CVE Vulnerability Catalog

A heap-based buffer overflow in the nbns_spoof function in Ettercap 0.8.1 can be exploited by remote attackers. Attackers can cause a denial of service or potentially execute arbitrary code by sending a large netbios packet.

An integer underflow in Ettercap 0.8.1 allows remote attackers to cause a denial of service (out-of-bounds write) and possibly execute arbitrary code. This can occur in several functions, including dissector_dhcp, dissector_gg, and dissector_TN3270.

GParted before 0.15.0 allows local users to execute arbitrary commands with root privileges via shell metacharacters in a crafted filesystem label.

The dissector_postgresql function in Ettercap before version 0.8.1 allows remote attackers to cause a denial of service and possibly execute arbitrary code via a crafted password length, which triggers a 0 character to be written to an arbitrary memory location.

Heap-based buffer overflow in the dissector_postgresql function in dissectors/ec_postgresql.c in Ettercap before 0.8.1 allows remote attackers to cause a denial of service or possibly execute arbitrary code via a crafted password length value that is inconsistent with the actual length of the password.

Buffer overflow in Allied Telesis devices such as AR440S, AR441S, AR442S, and others with firmware before version 2.9.1-21 allows remote attackers to execute arbitrary code via a crafted HTTP POST request.

The ARRIS Touchstone TG862G/CT Telephony Gateway with firmware 7.6.59S.CT and earlier has a default password of 'password' for the admin account, making it easier for remote attackers to gain access via a request to home_loggedout.php.

SAP BusinessObjects Edge 4.1 allows remote attackers to obtain the SI_PLATFORM_SEARCH_SERVER_LOGON_TOKEN token and gain privileges via a crafted CORBA call.

The Linux kernel before version 3.17.5 has an issue with handling faults related to the Stack Segment (SS) segment register, allowing local users to gain privileges by triggering an IRET instruction that leads to access to a GS Base address from the wrong space.

The vulnerability in EMC Documentum Content Server before version 6.7 SP1 P29, 6.7 SP2 before P18, 7.0 before P16, and 7.1 before P09 allows remote authenticated users to gain privileges by manipulating dm_job and dm_job_request objects.

Directory traversal vulnerability in the CollectorConfInfoServlet servlet in ManageEngine NetFlow Analyzer allows remote attackers to execute arbitrary code via a .. (dot dot) in the filename.

The NativeAppServlet in ManageEngine Desktop Central MSP before version 90075 allows remote attackers to execute arbitrary code via a crafted JSON object.

Docker version 1.3.2 allows remote attackers to execute arbitrary code with root privileges via a crafted image or build in a Dockerfile in an LZMA (.xz) archive.

CVE-2014-9057 describes an SQL injection vulnerability in the XML-RPC interface in Movable Type before version 5.18, 5.2.x before 5.2.11, and 6.x before 6.0.6. This allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

An SQL injection vulnerability in phpTrafficA version 2.3 and earlier in Php/Functions/log_function.php allows remote attackers to execute arbitrary SQL commands via a User-Agent HTTP header.

Integer overflow in RPM 4.12 and earlier allows remote attackers to execute arbitrary code via a crafted CPIO header in the payload section of an RPM file, which triggers a stack-based buffer overflow.

A directory traversal vulnerability in SafeNet Authentication Service (SAS) Outlook Web Access Agent before version 1.03.30109 allows remote attackers to read arbitrary files via a .. (dot dot) in the GetFile parameter.

The upgrade functionality in Malwarebytes Anti-Malware (MBAM) consumer before 2.0.3 and Malwarebytes Anti-Exploit (MBAE) consumer 1.04.1.1012 allows man-in-the-middle attackers to execute arbitrary code by spoofing the update server and uploading an executable.

A race condition in RPM 4.11.1 and earlier allows remote attackers to execute arbitrary code via a crafted RPM file. The issue is that the installation extracts the contents to temporary files before validating the signature.

The default configuration of Zenoss Core before version 5 allows remote attackers to read or modify database information by connecting to unspecified open ports.