CVE Vulnerability Catalog

LibreOffice before 2017-03-17 has an out-of-bounds write caused by a heap-based buffer overflow related to the ReadJPEG function in vcl/source/filter/jpeg/jpegc.cxx.

Buffer overflow in Quest One Identity Privilege Manager for Unix before version 6.0.0.061 allows remote attackers to gain full access to the policy server via an ACT_ALERT_EVENT request that causes memory corruption in the pmmasterd daemon.

The GlobalProtect external interface in PAN-OS before version 6.1.17, 7.x before 7.0.15, 7.1.x before 7.1.9, and 8.x before 8.0.2 provides different error messages for failed login attempts depending on whether the username exists. This allows remote attackers to enumerate account names and conduct brute-force attacks.

Trend Micro Threat Discovery Appliance version 2.6.1062r1 and earlier uses predictable session values, allowing remote attackers to bypass authentication by guessing the value.

Buffer overflow in WN-G300R3 firmware Ver.1.03 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors.

smalruby-editor v0.4.0 and earlier allows remote attackers to execute arbitrary OS commands via unspecified vectors.

The NFSv2 and NFSv3 server implementations in the Linux kernel through 4.10.13 lack certain checks for the end of a buffer, which allows remote attackers to trigger pointer-arithmetic errors or possibly have unspecified other impact via crafted requests.

UDFclient (before version 0.8.8) has a custom strlcpy implementation that is vulnerable to buffer overflow. This issue occurs on systems with a C library that lacks its own strlcpy.

In Avast Antivirus before v17, using the LPC interface API exposed by the AvastSVC.exe Windows service, it is possible to launch predefined binaries, or replace or delete arbitrary files. This vulnerability is exploitable by any unprivileged user when Avast Self-Defense is disabled.

A path traversal vulnerability exists in simple-file-manager before 2017-04-26, affecting index.php (the sole 'Simple PHP File Manager' component).

Certain Technicolor devices have an SNMP access-control bypass, possibly involving an ISP customization. The Technicolor DPC3928SL with specific firmware can be reached from the Internet using any SNMP community string.

A stack-based buffer overflow in the ipv6_addr_from_str function in RIOT prior to April 25, 2017, can be exploited by local and potentially remote attackers. Attackers may cause a denial of service or possibly have unspecified other impacts via a malformed IPv6 address.

FreeType 2 before March 26, 2017, has an out-of-bounds write caused by a heap-based buffer overflow related to the t1_builder_close_contour function in psaux/psobjs.c.

The dpkg-source program in versions 1.3.0 through 1.18.23 allows the use of a non-GNU patch program and does not provide a protection mechanism for blank-indented diff hunks, enabling remote attackers to conduct directory traversal attacks via a crafted Debian source package.

On Wireless IP Camera (P2P) WIFICAM devices, access to .ini files (containing credentials) is not correctly checked. An attacker can bypass authentication by providing an empty loginuse parameter and an empty loginpas parameter in the URI.

WIFICAM (P2P) Wireless IP Camera devices have a backdoor root account that can be accessed via TELNET.

TP-Link C2 and C20i devices with firmware 0.9.1 4.2 v0032.0 Build 160706 Rel.37961n allow remote code execution with a single HTTP request by placing shell commands in a 'host=' line within HTTP POST data.

TP-Link C2 and C20i devices with firmware 0.9.1 4.2 v0032.0 Build 160706 Rel.37961n have backdoor accounts. These accounts include admin with password 1234, guest with password guest, and test with password test.

The eCommerce Shopsoftware version 2.0.2.2 rev 10690 contains an XXE vulnerability in the api/it-recht-kanzlei/api-it-recht-kanzlei.php file.