An exposure of sensitive information vulnerability exists in Jenkins Kubernetes Plugin 1.10.1 and earlier in KubernetesCloud.java that allows attackers to capture credentials with a known credentials ID stored in Jenkins.


A exposure of sensitive information vulnerability exists in Jenkins Kubernetes Plugin 1.7.0 and older in ContainerExecDecorator.java that results in sensitive variables such as passwords being written to logs.


An exposure of sensitive information vulnerability exists in Jenkins GitHub Pull Request Builder Plugin version 1.39.0 and older in GhprbCause.java that allows an attacker with local file system access to obtain GitHub credentials.


An exposure of sensitive information vulnerability exists in Jenkins Reverse Proxy Auth Plugin 1.5 and older in ReverseProxySecurityRealm#authContext that allows attackers with local file system access to obtain a list of authorities for logged in users.


An exposure of sensitive information vulnerability exists in Jenkins Perforce Plugin version 1.3.36 and older in PerforcePasswordEncryptor.java that allows attackers with local file system access to obtain encrypted Perforce passwords and decrypt them.


A exposure of sensitive information vulnerability exists in Jenkins Configuration as Code Plugin 0.7-alpha and earlier in ConfigurationAsCode.java that allows attackers with Overall/Read access to obtain the YAML export of the Jenkins configuration.


An exposure of sensitive information vulnerability exists in Schneider Electric's Pelco VideoXpert Enterprise versions 2.0 and prior. Using a directory traversal attack an unauthorized person can view web server files.

exposure of sensitive information
directory traversal


In all Android releases from CAF using the Linux kernel a QTEE system call fails to validate a pointer.


If an application encounters a fatal protocol error and then calls SSL_shutdown() twice (once to send a close_notify and once to receive one) then OpenSSL can respond differently to the calling application if a 0 byte record is received with invalid padding compared to if a 0 byte record is received with an invalid MAC. If the application then behaves differently based on that in a way that is detectable to the remote peer then this amounts to a padding oracle that could be used to decrypt data. In order for this to be exploitable \non-stitched\ ciphersuites must be in use. Stitched ciphersuites are optimised implementations of certain commonly used ciphersuites. Also the application must call SSL_shutdown() twice even if a protocol error has occurred (applications should not do this but some do anyway). Fixed in OpenSSL 1.0.2r (Affected 1.0.2-1.0.2q).


A security feature bypass vulnerability exists when Windows Netlogon improperly handles a secure communications channel aka 'NetLogon Security Feature Bypass Vulnerability'.


A security feature bypass exists when Windows Secure Boot improperly restricts access to debugging functionality aka 'Windows Secure Boot Security Feature Bypass Vulnerability'.


A security feature bypass vulnerability exists when Microsoft Browsers fail to validate the correct Security Zone of requests for specific URLs aka 'Microsoft Browser Security Feature Bypass Vulnerability'.


A security feature bypass vulnerability exists where a NETLOGON message is able to obtain the session key and sign messages.To exploit this vulnerability an attacker could send a specially crafted authentication request aka 'Microsoft Windows Security Feature Bypass Vulnerability'.


A security feature bypass vulnerability exists in Microsoft Office software by not enforcing macro settings on an Excel document aka 'Microsoft Office Excel Security Feature Bypass'.


A security feature bypass vulnerability exists in Active Directory Federation Services (ADFS) which could allow an attacker to bypass the extranet lockout policy.To exploit this vulnerability an attacker could run a specially crafted application which would allow an attacker to launch a password brute-force attack or cause account lockouts in Active Directory.This security update corrects how ADFS handles external authentication requests. aka 'ADFS Security Feature Bypass Vulnerability'. This CVE ID is unique from CVE-2019-0975.


A security feature bypass exists when Windows incorrectly validates CAB file signatures aka 'Windows File Signature Security Feature Bypass Vulnerability'.


A security feature bypass vulnerability exists when Microsoft browsers improperly handle requests of different origins aka 'Microsoft Browsers Security Feature Bypass Vulnerability'.


A security feature bypass vulnerability exists in Edge that allows for bypassing Mark of the Web Tagging (MOTW) aka 'Microsoft Edge Security Feature Bypass Vulnerability'.


A security feature bypass vulnerability exists when Microsoft Office improperly handles input aka 'Microsoft Office Security Feature Bypass Vulnerability'.


A security feature bypass vulnerability exists when Microsoft Defender improperly handles specific buffers aka 'Microsoft Defender Security Feature Bypass Vulnerability'.


A security feature bypass vulnerability exists when Microsoft Edge improperly handles extension requests and fails to request host permission for all_urls aka 'Microsoft Edge Security Feature Bypass Vulnerability'.


PHP file inclusion vulnerability in includes/edit_new.php in Pivot 1.30 RC2 and earlier when register_globals is enabled allows remote attackers to execute arbitrary PHP code via a FTP URL or full file path in the Pathsextensions_path parameter.


PHP file inclusion vulnerability in top_graph_header.php in Cacti 0.8.6d and possibly earlier versions allows remote attackers to execute arbitrary PHP code via the configlibrary_path parameter.


PHP file inclusion vulnerability in index.php of iCMS allows remote attackers to include arbitrary files via the page parameter.


PHP file inclusion vulnerability in grab_globals.lib.php in phpMyAdmin 2.6.4 and 2.6.4-pl1 allows remote attackers to include local files via the $__redirect parameter possibly involving the subform array.


PHP file inclusion vulnerability in bug_sponsorship_list_view_inc.php in Mantis 1.0.0RC2 and 0.19.2 allows remote attackers to execute arbitrary PHP code and include arbitrary local files via the t_core_path parameter.


PHP file inclusion vulnerability in user.php in PostNuke 0.703 allows remote attackers to include arbitrary files and possibly execute code via the caselist parameter.


Local file inclusion vulnerability in Zenphoto 1.4.14 and earlier allows a remote attacker with an administrative privilege to execute arbitrary code or obtain sensitive information.

file inclusion vulnerability
arbitrary code execution


Local file inclusion vulnerability in OneThird CMS v1.96c and earlier allows a remote unauthenticated attacker to execute arbitrary code or obtain sensitive information via unspecified vectors.


PHP file inclusion vulnerability in index.php in OSTE 1.0 allows remote attackers to execute arbitrary code via the (1) page and (2) site parameters.


PHP file inclusion vulnerability in osCommerce 2.1 execute arbitrary commands via the include_file parameter to include_once.php.

file inclusion vulnerability
arbitrary command execution


PHP file inclusion vulnerability in index.php in Content2Web 1.0.1 allows remote attackers to include arbitrary files via the show parameter which can lead to resultant errors such as path disclosure SQL error messages and cross-site scripting (XSS).

file inclusion vulnerability
cross site scripting


PHP file inclusion vulnerability in the osTicket module in Help Center Live before 2.0.3 allows remote attackers to access or include arbitrary files via the file parameter possibly due to a directory traversal vulnerability.

file inclusion vulnerability
directory traversal


Unrestricted file upload vulnerability in Micro Focus ArcSight Logger version 6.7.0 and later. This vulnerability could allow Unrestricted Upload of File with Dangerous type.


Unrestricted file upload vulnerability in view.php in Machform 2 allows remote attackers to execute arbitrary PHP code by uploading a PHP file then accessing it via a direct request to the file in the upload form's directory in data/.


Unrestricted file upload vulnerability in lazyseo.php in the Lazy SEO plugin 1.1.9 for WordPress allows remote attackers to execute arbitrary PHP code by uploading a PHP file then accessing it via a direct request to the file in lazy-seo/.


