CVE Vulnerability Catalog

The Integrated User Firewall (UserFW) feature in Junos OS version 12.1X47-D10 on Juniper SRX devices introduced integration of user profiles with existing firewall policies. During a security review, hardcoded credentials were identified and removed, which can impact both SRX devices and integrated LDAP and Active Directory points.

A reflected cross site scripting vulnerability in the NetScreen WebUI of Juniper Networks Juniper NetScreen Firewall+VPN allows an attacker to inject HTML/JavaScript content into the management session of other users, including the administrator.

In PHP 7.x before 7.0.21 and 7.1.x before 7.1.7, the msgfmt_parse_message function in msgformat_parse.c does not restrict locale length, which can lead to stack-based buffer overflow and application crash.

Fiyo CMS version 2.0.7 has an SQL injection vulnerability in sys_article.php via the name parameter when editing or adding a tag name.

dataTaker DT8x dEX w wersji 1.72.007 pozwala zdalnym atakującym na tworzenie programów lub harmonogramów, co może prowadzić do wysyłania wiadomości e-mail lub nawiązywania połączeń z serwerami FTP w celu przesyłania danych.

Zoho ManageEngine Desktop Central before build 100092 allows remote attackers to execute arbitrary code via vectors involving the upload of help desk videos.

GLPI versions before 9.1.5 are vulnerable to SQL injection via an ajax/getDropdownValue.php request with an entity_restrict parameter that is not a list of integers.

A specific device configuration can lead to a situation where a user logs in without being prompted for a password. This issue occurs due to a failure in committing configuration changes, potentially allowing unauthorized access.

The re-key admin monitor was introduced in Jenkins 1.498, re-encrypting all secrets in JENKINS_HOME with a new key and creating a backup directory with old secrets and the key used for encryption. These backups were world-readable and not removed afterwards.

ONOS version 1.9.0 is vulnerable to unauthenticated upload of applications (.oar), leading to remote code execution.

Creolabs Gravity version 1.0 is vulnerable to a stack overflow in the memcmp function.

Creolabs Gravity version 1.0 is vulnerable to a stack overflow in the string_repeat() function.

Creolabs Gravity version 1.0 is vulnerable to a heap overflow in an undisclosed component that can result in arbitrary code execution.

Creolabs Gravity version 1.0 is vulnerable to a Double Free in gravity_value, potentially leading to modification of unexpected memory locations.

In version 5.1 of EyesOfNetwork (EON), there is an unauthenticated SQL injection vulnerability in eonweb that can lead to remote root access.

Kubernetes versions 1.5.0-1.5.4 are vulnerable to a privilege escalation in the PodSecurityPolicy admission plugin, allowing the use of any existing PodSecurityPolicy object.

rbenv (all current versions) is vulnerable to Directory Traversal in the specification of Ruby version, resulting in arbitrary code execution.

gtk-vnc version 0.4.2 and older does not correctly check framebuffer boundaries when updating, which may lead to memory corruption during rendering.

Framadate version 1.0 is vulnerable to Formula Injection in the CSV Export resulting possible Information Disclosure and Code Execution.

RVM automatically loads environment variables from files in $PWD, leading to command execution vulnerabilities. RVM also executes hooks and installs gems and performs 'bundle install' based on files in $PWD, resulting in code execution.