishandles the /(?:|a|){100}x/ pattern and related patterns, allowing remote attackers to cause a denial of service (infinite recursion) or possibly have unspecified other impact via a crafted regular expression.

PCRE before 8.38 mishandles the interaction of lookbehind assertions and mutually recursive subpatterns, allowing remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression.

PCRE before 8.38 mishandles certain repeated conditional groups, allowing remote attackers to cause a denial of service (buffer overflow) or possibly have unspecified other impact via a crafted regular expression.

The Jenkins CLI subsystem in Jenkins before 1.638 and LTS before 1.625.2 allows remote attackers to execute arbitrary code via a crafted serialized Java object, related to a problematic webapps/ROOT/WEB-INF/lib/commons-collections-*.jar file and the 'Groovy variant in 'ysoserial'.

The KVM subsystem in the Linux kernel through 4.2.6 and Xen 4.3.x through 4.6.x allows guest OS users to cause a denial of service (host OS panic or hang) by triggering many #DB (Debug) exceptions related to svm.c.

A heap-based buffer overflow in the ASN.1 decoder in Mozilla Network Security Services (NSS) before 3.19.2.1 and 3.20.x before 3.20.1 can lead to application crashes or potentially allow remote attackers to execute arbitrary code via crafted OCTET STRING data.

W urządzeniach Allen-Bradley MicroLogix 1100 przed wersją B FRN 15.000 oraz 1400 przed wersją B FRN 15.003 występuje przepełnienie bufora na stosie, które umożliwia zdalnym atakującym wykonanie dowolnego kodu poprzez nieokreślone wektory.

Omron CX-One CX-Programmer w wersjach przed 9.6 oraz urządzenia PLC CJ2M przed wersją 2.1 i CJ2H przed wersją 1.5 przesyłają hasła w postaci niezaszyfrowanej. To umożliwia zdalnym atakującym pozyskanie wrażliwych informacji poprzez podsłuchiwanie sieci podczas żądania odblokowania PLC.

An integer underflow in the base64-decoding implementation in EMC RSA BSAFE Micro Edition Suite before version 4.0.8 and 4.1.x before 4.1.3 allows remote attackers to cause a denial of service via crafted base64 data.

The MethodClosure class in Apache Groovy versions 1.7.0 through 2.4.3 allows remote attackers to execute arbitrary code or cause a denial of service via a crafted serialized object.

A use-after-free vulnerability in the IndexedDB implementation in Google Chrome before version 44.0.2403.89 allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging an abort action before a certain write operation.