Arbitrary file upload vulnerability in Fork CMS 5.9.2 allows attackers to create or replace arbitrary files in the /themes directory via a crafted zip file uploaded to the Themes panel.


A File Upload vulnerability exists in Sourcecodester Student Attendance Manageent System 1.0 via the file upload functionality.


A file upload vulnerability exists in Sourcecodester Customer Relationship Management System 1.0 via the account update option & customer create option which could let a remote malicious user upload an arbitrary php file. .


A File Upload vulnerability exists in bbs v5.3 via QuestionManageAction.java in a getType function.


A File Upload vulnerability exists in Studio-42 elFinder 2.0.4 to 2.1.59 via connector.minimal.php which allows a remote malicious user to upload arbitrary files and execute PHP code.


Unrestricted file upload vulnerability in config/upload.php in Moonware (aka Dale Mooney Gallery) allows remote attackers to upload and execute arbitrary PHP files in images/ possibly related to config/admin.php.


Unrestricted file upload vulnerability in admin/pages/blog-add.php in Neuron Blog 1.1 allows remote attackers to upload and execute arbitrary PHP files in uploads/.


Unrestricted file upload vulnerability in pfs.php in Neocrome Seditio 121 and earlier allows remote authenticated users to upload arbitrary PHP code via a filename ending with (1) .php.gif (2) .php.jpg or (3) .php.png.


Unrestricted file upload vulnerability in mod/contak.php in AuraCMS 2.1 allows remote attackers to upload and execute arbitrary PHP files via the image parameter which places a file under files/.


Unrestricted file upload vulnerability in EZPhotoSales 1.9.3 and earlier allows remote authenticated administrators to upload and execute arbitrary PHP code under OnlineViewing/galleries/.


Unrestricted file upload vulnerability in banner-upload.php in Szymon Kosok Best Top List allows remote attackers to upload and execute arbitrary PHP files in banners/.


Unrestricted file upload vulnerability in index.php in Pakupaku CMS 0.4 and earlier allows remote attackers to upload and execute arbitrary PHP files in uploads/ via an Uploads action.


Unrestricted file upload vulnerability in eFileMan 7.1.0.87-88 allows remote attackers to upload arbitrary files with \uploads/upload_file.\ destination filenames via unspecified vectors to upload.cgi accessed from upload.html.


Unrestricted file upload vulnerability in the profiles script in ProfileCMS 1.0 allows remote attackers to upload and execute arbitrary PHP code via unspecified vectors involving creation of a profile.


Unrestricted file upload vulnerability in component/upload.jsp in Korean GHBoard allows remote attackers to upload arbitrary files via unspecified vectors probably involving a direct request.


Unrestricted file upload vulnerability in uploadrequest.asp in Layton HelpBox 3.7.1 allows remote authenticated users to upload and execute arbitrary ASP files related to not properly checking file extensions.


Unrestricted file upload vulnerability in the UpLoad feature (lib/plugin/UpLoad.php) in PhpWiki 1.3.x allows remote attackers to upload arbitrary PHP files with a (1) php3 (2) php4 or (3) php5 extension.


Unrestricted file upload vulnerability in Jetbox CMS allows remote authenticated users with author privileges to upload arbitrary scripts via unspecified vectors which can be accessed in webfiles/. NOTE: this issue might be a duplicate of CVE-2004-1448.


Unrestricted file upload vulnerability in includes/upload_file.php in DmCMS allows remote attackers to upload arbitrary PHP scripts by placing a script's contents in both the File2 and File3 parameters and sending a ok.php?do=act Referer.


Unrestricted file upload vulnerability in FileCloset before 1.1.5 allows remote attackers to upload arbitrary PHP files via unspecified vectors.


Unrestricted file upload vulnerability in labs.beffa.org w2box 4.0.0 Beta4 allows remote attackers to upload arbitrary PHP code via a filename with a double extension such as .php.jpg.


Unrestricted file upload vulnerability in forum_write.php in Maran PHP Forum allows remote attackers to upload and execute arbitrary PHP files via a trailing %00 in a filename in the page parameter.


Unrestricted file upload vulnerability in admin/images.php in Pluxml 0.3.1 allows remote attackers to upload and execute arbitrary PHP code via a .jpg filename.


Unrestricted file upload vulnerability in upload.php in dreamLog (aka dreamblog) 0.5 allows remote attackers to upload and execute arbitrary PHP code in uploads/images/ via the uploadedFile parameter.


Unrestricted file upload vulnerability in LiveCMS 3.4 and earlier allows remote attackers to upload and execute arbitrary PHP code by specifying a PHP file type in a parameter intended for \a small image\ associated with an article.


Unrestricted file upload vulnerability in signup.php in e107 0.7.8 and earlier when photograph upload is enabled allows remote attackers to upload and execute arbitrary PHP code via a filename with a double extension such as .php.jpg.


Unrestricted file upload vulnerability in Link Request Contact Form 3.4 allows remote attackers to execute arbitrary PHP code by uploading a file with a .php extension and an image content type as demonstrated by image/jpeg.


Unrestricted file upload vulnerability in Cromosoft Simple Plantilla PHP (SPP) allows remote attackers to upload arbitrary scripts via a filename with a double extension.


Unrestricted file upload vulnerability in gallery.php in phpx 3.5.15 allows remote attackers to upload and execute arbitrary PHP scripts via an addImage action which places scripts into the gallery/shelties/ directory.


Unrestricted file upload vulnerability in LoveCMS 1.4 allows remote authenticated administrators to upload arbitrary files to /modules/content/pictures/tmp/.


Unrestricted file upload vulnerability in webSPELL allows remote authenticated administrators to upload and execute arbitrary PHP code via the add squad feature. NOTE: this issue may be an administrative feature in which case this CVE may be REJECTED.


Unrestricted file upload vulnerability in sitex allows remote attackers to upload arbitrary PHP code via an avatar filename with a double extension such as .php.jpg which fails verification and is saved as a .php file.


Unrestricted file upload vulnerability in index.php in IceBB 1.0-rc5 allows remote authenticated users to upload arbitrary files via the avatar function which can later be accessed in uploads/.


Unrestricted file upload vulnerability in eXtremePow eXtreme File Hosting allows remote attackers to upload arbitrary PHP code via a filename with a double extension such as (1) .rar.php or (2) .zip.php.


Unrestricted File Upload vulnerability in Photo Gallery 1.2.5.


Unrestricted file upload vulnerability in the N-Media file uploader plugin before 3.4 for WordPress allows remote authenticated users to execute arbitrary PHP code by leveraging Author privileges to store a file.


Unrestricted file upload vulnerability in admintools/editpage-2.php in Agoko CMS 0.4 and earlier allows remote attackers to inject and execute arbitrary PHP code via the filename and text parameters.


Unrestricted file upload vulnerability in upload.php in PHPSimplicity Simplicity oF Upload 1.3.2 allows remote attackers to execute arbitrary PHP code by uploading a file with a double extension as demonstrated by .php.gif.


Unrestricted file upload vulnerability in AspDotNetStorefront 3.3 allows remote authenticated administrators to upload arbitrary files with executable extensions via admin/images.aspx.


Unrestricted file upload vulnerability in PixlrEditorHandler.php in Synology Photo Station before 6.7.3-3432 and 6.3-2967 allows remote attackers to create arbitrary PHP scripts via the type parameter.


Remote file upload vulnerability in Wordpress Plugin Mobile App Native 3.0.


Unrestricted File Upload vulnerability in GPWeb 8.4.61 allows remote authenticated users to upload any type of file including a PHP shell.


