CVE Vulnerability Catalog

The TLS session cache in FreeRADIUS from versions 2.1.1 to 2.1.7, 3.0.x before 3.0.14, 3.1.x before 2017-02-04, and 4.0.x before 2017-02-04 has a problem with reliably preventing the resumption of an unauthenticated session. This allows remote attackers, such as malicious 802.1X supplicants, to bypass authentication via PEAP or TTLS.

An Improper Restriction of Excessive Authentication Attempts issue was discovered in Moxa OnCell G3110-HSPA, G3110-HSDPA, G3150-HSDPA, and OnCell 5104-HSPA and 5004-HSPA. An attacker can freely use brute force to determine parameters needed to bypass authentication.

A Plaintext Storage of a Password issue was discovered in Moxa OnCell G3110-HSPA, G3110-HSDPA, G3150-HSDPA, and OnCell 5104-HSDPA, 5104-HSPA, and 5004-HSPA. The application's configuration file contains parameters that represent passwords in plaintext.

In Open vSwitch (OvS) v2.7.0, there is a buffer over-read while parsing the group mod OpenFlow message sent from the controller in the function `ofputil_pull_ofp15_group_mod` in `lib/ofp-util.c`.

In Open vSwitch (OvS) 2.6.1, there is a buffer over-read issue in the firewall implementation. This occurs while parsing malformed TCP, UDP, and IPv6 packets in the functions `extract_l3_ipv6`, `extract_l4_tcp`, and `extract_l4_udp`, which can be triggered remotely.

Juju versions before 1.25.12, 2.0.x before 2.0.4, and 2.1.x before 2.1.3 use a UNIX domain socket without setting appropriate permissions, allowing privilege escalation by users on the system to root.

Picocom before 2.0 has a command injection vulnerability in the 'send and receive file' command because the command line is executed by /bin/sh unsafely.

CVE-2017-7337 describes an improper Access Control vulnerability in Fortinet FortiPortal versions 4.0.0 and below that allows an attacker to interact with unauthorized VDOMs or enumerate other ADOMs via another user's stolen session and CSRF tokens or the adomName parameter in the /fpc/sec/customer/policy/getAdomVersion request.

Urządzenia NETGEAR WNR2000v3 przed wersją 1.1.2.14, WNR2000v4 przed wersją 1.0.0.66 oraz WNR2000v5 przed wersją 1.0.0.42 umożliwiają obejście uwierzytelniania oraz zdalne wykonanie kodu poprzez przepełnienie bufora, które wykorzystuje parametr w aplikacji webowej administracji.

Yodl before 3.07.01 has a buffer over-read vulnerability in the queue_push function in queue/queuepush.c.

Trend Micro ServerProtect for Linux 3.0 before CP 1531 allows attackers to write to arbitrary files and consequently execute arbitrary code with root privileges due to failure to validate software updates.

SAP Business One for Android version 1.2.3 allows remote attackers to conduct XML External Entity (XXE) attacks via crafted XML data in a request to a specific endpoint.

CVE-2016-4435 affects an endpoint of the Agent running on the BOSH Director VM with stemcell versions prior to 3232.6 and 3146.13. It allows unauthenticated clients to read or write blobs and may lead to a denial of service attack on the Director VM.

Cloud Foundry Garden-Linux versions prior to v0.333.0 and Elastic Runtime 1.6.x versions prior to 1.6.17 contain a flaw in managing container files during Docker image preparation. This flaw could be exploited to delete, corrupt, or overwrite host files and directories, including other container filesystems on the host.

Spring Framework versions 4.2.0 to 4.2.1, 4.0.0 to 4.1.7, 3.2.0 to 3.2.14, and older unsupported versions are vulnerable to a Reflected File Download (RFD) attack. The attack involves a malicious user crafting a URL with a batch script extension that results in the response being downloaded rather than rendered and also includes some input reflected in the response.

CVE-2014-3527 affects CAS proxy ticket authentication in Spring Security versions 3.1 to 3.2.4. A malicious CAS Service could trick another CAS Service into authenticating a proxy ticket that was not associated, leading to bypassing access control restrictions.

An issue was discovered in Oniguruma 6.2.0, used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5, where a heap out-of-bounds write occurs in bitset_set_range() due to an uninitialized variable from an incorrect state transition. This can lead to memory corruption.

An issue was discovered in Oniguruma 6.2.0, used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5, related to a stack out-of-bounds read. Invalid handling of reg->dmin in forward_search_range() could lead to an invalid pointer dereference.

An issue was discovered in Oniguruma 6.2.0, used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5, where a heap out-of-bounds write or read occurs during regular expression compilation. Octal numbers larger than 0xff are not handled correctly, leading to memory corruption.

An issue was discovered in Oniguruma 6.2.0, used in Oniguruma-mod in Ruby through 2.4.1 and mbstring in PHP through 7.1.5, related to a stack out-of-bounds write during regular expression compilation. A malformed regular expression could lead to a stack buffer overflow.