CVE Vulnerability Catalog

In Android for MSM, Firefox OS for MSM, and QRD Android, a buffer overflow vulnerability exists while reading firmware logs. This affects all Android releases from CAF using the Linux kernel.

In Android for MSM, Firefox OS for MSM, and QRD Android, there is an issue with reduced cryptographic strength while deriving the disk encryption key. This affects all Android releases from CAF using the Linux kernel.

The most package in Debian wheezy before 5.0.0a-2.2, in Debian jessie before 5.0.0a-2.3+deb8u1, and in Debian unstable before 5.0.0a-3 allows remote attackers to execute arbitrary commands via shell metacharacters in the name of an LZMA-compressed file.

The remote management interface on the Claymore Dual GPU miner 10.1 allows an unauthenticated remote attacker to execute arbitrary code due to a stack-based buffer overflow in the request handler. This can be exploited via a long API request that is mishandled during logging.

The OhMiBod Remote app for Android and iOS allows remote attackers to impersonate users by sniffing network traffic for search responses from the OhMiBod API server and then editing the username, user_id, and token fields in the OMB.xml file.

Version 2.2.4.8 and earlier of iSmartAlarm CubeOne firmware has a vulnerability that allows password file exposure. Attackers can retrieve credentials from this file, enabling them to execute arbitrary commands with administrative privileges.

In Apache Qpid Broker-J versions 0.18 through 0.32, misconfiguration of ports with different authentication providers can allow a remote attacker connecting to the HTTP port to trick the broker into using an authentication provider from another port. The attacker must have valid credentials for the provider on the spoofed port.

Improper authentication issue in PTW-WMS1 firmware version 2.000.012 allows remote attackers to log in to the device with root privileges and conduct arbitrary operations via unspecified vectors.

PTW-WMS1 firmware version 2.000.012 allows remote attackers to execute arbitrary OS commands via unspecified vectors.

PTW-WMS1 firmware version 2.000.012 allows remote attackers to bypass access restrictions to obtain or delete data on the disk via unspecified vectors.

SQL injection vulnerability in A-Reserve and A-Reserve for MT versions 3.8.6 and earlier allows an attacker to execute arbitrary SQL commands via unspecified vectors.

SQL injection vulnerability in A-Member and A-Member for MT versions 3.8.6 and earlier allows an attacker to execute arbitrary SQL commands via unspecified vectors.

Directory traversal vulnerability in QND Advance/Standard allows an attacker to read arbitrary files via a specially crafted command.

Indeo Otter through 1.7.4 mishandles a '</script>' substring in an initial DP payload, allowing remote attackers to cause a denial of service (crash) or possibly have unspecified other impact.

Inedo Otter before 1.7.4 has directory traversal in filesystem-based rafts via vectors involving '/' characters or initial '.' characters.

Adobe ColdFusion has an Untrusted Data Deserialization vulnerability. This affects Update 4 and earlier versions for ColdFusion 2016, and Update 12 and earlier versions for ColdFusion 11.

Adobe ColdFusion has an Untrusted Data Deserialization vulnerability. This affects Update 4 and earlier versions for ColdFusion 2016, and Update 12 and earlier versions for ColdFusion 11.

Adobe Flash Player has an exploitable memory corruption vulnerability in the MP4 atom parser. Successful exploitation could lead to arbitrary code execution.

Adobe Flash Player has a memory corruption vulnerability in the text handling function that could be exploited for arbitrary code execution. This affects version 26.0.0.151 and earlier.

A vulnerability in Cisco WebEx Network Recording Player allows for remote code execution affecting ARF and WRF files. A remote attacker could exploit this by sending a malicious ARF or WRF file to a user and convincing them to launch it.