Unrestricted file upload vulnerability in Infinite Automation Mango Automation 2.5.x and 2.6.x before 2.6.0 build 430 allows remote authenticated users to execute arbitrary JSP code via vectors involving an upload of an image file.


Remote file upload vulnerability in fast-image-adder v1.1 Wordpress plugin


Remote file upload vulnerability in mailcwp v1.99 wordpress plugin


Remote file upload vulnerability in wordpress plugin csv2wpec-coupon v1.1


Unrestricted file upload vulnerability in the Avatar Uploader module before 6.x-1.3 for Drupal allows remote authenticated users to execute arbitrary PHP code by uploading a file with a PHP extension then accessing it via unspecified vectors.


Unrestricted file upload vulnerability in admin/x_image.php in Szava Gyula and Csaba Tamas e-Vision CMS probably 1.0 allows remote attackers to upload arbitrary files to the /imagebank directory.


Unrestricted file upload vulnerability in index.php in Speedywiki 2.0 allows remote authenticated users to upload and execute arbitrary PHP code by setting the upload parameter to 1.


Unrestricted file upload vulnerability in upload.php for Free Web Publishing System (FreeWPS) possibly 2.11 and earlier allows remote attackers to upload and execute arbitrary PHP programs.


Unrestricted

file

upload

vulnerability

in

in

Site@School

(S@S)

and

earlier

allows

remote

attackers

to

upload

and

execute

arbitrary

files

with

executable

extensions.


Unrestricted file upload vulnerability in fileupload.html in vtiger CRM 4.2.4 and possibly earlier versions allows remote attackers to upload and execute arbitrary files with executable extensions in the /cashe/mails folder.


Unrestricted file upload vulnerability in lib/exe/media.php in DokuWiki before 2006-03-09c allows remote attackers to upload executable files into the data/media folder via unspecified vectors.


Unrestricted file upload vulnerability in modules/galleryuploadfunction.php in Jupiter CMS allows remote attackers to upload picture files and possibly files with arbitrary extensions to gallery/albums/public.


Unrestricted file upload vulnerability in The Address Book 1.04e validates the Content-Type header but not the file extension which allows remote attackers to upload arbitrary PHP scripts.


Unrestricted file upload vulnerability in upload.php in GenesisTrader 1.0 allows remote authenticated users to upload arbitrary files via unspecified vectors possibly involving form.php and the ajoutfich \foap\ action.


Unrestricted file upload vulnerability in admin/uploads.php in PHP-Update 2.7 and earlier allows remote authenticated users to upload arbitrary PHP scripts to the gfx/ and files/ directories via the userfile parameter.


Unrestricted file upload vulnerability in admin/add.php in Midicart allows remote authenticated users to upload arbitrary .php files and possibly other files to the images/ directory under the web root.


Unrestricted file upload vulnerability in TFT-Gallery allows remote authenticated administrators to upload arbitrary .php files possibly using admin/index.php. NOTE: this can be leveraged with CVE-2006-1412 to create a remote unauthenticated vector.


Unrestricted file upload vulnerability in add.asp in OzzyWork Gallery possibly 2.0 and earlier allows remote attackers to upload and execute arbitrary ASP files by removing the client-side security checks.


Unrestricted file upload vulnerability in IMCE before 1.6 a Drupal module allows remote authenticated users to upload arbitrary PHP code via a filename with a double extension such as .php.gif.


Unrestricted file upload vulnerability in P-News 2.0 allows remote attackers to upload and execute arbitrary files via an avatar file. NOTE: the provenance of this information is unknown; the details are obtained solely from third party information.


Unrestricted file upload vulnerability in IBM Rational AppScan Enterprise 5.x and 8.x before 8.5.0.1 allows remote authenticated users to execute arbitrary ASP.NET code by uploading a .aspx file and then accessing it via unspecified vectors.


Unrestricted file upload vulnerability in NetArt Media Car Portal 3.0 allows remote attackers to execute arbitrary PHP code by uploading a file a double extension as demonstrated by .php%00.jpg.


Unrestricted file upload vulnerability in Ultimate Member plugin prior to version 2.0.4 for WordPress allows remote authenticated users to upload arbitrary image files via unspecified vectors.


Unrestricted file upload vulnerability in SiteBridge Inc. Joruri Gw Ver 3.2.0 and earlier allows remote authenticated users to execute arbitrary PHP code via unspecified vectors.


A file upload vulnerability was discovered in the file path /bl-plugins/backup/plugin.php on Bludit version 3.12.0. If an attacker is able to gain Administrator rights they will be able to use unsafe plugins to upload a backup file and control the server.


Unrestricted file upload vulnerability in the file manager module in DotNetNuke before 4.8.2 allows remote administrators to upload arbitrary files and gain privileges to the server via unspecified vectors.


Unrestricted file upload vulnerability in admin/galeria.php in ThePortal2 2.2 allows remote attackers to execute arbitrary PHP code by uploading a file with an executable extension then accessing it via a direct request to the file in galeria/.


Unrestricted file upload vulnerability in ImperialBB 2.3.5 and earlier allows remote authenticated users to upload and execute arbitrary PHP code by placing a .php filename in the Upload_Avatar parameter and sending the image/gif content type.


Unrestricted file upload vulnerability in src/yopy_upload.php in Project-Based Calendaring System (PBCS) 0.7.1 allows remote authenticated users to upload arbitrary files to tmp/uploads.


Unrestricted file upload vulnerability in admin/upload.php in Benja CMS 0.1 allows remote attackers to upload and execute arbitrary PHP files via unspecified vectors followed by a direct request to the file in billeder/.


Unrestricted file upload vulnerability in qtofm.php in QTOFileManager 1.0 allows remote attackers to execute arbitrary PHP code by uploading a file with an executable extension then accessing it via a direct request.


Unrestricted file upload vulnerability in WordPress 2.5.1 and earlier might allow remote authenticated administrators to upload and execute arbitrary PHP files via the Upload section in the Write Tabs area of the dashboard.


Unrestricted file upload vulnerability in dmclTrace.jsp in EMC Documentum Administrator 5.3.0.313 and Webtop 5.3.0.317 allows remote attackers to overwrite arbitrary files via the filename attribute.


Unrestricted file upload vulnerability in ajaxfilemanager.php in the Wp-FileManager 1.2 plugin for WordPress allows remote attackers to upload and execute arbitrary PHP code via unspecified vectors.


Unrestricted file upload vulnerability in PHP F1 Max's File Uploader allows remote attackers to upload and execute arbitrary PHP files.


Unrestricted file upload vulnerability in Zero CMS 1.0 Alpha and earlier allows remote attackers to bypass intended access restrictions and upload and execute arbitrary files by uploading an avatar file with an accepted Content-Type such as image/jpeg.


Unrestricted file upload vulnerability in PhotoPost vBGallery before 2.4.2 allows remote attackers to upload and execute arbitrary files via unknown vectors.


Unrestricted file upload vulnerability in JSPWiki 2.4.104 and 2.5.139 allows remote attackers to upload and execute arbitrary .jsp files via an unspecified manipulation that attaches a .jsp file to an \entry page.\


Unrestricted file upload vulnerability in IBM Algo One UDS 4.7.0 through 5.0.0 allows remote authenticated users to execute arbitrary code by uploading a .jsp file and then launching it.

file upload vulnerability
arbitrary code execution


Unrestricted file upload vulnerability in the SAP NetWeaver Development Infrastructure (NWDI) allows remote attackers to execute arbitrary code by uploading a file with an executable extension via unspecified vectors.


