CVE Vulnerability Catalog

An issue was discovered in Pivotal RabbitMQ 3.x before 3.5.8 and 3.6.x before 3.6.6, as well as RabbitMQ for PCF 1.5.x before 1.5.20, 1.6.x before 1.6.12, and 1.7.x before 1.7.7, regarding MQTT connection authentication. Authentication using a username/password pair succeeds if an existing username is provided but the password is omitted from the connection request.

The Single Sign-On feature in VMware vCenter Server 5.5 before U3e, 6.0 before U2a, and vRealize Automation 6.x before 6.2.5 allows remote attackers to read arbitrary files or cause a denial of service via an XML document containing an external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) issue.

VMware vRealize Operations versions 6.x before 6.4.0 allow remote authenticated users to gain privileges or halt and remove virtual machines via unspecified vectors.

VMware vSphere Data Protection (VDP) versions 5.5.x through 6.1.x contains an SSH private key with a publicly known password, making it easier for remote attackers to gain login access via an SSH session.

A vulnerability in the Docker Engine configuration of Cisco CloudCenter Orchestrator (CCO) could allow an unauthenticated, remote attacker to install Docker containers with high privileges on the affected system.

Bundler 1.x may allow remote attackers to inject arbitrary Ruby code into an application by leveraging a gem name collision on a secondary source.

In the perl-XML-Twig module, the `expand_external_ents` option, which is supposed to control external entity expansion, does not work correctly. External entities are always expanded, regardless of the option's setting.

Microsoft Office 2016 contains a vulnerability that allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted document.

In dotCMS before version 3.3.2, there is an SQL injection vulnerability in the REST API that allows remote attackers to execute arbitrary SQL commands via the stName parameter to api/content/save/1.

Lack of appropriate exception handling in some receivers of the Telecom application on Samsung Note devices with L(5.0/5.1), M(6.0), and N(7.0) software allows attackers to crash the system easily resulting in a possible DoS attack, or possibly gain privileges.

Lack of appropriate exception handling in some receivers of the Telecom application on Samsung Note devices with L(5.0/5.1), M(6.0), and N(7.0) software allows attackers to easily crash the system, potentially leading to a DoS attack or gaining privileges.

Lack of appropriate exception handling in some receivers of the Telecom application on Samsung Note devices with L(5.0/5.1), M(6.0), and N(7.0) software allows attackers to easily crash the system, potentially leading to a DoS attack or gaining privileges.

An issue was discovered in xrdp before 0.9.1, where a file ~/.vnc/sesman_${username}_passwd is created upon successful RDP login. Its content is the user's cleartext password, DES encrypted with a known key.

MagpieRSS, used in the front-end component in Nagios Core before version 4.2.2, may allow remote attackers to read or write to arbitrary files by spoofing a crafted response from the Nagios RSS feed server.

Adobe InDesign version 11.4.1 and earlier, Adobe InDesign Server 11.0.0 and earlier have an exploitable memory corruption vulnerability. Successful exploitation could lead to arbitrary code execution.

Adobe Animate versions 15.2.1.95 and earlier have an exploitable memory corruption vulnerability. Successful exploitation could lead to arbitrary code execution.

Adobe DNG Converter versions 9.7 and earlier have an exploitable memory corruption vulnerability. Successful exploitation could lead to arbitrary code execution.

XRegion in TigerVNC allows remote VNC servers to cause a denial of service (NULL pointer dereference) by leveraging failure to check a malloc return value, a similar issue to CVE-2014-6052.

CVE-2016-1000156 is a vulnerability related to an incomplete fix for remote file upload in Mailcwp version 1.100. It allows attackers to upload malicious files to the server.

Buffer underflow in X.org libXvMC before 1.0.10 allows remote X servers to have unspecified impact via an empty string.