CVE Vulnerability Catalog

Node.js was affected by an OpenSSL vulnerability (CVE-2017-3737) related to the use of SSL_read() due to TLS handshake failure. An active network attacker could send application data to Node.js, bypassing TLS authentication and encryption.

Posty Readymade Classifieds Script version 1.0 allows an attacker to inject SQL commands via requests to listings.php?catid= or ads-details.php?ID=.

Techno Portfolio Management Panel version 1.0 allows an attacker to inject SQL commands via a single.php?id= request.

The web interface packet capture management component in Palo Alto Networks PAN-OS before 6.1.19, 7.0.x before 7.0.19, 7.1.x before 7.1.14, and 8.0.x before 8.0.6 allows remote authenticated users to execute arbitrary code via unspecified vectors.

In Apache Synapse, by default no authentication is required for Java Remote Method Invocation (RMI), allowing remote code execution attacks through specially crafted serialized objects. Versions 3.0.1 and earlier (3.0.0, 2.1.0, 2.0.0, 1.2, 1.1.2, 1.1.1) are vulnerable.

ImageMagick before 6.9.9-24 and 7.x before 7.0.7-12 has a use-after-free in Magick::Image::read in Magick++/lib/Image.cpp.

The ucnv_UTF8FromUTF8 function in the ICU library for C/C++ through version 60.1 mishandles ucnv_convertEx calls for UTF-8 to UTF-8 conversion, which can lead to stack-based buffer overflow and application crash.

An issue was discovered in Adobe Flash Player 27.0.0.183 and earlier versions related to reading data past the end of the target buffer. The use of an invalid pointer during access to internal data structure fields causes this vulnerability.

An issue was discovered in Adobe Flash Player 27.0.0.183 and earlier versions related to reading data past the end of the target buffer. The use of an invalid pointer during access to internal data structure fields causes this vulnerability.

A vulnerability exists in Adobe Acrobat and Reader related to use after free in the JavaScript engine. This affects versions 2017.012.20098 and earlier, 2017.011.30066 and earlier, 2015.006.30355 and earlier, and 11.0.22 and earlier.

A use-after-free vulnerability was discovered in Adobe Photoshop 18.1.1 (2017.1.1) and earlier versions. Successful exploitation could lead to arbitrary code execution.

A memory corruption vulnerability was discovered in Adobe Photoshop 18.1.1 (2017.1.1) and earlier versions. Successful exploitation could lead to arbitrary code execution.

A memory corruption vulnerability was discovered in Adobe InDesign 12.1.0 and earlier versions. Successful exploitation could lead to arbitrary code execution.

An issue was discovered in Adobe DNG Converter 9.12.1 and earlier versions related to memory corruption. Successful exploitation could lead to arbitrary code execution.

A memory corruption vulnerability was discovered in Adobe Shockwave 12.2.9.199 and earlier. Successful exploitation could lead to arbitrary code execution.

A memory corruption vulnerability exists in Adobe Acrobat and Reader that could be exploited to execute arbitrary code. This affects versions 2017.012.20098 and earlier, 2017.011.30066 and earlier, 2015.006.30355 and earlier, and 11.0.22 and earlier.

A Server-Side Request Forgery (SSRF) vulnerability was discovered in Adobe Connect 9.6.2 and earlier versions, which could be abused to bypass network access controls.

A use after free vulnerability was discovered in Adobe Flash Player 27.0.0.183 and earlier versions in the Primetime SDK metadata functionality. The mismatch between an old and a new object can provide an attacker with unintended memory access, potentially leading to code corruption, control-flow hijack, or an information leak attack.

A use after free vulnerability was discovered in Adobe Flash Player 27.0.0.183 and earlier versions in the Primetime SDK. The mismatch between an old and a new object can provide an attacker with unintended memory access, potentially leading to code corruption, control-flow hijack, or an information leak attack.