Unrestricted file upload vulnerability in IBM SPSS Analytical Decision Management 6.1 before IF1 6.2 before IF1 and 7.0 before FP1 IF6 allows remote authenticated users to execute arbitrary code by uploading and accessing a JSP file.


Unrestricted file upload vulnerability in Apache Tomcat 7.x before 7.0.40 in certain situations involving outdated java.io.File code and a custom JMX configuration allows remote attackers to execute arbitrary code by uploading and accessing a JSP file.


Unrestricted file upload vulnerability in the chunk upload API in MediaWiki 1.19 through 1.19.6 and 1.20.x before 1.20.6 allows remote attackers to execute arbitrary code by uploading a file with an executable extension.


Arbitrary

file

upload

vulnerability

in

Victor

CMS

v

allows

attackers

to

execute

arbitrary

code

via

the

file

upload

to


Arbitrary file upload vulnerability in SourceCodester E-Commerce Website v 1.0 allows attackers to execute arbitrary code via the file upload to prodViewUpdate.php.


Arbitrary file upload vulnerability in SourceCodester Responsive Ordering System v 1.0 allows attackers to execute arbitrary code via the file upload to Product_model.php.


Arbitrary file upload vulnerability in SourceCodester Travel Management System v 1.0 allows attackers to execute arbitrary code via the file upload to updatepackage.php.


Arbitrary file upload vulnerability in SourceCodester Alumni Management System v 1.0 allows attackers to execute arbitrary code via the file upload to manage_event.php.


Arbitrary file upload vulnerability in SourceCodester Learning Management System v 1.0 allows attackers to execute arbitrary code via the file upload to \\lms\\student_avatar.php.


Arbitrary file upload vulnerability in SourceCodester Ordering System v 1.0 allows attackers to execute arbitrary code via the file upload to ordering\\admin\\products\\edit.php.


A File Upload vulnerability exists in bbs 5.3 is via MembershipCardManageAction.java in a GetType function which lets a remote malicious user execute arbitrary code.


A File Upload vulnerability exists in bbs 5.3 is via TopicManageAction.java in a GetType function which lets a remote malicious user execute arbitrary code.


A File Upload vulnerability exists in bbs 5.3 is via HelpManageAction.java in a GetType function which lets a remote malicious user execute arbitrary code.


A File Upload vulnerability exists in bbs 5.3 is via ForumManageAction.java in a GetType function which lets a remote malicious user execute arbitrary code.


Arbitrary file upload vulnerability sysupload.php in millken doyocms 2.3 allows attackers to execute arbitrary code.


Unrestricted file upload vulnerability in Huawei Honor Cube Wireless Router WS860s before V100R001C02B222 allows remote attackers to execute arbitrary code by uploading a file with an executable extension then accessing it via unspecified vectors.


Unrestricted file upload vulnerability in Visual Mining NetCharts Server allows remote attackers to execute arbitrary code by uploading a file with an executable extension then accessing it via unspecified vectors.


Unrestricted file upload vulnerability in PaperThin CommonSpot before 7.0.2 and 8.x before 8.0.3 allows remote attackers to execute arbitrary code by uploading a ColdFusion page and then accessing it via unspecified vectors.


Unrestricted file upload vulnerability in Aruba Web Management portal allows remote attackers to execute arbitrary code by uploading a file with an executable extension.


Unrestricted file upload vulnerability in the powermail extension before 1.6.11 and 2.x before 2.0.14 for TYPO3 allows remote attackers to execute arbitrary code by uploading a file with a crafted extension then accessing it via unspecified vectors.


Unrestricted file upload vulnerability in Attachmate Verastream Process Designer (VPD) before R6 SP1 Hotfix 1 allows remote attackers to execute arbitrary code by uploading and launching an executable file.


Unrestricted file upload vulnerability in the image upload module in SAS Visual Analytics 6.4M1 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension then accessing it via unspecified vectors.


Unrestricted file upload vulnerability in the mm_forum extension before 1.9.3 for TYPO3 allows remote attackers to execute arbitrary code by uploading a file with an executable extension then accessing it via unspecified vectors.


Unrestricted file upload vulnerability in fileman_file_upload.php in Orbis CMS 1.0.2 allows remote authenticated users to execute arbitrary code by uploading a .php file and then accessing it via a direct request to the file in uploads/.


Unrestricted file upload vulnerability in Opial 1.0 allows remote attackers to execute arbitrary code by uploading a file with an executable extension as a User Image then accessing it via a request to the file in userimages related to register.php.


Unrestricted file upload vulnerability in admin/add_album.php in The Rat CMS Alpha 2 allows remote attackers to execute arbitrary code by uploading a file with an executable extension then accessing it via a direct request to the file in images/.


Unrestricted file upload vulnerability in admin.php in MCshoutbox 1.1 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension then accessing it via a direct request to the file in smilies/.


Unrestricted file upload vulnerability in admin/uploadform.asp in Battle Blog 1.25 allows remote attackers to execute arbitrary code by uploading a file with an executable extension then accessing it via a direct request to the file.


Unrestricted file upload vulnerability in VidSharePro allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension then accessing it via unspecified vectors.


Unrestricted file upload vulnerability in upload.php in WikkiTikkiTavi 1.11 allows remote attackers to execute arbitrary code by uploading a file with an executable extension then accessing it via a direct request to the file in img/.


Unrestricted file upload vulnerability in Element-IT Ultimate Uploader 1.3 allows remote attackers to execute arbitrary code by uploading a file with an executable extension then accessing it via a direct request to the file in upload/.


Unrestricted file upload vulnerability in upper.php in kandalf upper 0.1 allows remote attackers to execute arbitrary code by uploading a file with an executable extension then accessing it via a direct request to the file in fileup/.


Unrestricted file upload vulnerability in ajax/addComment.php in telepark.wiki 2.4.23 and earlier script allows remote attackers to execute arbitrary code by uploading a file with a name containing a NULL byte.


Unrestricted file upload vulnerability in uploader.php in Uploader 1.1 allows remote attackers to execute arbitrary code by uploading a file with an executable extension then accessing it via a direct request to the file in uploads/.


Unrestricted file upload vulnerability in the Administration Panel for NewsPHP allows remote authenticated administrators to upload and execute arbitrary code instead of video files.


Unrestricted file upload vulnerability in QNAP Signage Station before 2.0.1 allows remote authenticated users to execute arbitrary code by uploading an executable file and then accessing this file via an unspecified URL.


Unrestricted file upload vulnerability in Yeager CMS 1.2.1 allows remote attackers to execute arbitrary code by uploading a file with an executable extension.


Unrestricted file upload vulnerability in app/lib/mlf.pl in C-BOARD Moyuku before 1.03b3 allows remote attackers to execute arbitrary code by uploading a file with a \\0 character in its name.


Unrestricted file upload vulnerability in EMC M&R (aka Watch4Net) before 6.5u1 and ViPR SRM before 3.6.1 allows remote authenticated users to execute arbitrary code by uploading and then accessing an executable file.


Unrestricted file upload vulnerability in Mrs. Shiromuku Perl CGI shiromuku(bu2)BBS before 2.91 allows remote attackers to execute arbitrary code by uploading an executable file.


Unrestricted file upload vulnerability in ferretCMS 1.0.4-alpha allows remote administrators to execute arbitrary code by uploading a file with an executable extension then accessing it via a direct request to the file in custom/uploads/.


Unrestricted file upload vulnerability in D-Link DCS-931L with firmware 1.04 and earlier allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension.


