CVE Vulnerability Catalog

Unauthenticated messages are processed by the User Equipment (UE). Certain NAS messages are processed when no EPS security context exists in the UE.

In CodeIgniter before version 3.1.3, a vulnerability exists in Email.php that allows remote attackers to execute arbitrary code. Attackers can leverage control over the email->from field to inject sendmail command-line arguments.

All versions of PHP 7 have a vulnerability that during the unserialization process may lead to use-after-free when resizing the 'properties' hash table of a serialized object. A remote attacker may exploit this bug to gain arbitrary code execution.

The base64decode function in base64.c in libimobiledevice libplist through version 1.12 allows attackers to obtain sensitive information from process memory or cause a denial of service (buffer over-read) via split encoded Apple Property List data.

The SplObjectStorage unserialize implementation in PHP before 7.0.12 does not verify that a key is an object, allowing remote attackers to execute arbitrary code or cause a denial of service via crafted serialized data.

In PHP before 7.0.15 and 7.1.x before 7.1.1, there is an issue in zend_hash.c that mishandles cases requiring large array allocations. This can allow remote attackers to execute arbitrary code or cause a denial of service.

The 'process-execute' and 'process-spawn' procedures in CHICKEN Scheme use fixed-size buffers for holding arguments and environment variables for the execve() call. This can lead to buffer overrun when user-supplied argument/environment variable lists are provided.

eClinicalWorks Population Health (CCMR) has a session fixation vulnerability. The application does not assign a new session ID during user authentication, allowing the use of an existing session ID.

Splunk Web in Splunk Enterprise before version 5.0.17, 6.0.13, 6.1.12, 6.2.12, 6.3.8, and 6.4.4 is vulnerable to HTTP request injection attacks, allowing remote attackers to obtain sensitive REST API authentication-token information.

An issue was discovered in Pivotal GemFire for PCF 1.6.x versions prior to 1.6.5 and 1.7.x versions prior to 1.7.1 regarding unauthenticated access to the gfsh (Geode Shell) endpoint. This endpoint is publicly accessible, allowing attackers to execute any commands.

Multiple integer overflows in the process_bin_update function in Memcached can be exploited to cause heap overflow and lead to remote code execution.

An integer overflow in the process_bin_append_prepend function in Memcached can be exploited to cause heap overflow and lead to remote code execution.

An exploitable out-of-bounds write exists in the Bzip2 parsing of the Lexmark Perspective Document Filters conversion functionality. A crafted Bzip2 document can lead to a stack-based buffer overflow causing an out-of-bounds write which under the right circumstance could potentially be leveraged by an attacker to gain arbitrary code execution.

CVE-2016-2339 describes a heap overflow vulnerability in the 'initialize' function of Fiddle::Function.new in Ruby. A specially crafted object passed as an element of the args array can increase the size of this array after allocation, leading to a heap overflow.

Type confusion exists in the TclTkIp class method _cancel_eval in Ruby. An attacker passing a different type of object than String as the 'retval' argument can cause arbitrary code execution.

Type confusion exists in the WIN32OLE class in Ruby in the ole_invoke and ole_query_interface methods. An attacker passing a different type of object than assumed by developers can cause arbitrary code execution.

A remote code execution vulnerability exists in the Trane ComfortLink II firmware version 2.0.2 in the DSS service. An attacker who can connect to the DSS service on the Trane ComfortLink II device can send an overly long REG request that can overflow a fixed size stack buffer, resulting in arbitrary code execution.

A design flaw in the Trane ComfortLink II SCC firmware version 2.0.2 allows remote attackers to take complete control of the system.

Heap-based buffer overflow in MatrixSSL before version 3.8.6 allows remote attackers to execute arbitrary code via a crafted Subject Alt Name in an X.509 certificate.

In Veritas NetBackup Appliance versions 2.6.0.x through 2.6.0.4, 2.6.1.x through 2.6.1.2, 2.7.x through 2.7.3, and 3.0.x, a vulnerability allows remote attackers to execute arbitrary commands via shell metacharacters in the hostName parameter to appliancews/getLicense.