Unrestricted file upload vulnerability in Berta CMS allows remote attackers to execute arbitrary code by uploading a crafted image file with an executable extension then accessing it via a direct request to the file in an unspecified directory.


Unrestricted file upload vulnerability in eFront 3.6.11 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension via an attachment in a message.


Unrestricted file upload vulnerability in hava_upload.php in Havalite CMS 1.1.0 and earlier allows remote attackers to execute arbitrary code by uploading a file with a .php;.gif extension then accessing it via a direct request to the file in tmp/files/.


Unrestricted file upload vulnerability in chat/sendfile.aspx in ReadyDesk 9.1 allows remote attackers to execute arbitrary code by uploading and requesting a .aspx file.


Unrestricted file upload vulnerability in the Document Builder in IBM Rational Publishing Engine (aka RPENG) 2.0.1 before ifix002 allows remote authenticated users to execute arbitrary code by specifying an unexpected file extension.


Unrestricted file upload vulnerability in lib/image_upload.php in KafooeyBlog 1.55b allows remote attackers to execute arbitrary code by uploading a file with an executable extension then accessing it via a direct request to the file.


Unrestricted file upload vulnerability in admin/uploader.php in Minimal ABlog 0.4 allows remote attackers to execute arbitrary code by uploading a file with an executable extension then accessing it via a direct request to the file in img/.


Unrestricted file upload vulnerability in the profile feature in VidiScript allows registered remote authenticated users to execute arbitrary code by uploading a PHP file as an Avatar then accessing the avatar via a direct request.


Unrestricted file upload vulnerability in submit_file.php in AlstraSoft SendIt Pro allows remote attackers to execute arbitrary code by uploading a file with an executable extension then accessing it via a direct request to the file in send/files/.


Unrestricted file upload vulnerability in adm/visual/upload.php in SiteXS CMS 0.1.1 allows remote attackers to execute arbitrary code by uploading a file with an executable extension then accessing it via a direct request to the file in images/.


Unrestricted file upload vulnerability in PHPStore Real Estate allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension as a logo then accessing it via a direct request to the file in realty/re_images/.


Unrestricted file upload vulnerability in upload.php in YourPlace 1.0.2 and earlier allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension then accessing it via a direct request to the file.


Unrestricted file upload vulnerability in class/ApplyDB.php in ClassSystem 2.3 allows remote attackers to execute arbitrary code by uploading a file with an executable extension then accessing it via a direct request to the file in class/UploadHomepage/.


Unrestricted file upload vulnerability in add.php in FlexPHPDirectory 0.0.1 allows remote attackers to execute arbitrary code by uploading a file with an executable extension then accessing it via a direct request to the file in photo/.


Unrestricted file upload vulnerability in saa.php in Andy's PHP Knowledgebase (aphpkb) 0.92.9 allows remote attackers to execute arbitrary code by uploading a file with an executable extension then accessing it via a link that is listed by authors.php.


Unrestricted file upload vulnerability in index.php in phpAdBoard 1.8 allows remote attackers to execute arbitrary code by uploading a file with an executable extension then accessing it via a direct request to the file in photoes/.


Unrestricted file upload vulnerability in the file manager in Creative Mind Creator CMS 5.0 allows remote attackers to execute arbitrary code via unknown vectors.


Unrestricted file upload vulnerability in the BlogAPI module in Drupal 5.x before 5.10 and 6.x before 6.4 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension which is not validated.


Unrestricted file upload vulnerability in upload.php in ContentNow CMS 1.4.1 allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension then accessing it via a direct request to the file in upload/.


Unrestricted file upload vulnerability in upload_pictures.php in WebXell Editor 0.1.3 allows remote attackers to execute arbitrary code by uploading a .php file with a jpeg content type then accessing it via a direct request to the file in upload/.


Unrestricted file upload vulnerability in admin/Editor/imgupload.php in FlashBlog 0.31 beta allows remote attackers to execute arbitrary code by uploading a .php file then accessing it via a direct request to the file in tus_imagenes/.


Unrestricted file upload vulnerability in upload/uploader.html in meBiblio 0.4.7 allows remote attackers to execute arbitrary code by uploading a .php file then accessing it via a direct request to the files/ directory.


Unrestricted file upload vulnerability in GE Fanuc Proficy Real-Time Information Portal 2.6 and earlier allows remote attackers to execute arbitrary code by uploading a file with an executable extension to the main virtual directory.


Unrestricted file upload vulnerability in the ajout_cat mode in admin/main.php in Tr Script News 2.1 allows remote authenticated users to execute arbitrary code by uploading a file with a .php extension.


Unrestricted file upload vulnerability in attachement.php in HDWiki 5.0 allows remote attackers to execute arbitrary code by uploading a file with an executable extension then accessing it via a direct request to the file in image directory.


Unrestricted file upload vulnerability in the Registration/Edit My Profile portlet in IBM WebSphere Portal 7.x before 7.0.0.2 CF27 and 8.x through 8.0.0.1 CF09 allows remote attackers to cause a denial of service or modify data via unspecified vectors.

file upload vulnerability
denial of service


Arbitrary File Upload vulnerability in Online Book Store v1.0 in admin_add.php which may lead to remote code execution.

file upload vulnerability
remote code execution


Unrestricted file upload vulnerability in the yccms 3.3 project. The xhUp function's improper judgment of the request parameters triggers remote code execution.


A file upload vulnerability in vtecrm vtenext 19 CE allows authenticated users to upload files with a .pht extension resulting in remote code execution.


Ming (aka libming) 0.4.8 has an \fill overflow\ vulnerability in the function SWFShape_setLeftFillStyle in blocks/shape.c.


OpenSSL has internal defaults for a directory tree where it can find a configuration file as well as certificates used for verification in TLS. This directory is most commonly referred to as OPENSSLDIR and is configurable with the --prefix / --openssldir configuration options. For OpenSSL versions 1.1.0 and 1.1.1 the mingw configuration targets assume that resulting programs and libraries are installed in a Unix-like environment and the default prefix for program installation as well as for OPENSSLDIR should be '/usr/local'. However mingw programs are Windows programs and as such find themselves looking at sub-directories of 'C:/usr/local' which may be world writable which enables untrusted users to modify OpenSSL's default configuration insert CA certificates modify (or even replace) existing engine modules etc. For OpenSSL 1.0.2 '/usr/local/ssl' is used as default for OPENSSLDIR on all Unix and Windows targets including Visual C builds. However some build instructions for the diverse Windows targets on 1.0.2 encourage you to specify your own --prefix. OpenSSL versions 1.1.1 1.1.0 and 1.0.2 are affected by this issue. Due to the limited scope of affected deployments this has been assessed as low severity and therefore we are not creating new releases at this time. Fixed in OpenSSL 1.1.1d (Affected 1.1.1-1.1.1c). Fixed in OpenSSL 1.1.0l (Affected 1.1.0-1.1.0k). Fixed in OpenSSL 1.0.2t (Affected 1.0.2-1.0.2s).

find configuration file and certificates


In IIS an attacker could determine a real path using a request for a non-existent URL that would be interpreted by Perl (perl.exe).


Multiple format string vulnerabilities in the DCC functionality in KVIrc 3.4 and 4.0 have unspecified impact and remote attack vectors.


Multiple format string vulnerabilities in Lintian 1.23.x through 1.23.28 1.24.x through 1.24.2.1 and 2.x before 2.3.2 allow remote attackers to have an unspecified impact via vectors involving (1) check scripts and (2) the Lintian::Schedule module.


Multiple format string vulnerabilities in Midnight Commander (mc) 4.5.55 and earlier allow remote attackers to have an unknown impact.


Multiple format string vulnerabilities in White_Dune before 0.29beta851 have unspecified impact and attack vectors a different vulnerability than CVE-2008-0101.


Multiple format string vulnerabilities in Babo Violent 2 2.08.00 and earlier allow remote attackers to execute arbitrary code via format string specifiers in (1) a message or (2) certain data associated with an admin login.

format string vulnerability
arbitrary code execution


Multiple format string vulnerabilities in Battlefront Dropteam 1.3.3 and earlier allow remote attackers to execute arbitrary code via format string specifiers in the (1) username (2) password and (3) nickname fields in a \0x01\ packet.


Multiple format string vulnerabilities in PHP before 5.2.1 might allow attackers to execute arbitrary code via format string specifiers to (1) all of the *print functions on 64-bit systems and (2) the odbc_result_all function.


Multiple format string vulnerabilities in client/client.c in smbclient in Samba 3.2.0 through 3.2.12 might allow context-dependent attackers to execute arbitrary code via format string specifiers in a filename.


Multiple format string vulnerabilities in IBM DB2 Universal Database 8.1 may allow local users to execute arbitrary code via certain command line arguments to (1) db2start (2) db2stop or (3) db2govd.


Multiple format string vulnerabilities in the logger function in netzio.c for Tanne 0.6.17 allows remote attackers to execute arbitrary code via format string specifiers in syslog.


Multiple format string vulnerabilities in (1) neon 0.24.4 and earlier and other products that use neon including (2) Cadaver (3) Subversion and (4) OpenOffice allow remote malicious WebDAV servers to execute arbitrary code.


Multiple format string vulnerabilities in emil 2.1.0 and earlier may allow remote attackers to execute arbitrary code by triggering certain error messages.


Multiple format string vulnerabilities in Metamail 2.7 and earlier allow remote attackers to execute arbitrary code.


Multiple format string vulnerabilities in the (1) logquit (2) logerr or (3) loginfo functions in Software Upgrade Protocol (SUP) allows remote attackers to execute arbitrary code via format string specifiers in messages that are logged by syslog.


Multiple format string vulnerabilities in the auth_ldap_log_reason function in Apache auth_ldap 1.6.0 and earlier allows remote attackers to execute arbitrary code via various vectors including the username.


Multiple format string vulnerabilities in xiTK (xitk/main.c) in xine 0.99.3 allow remote attackers to execute arbitrary code via format string specifiers in a long filename on an EXTINFO line in a playlist file.


Multiple format string vulnerabilities in the (1) DHCP and (2) ANSI A dissectors in Ethereal before 0.10.11 may allow remote attackers to execute arbitrary code.


Multiple format string vulnerabilities in the GNOME Data Access library for GNOME2 (libgda2) 1.2.1 and earlier allow attackers to execute arbitrary code.


Multiple format string vulnerabilities in UltraISO 9.3.1.2633 and possibly other versions before 9.3.3.2685 allow user-assisted attackers to execute arbitrary code via format string specifiers in the filename of a (1) DAA or (2) ISZ file.


Multiple format string vulnerabilities in snoop on Sun Solaris 8 through 10 and OpenSolaris before snv_96 when the -o option is omitted allow remote attackers to execute arbitrary code via format string specifiers in an SMB packet.


Multiple format string vulnerabilities in heartbeat 0.4.9 and earlier (claimed as buffer overflows in some sources) allow remote attackers to execute arbitrary code via certain packets to UDP port 694 (incorrectly claimed as TCP in some sources).

format string vulnerability
buffer overflow
arbitrary code execution


Multiple format string vulnerabilities in Empire Server before 4.3.1 allow attackers to cause a denial of service (crash) via the (1) load (2) spy and (3) bomb functions.

format string vulnerability
denial of service


Multiple format string vulnerabilities in ProFTPD before 1.3.0rc2 allow attackers to cause a denial of service or obtain sensitive information via (1) certain inputs to the shutdown message from ftpshut or (2) the SQLShowInfo mod_sql directive.


Multiple format string vulnerabilities in the gm_main_window_flash_message function in Ekiga before 2.0.5 allow attackers to cause a denial of service and possibly execute arbitrary code via a crafted Q.931 SETUP packet.

format string vulnerability
denial of service
arbitrary code execution


Multiple format string vulnerabilities in Midnight Commander (mc) before 4.6.0 may allow attackers to cause a denial of service or execute arbitrary code.


Multiple format string vulnerabilities in Wireshark (aka Ethereal) 0.10.x to 0.99.0 allow remote attackers to cause a denial of service and possibly execute arbitrary code via the (1) ANSI MAP (2) Checkpoint FW-1 (3) MQ (4) XML and (5) NTP dissectors.


Multiple format string vulnerabilities in mcrypt 2.6.8 and earlier might allow user-assisted remote attackers to cause a denial of service (crash) or possibly execute arbitrary code via vectors involving (1) errors.c or (2) mcrypt.c.


Multiple format string vulnerabilities in OpenTTD before 0.4.0.1 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via unspecified vectors.


The

wp-support-plus-responsive-ticket-system

plugin

before

for

WordPress

has

full

path

disclosure.


In all Qualcomm products with Android releases from CAF using the Linux kernel user-level permissions can be used to gain access to kernel memory specifically the ION cache maintenance code is writing to a user supplied address.


Untrusted search path vulnerability in STAMP Workbench installer all versions allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.


A certain Red Hat patch for the Linux kernel in Red Hat Enterprise Linux (RHEL) 4 on the ia64 platform allows local users to use ptrace on an arbitrary process and consequently gain privileges via vectors related to a missing ptrace_check_attach call.


Cisco AnyConnect Secure Mobility Client 4.0(.00051) and earlier allows local users to gain privileges via crafted IPC messages that trigger use of root privileges for a software-package installation aka Bug ID CSCus79385.


Cisco Adaptive Security Appliance (ASA) Software before 8.4(1) on ASA 5500 ASA 5500-X PIX and FWSM devices allows local users to gain privileges via invalid CLI commands aka Bug ID CSCtu74257 or EPICBANANA.


K7 Antivirus Premium before 15.1.0.53 allows local users to gain privileges by sending a specific IOCTL after setting the memory in a particular way.


IBM AIX 6.1 7.1 and 7.2 could allow a local user to exploit a vulnerability in the bellmail binary to gain root privileges.


IBM AIX 6.1 7.1 and 7.2 could allow a local user to gain root privileges using a specially crafted command within the bellmail client. IBM APARs: IV91006 IV91007 IV91008 IV91010 IV91011.


IBM AIX 7.1 7.2 and VIOS 3.1 could allow a local user to exploit a vulnerability in Korn Shell (ksh) to gain root privileges. IBM X-Force ID: 201478.


IBM AIX 7.1 7.2 and VIOS 3.1 could allow a non-privileged local user to exploit a vulnerability in the kernel to gain root privileges. IBM X-Force ID: 203977.


IBM AIX 7.1 7.2 and VIOS 3.1 could allow a local user to exploit a vulnerability in the ksu user command to gain root privileges. IBM X-Force ID: 189960.


The affected product is vulnerable to a network-based attack by threat actors utilizing crafted naming conventions of files to gain unauthorized access rights.


A vulnerability in the External RESTful Services (ERS) API of the Cisco Identity Services Engine (ISE) could allow an authenticated remote attacker to generate arbitrary certificates signed by the Internal Certificate Authority (CA) Services on ISE. This vulnerability is due to an incorrect implementation of role-based access control (RBAC). An attacker could exploit this vulnerability by crafting a specific HTTP request with administrative credentials. A successful exploit could allow the attacker to generate a certificate that is signed and trusted by the ISE CA with arbitrary attributes. The attacker could use this certificate to access other networks or assets that are protected by certificate authentication.


The web management interface for Mitel 3300 Integrated Communications Platform (ICP) before 4.2.2.11 generates easily predictable web session IDs which allows remote attackers to hijack other sessions via the parentsessionid cookie.


Trendnet AC2600 TEW-827DRU version 2.08B01 makes use of hardcoded credentials. It is possible to backup and restore device configurations via the management web interface. These devices are encrypted using a hardcoded password of \12345678\.


Optergy Proton/Enterprise devices have Hard-coded Credentials.


Adobe Acrobat and Reader versions 2018.011.20038 and earlier 2017.011.30079 and earlier and 2015.006.30417 and earlier have an NTLM SSO hash theft vulnerability. Successful exploitation could lead to information disclosure.


A heap based buffer overflow vulnerability exits in GNU LibreDWG 0.10 via bit_read_RC ../../src/bits.c:318.


A heap based buffer overflow issue exists in GNU LibreDWG 0.10.2641 via htmlwescape ../../programs/escape.c:97.


A heap based buffer overflow vulnerability exists in GNU LibreDWG 0.10 via read_2004_section_handles ../../src/decode.c:2637.


A heap based buffer overflow vulnerability exists in GNU LibreDWG 0.10.2641 via htmlescape ../../programs/escape.c:48.


A heap based buffer overflow vulneraibility exists in GNU LibreDWG 0.10 via bit_calc_CRC ../../src/bits.c:2213.


A heap based buffer overflow vulnerability exists in GNU LibreDWG 0.10.2641via htmlescape ../../programs/escape.c:51.


A heap based buffer overflow vulnerability exists in GNU LibreDWG 0.10 via read_2004_section_revhistory ../../src/decode.c:3051.


A heap based buffer overflow vulnerability exits in GNU LibreDWG 0.10 via: read_2004_section_appinfo ../../src/decode.c:2842.


A heap based buffer overflow vulnerability exists in GNU LibreDWG 0.10 via read_2004_compressed_section ../../src/decode.c:2417.


A heap based buffer overflow vulnerability exists in GNU LibreDWG 0.10 via read_2004_section_preview ../../src/decode.c:3175.


A heap based buffer overflow issue exists in GNU LibreDWG 0.10.2641 via output_TEXT ../../programs/dwg2SVG.c:114.


A heap based buffer overflow vulnerability exits in GNU LibreDWG 0.10 via bit_search_sentinel ../../src/bits.c:1985.


A heap based buffer overflow vulnerability exits in GNU LibreDWG 0.10 via bit_read_B ../../src/bits.c:135.


A heap based buffer overflow vulnerability exists in GNU LibreDWG 0.10 via read_2004_compressed_section ../../src/decode.c:2379.


A heap based buffer overflow vulnerability exits in GNU LibreDWG 0.10 via: read_2004_section_classes ../../src/decode.c:2440.


Potential heap based buffer overflow in ParseJSS in VideoLAN VLC before 2.2.5 due to skipping NULL terminator in an input string allows attackers to execute arbitrary code via a crafted subtitles file.

heap based buffer
buffer overflow
arbitrary code execution


A heap based buffer overflow vulnerability exists in ffjpeg through 2020-07-02 in the jfif_decode(void *ctxt BMP *pb) function at ffjpeg/src/jfif.c (line 544 & line 545) which could cause a denial of service by submitting a malicious jpeg image.

heap based buffer
denial of service
buffer overflow


A heap based buffer overflow in coders/tiff.c may result in program crash and denial of service in ImageMagick before 7.0.10-45.


In CryptoPlugin::decrypt of CryptoPlugin.cpp there is a possible out of bounds write due to a heap buffer overflow. This could lead to local escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-9 Android-10Android ID: A-137283376

heap buffer overflow
escalated privilege


global heap buffer overflow in skip_range in GitHub repository vim/vim prior to 8.2.4763. This vulnerability is capable of crashing software Bypass Protection Mechanism Modify Memory and possible remote execution


A heap buffer overflow in V8 in Google Chrome prior to 56.0.2924.76 for Linux Windows and Mac and 56.0.2924.87 for Android allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.


A heap buffer overflow was discovered in the device control ioctl in the Linux driver for Nvidia graphics cards which may allow an attacker to overflow 49 bytes. This issue was fixed in version 295.53.


A heap buffer overflow vulnerability may occur in WebAssembly when \shrinkElements\ is called followed by garbage collection on memory that is now uninitialized. This results in a potentially exploitable crash. This vulnerability affects Firefox < 58.


A heap buffer overflow vulnerability may occur in WebAssembly during Memory/Table resizing resulting in a potentially exploitable crash. This vulnerability affects Firefox < 58.


A heap buffer overflow in GPU in Google Chrome prior to 70.0.3538.67 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.


A heap buffer overflow in WebGL in Google Chrome prior to 65.0.3325.146 allowed a remote attacker to perform an out of bounds memory write via a crafted HTML page.


A heap buffer overflow in /src/dds_stream.c of Eclipse IOT Cyclone DDS Project v0.1.0 causes the DDS subscriber server to crash.


A heap buffer overflow read was discovered in upx 4.0.0 because the check in p_lx_elf.cpp is not perfect.


A heap buffer overflow vulnerability in msadpcm_decode_block of libsndfile 1.0.30 allows attackers to execute arbitrary code via a crafted WAV file.

heap buffer overflow
buffer overflow
arbitrary code execution


A heap buffer overflow in SANE Backends before 1.0.30 may allow a malicious device connected to the same local network as the victim to execute arbitrary code aka GHSL-2020-084.


A heap buffer overflow in SANE Backends before 1.0.30 allows a malicious device connected to the same local network as the victim to execute arbitrary code aka GHSL-2020-080.


A heap buffer overflow in the TFTP receiving code allows for DoS or arbitrary code execution in libcurl versions 7.19.4 through 7.64.1.

heap buffer overflow
buffer overflow
dos


A heap buffer overflow in the start_decoder function in stb_vorbis through 2019-03-04 allows an attacker to cause a denial of service or execute arbitrary code by opening a crafted Ogg Vorbis file.

heap buffer overflow
denial of service
buffer overflow
arbitrary code execution


A heap buffer overflow bug in libpl_droidsonroids_gif before 1.2.19 as used in WhatsApp for Android before version 2.19.291 could allow remote attackers to execute arbitrary code or cause a denial of service.


A heap buffer overflow vulnerability in the r_asm_swf_disass function of Radare2-extras before commit e74a93c allows attackers to execute arbitrary code or carry out denial of service (DOS) attacks.

heap buffer overflow
denial of service
buffer overflow
arbitrary code execution
dos


A heap buffer overflow vulnerability in Ap4TrunAtom.cpp of Bento 1.5.1-628 may lead to an out-of-bounds write while running mp42aac leading to system crashes and a denial of service (DOS).

heap buffer overflow
denial of service
buffer overflow
dos


A heap buffer overflow vulnerability inside of BMP image processing was found at core module of ONLYOFFICE DocumentServer v4.0.0-9-v6.0.0. Using this vulnerability an attacker is able to gain remote code executions on DocumentServer.

heap buffer overflow
remote code execution
buffer overflow


In all android releases(Android for MSM Firefox OS for MSM QRD Android) from CAF using the linux kernel Heap memory was accessed after it was freed


In radare2 before 2.9.0 a heap overflow vulnerability exists in the read_module_referenced_functions function in libr/anal/flirt.c via a crafted flirt signature file.


Adobe Acrobat and Reader 2018.011.20040 and earlier 2017.011.30080 and earlier and 2015.006.30418 and earlier versions have a Heap Overflow vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.


Adobe Acrobat and Reader versions 2018.011.20063 and earlier 2017.011.30102 and earlier and 2015.006.30452 and earlier have a heap overflow vulnerability. Successful exploitation could lead to arbitrary code execution.


Adobe Acrobat and Reader versions 2018.011.20038 and earlier 2017.011.30079 and earlier and 2015.006.30417 and earlier have a Heap Overflow vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.


Adobe Acrobat and Reader versions 2020.006.20042 and earlier 2017.011.30166 and earlier 2017.011.30166 and earlier and 2015.006.30518 and earlier have a heap overflow vulnerability. Successful exploitation could lead to arbitrary code execution .


Adobe Acrobat and Reader versions 2019.021.20061 and earlier 2017.011.30156 and earlier 2017.011.30156 and earlier and 2015.006.30508 and earlier have a heap overflow vulnerability. Successful exploitation could lead to arbitrary code execution .


Adobe s 15.020.20042 and earlier 15.006.30244 and earlier 11.0.18 and earlier have an exploitable heap overflow vulnerability in the XSLT engine. Successful exploitation could lead to arbitrary code execution.


Adobe s 15.020.20042 and earlier 15.006.30244 and earlier 11.0.18 and earlier have an exploitable heap overflow vulnerability when parsing TIFF image files. Successful exploitation could lead to arbitrary code execution.


Adobe s 15.020.20042 and earlier 15.006.30244 and earlier 11.0.18 and earlier have an exploitable heap overflow vulnerability in the JPEG decoder routine. Successful exploitation could lead to arbitrary code execution.


The affected product is vulnerable to a heap-based buffer overflow which may lead to code execution.


An issue was discovered on Samsung mobile devices with P(9.0) software. There is a heap overflow in the knox_kap driver. The Samsung ID is SVE-2019-14857 (November 2019).


An issue was discovered on Samsung mobile devices with N(7.x) O(8.x) and P(9.0) (MSM8996 MSM8998 Exynos7420 Exynos7870 Exynos8890 and Exynos8895 chipsets) software. A heap overflow in the keymaster Trustlet allows attackers to write to TEE memory and achieve arbitrary code execution. The Samsung ID is SVE-2019-14126 (May 2019).


An issue was discovered on Samsung mobile devices with N(7.x) O(8.x) and P(9.0) (Exynos chipsets) software. A up_parm heap overflow leads to code execution in the bootloader. The Samsung ID is SVE-2019-14993 (September 2019).


An issue was discovered on Samsung mobile devices with N(7.x) O(8.x) and P(9.0) (Exynos chipsets) software. There is a baseband heap overflow. The Samsung ID is SVE-2018-13187 (February 2019).


An issue was discovered on Samsung mobile devices with N(7.x) O(8.x) and P(9.0) (Exynos chipsets) software. A heap overflow occurs for baseband in the Shannon modem. The Samsung ID is SVE-2019-14071 (May 2019).


An issue was discovered on Samsung mobile devices with O(8.1) and P(9.0) (Exynos chipsets) software. A heap overflow exists in the bootloader. The Samsung ID is SVE-2019-14371 (July 2019).


An exploitable heap overflow vulnerability in the AcCellMargin handling code in Autodesk Advance Steel 2018 Autodesk AutoCAD 2018 Autodesk AutoCAD Architecture 2018 Autodesk AutoCAD Electrical 2018 Autodesk AutoCAD Map 3D 2018 Autodesk AutoCAD Mechanical 2018 Autodesk AutoCAD MEP 2018 Autodesk AutoCAD P&ID 2018 Autodesk AutoCAD Plant 3D 2018 Autodesk AutoCAD LT 2018 and Autodesk Civil 3D 2018. A specially crafted DXF file with too many cell margins populating an AcCellMargin object may cause a heap overflow resulting in code execution.


A heap overflow vulnerability exisfts in openSUSE libsolv through 13 Dec 2020 in the prefer_suggested function at src/policy.c: line 442.


A heap overflow vulnerability in Citrix NetScaler Gateway versions 10.1 before 135.8/135.12 10.5 before 65.11 11.0 before 70.12 and 11.1 before 52.13 allows a remote authenticated attacker to run arbitrary commands via unspecified vectors.


A heap overflow vulnerability exists in Pixar OpenUSD 20.05 when the software parses compressed sections in binary USD files. This instance exists in the USDC file format FIELDS section decompression heap overflow.


A heap overflow vulnerability exists in Pixar OpenUSD 20.05 when the software USDC file format SPECS section decompression heap overflow.


A heap overflow vulnerability exists in Pixar OpenUSD 20.05 when the software parses compressed sections in binary USD files. An instance exists in USDC file format FIELDSETS section decompression heap overflow.


A heap overflow vulnerability in the Autodesk FBX-SDK versions 2019.2 and earlier may lead to arbitrary code execution on a system running it.


A heap overflow vulnerability was found in bluez in versions prior to 5.63. An attacker with local network access could pass specially crafted files causing an application to halt or crash leading to a denial of service.

heap overflow vulnerability
denial of service


A heap overflow vulnerability exists within FactoryTalk Linx Version 6.11 and prior. This vulnerability could allow a remote unauthenticated attacker to send malicious port ranges which could result in remote code execution.

heap overflow vulnerability
remote code execution


Heap overflow in subsystem in Intel(R) CSME before versions 11.8.70 11.11.70 11.22.70 12.0.45; Intel(R) TXE before versions 3.1.70 and 4.0.20 may allow an unauthenticated user to potentially enable escalation of privileges information disclosure or denial of service via adjacent access.

heap overflow
denial of service
weak authentication management


A heap-based buffer over-read was discovered in canUnpack in p_mach.cpp in UPX 3.95 via a crafted Mach-O file.


A heap-based buffer over-read was discovered in the function read_srclines in dwarf_getsrclines.c in libdw in elfutils 0.175. A crafted input can cause segmentation faults leading to denial-of-service as demonstrated by eu-nm.


A heap-based buffer over-read was discovered in wasm::WasmBinaryBuilder::visitCall in wasm-binary.cpp in Binaryen 1.38.22. A crafted wasm input can cause a segmentation fault leading to denial-of-service as demonstrated by wasm-merge.


A

heap-based

buffer

over-read

was

discovered

in

wasm::SExpressionParser::skipWhitespace()

in

wasm-s-parser.cpp

in

Binaryen

A

crafted

wasm

input

can

cause

a

segmentation

fault

leading

to

denial-of-service

as

demonstrated

by


A heap-based buffer over-read exists in DemuxInit() in demux/asf/asf.c in VideoLAN VLC media player 3.0.7.1 via a crafted .mkv file.


A heap-based buffer over-read in xiph_PackHeaders() in modules/demux/xiph.h in VideoLAN VLC media player 3.0.7.1 allows remote attackers to trigger a heap-based buffer over-read via a crafted .ogg file.


A heap-based buffer over-read was discovered in decompileJUMP function in util/decompile.c of libming v0.4.8. A crafted input can cause segmentation faults leading to denial-of-service as demonstrated by swftocxx.


A heap-based buffer over-read exists in the function d_expression_1 in cp-demangle.c in GNU libiberty as distributed in GNU Binutils 2.31.1. A crafted input can cause segmentation faults leading to denial-of-service as demonstrated by c++filt.


A heap-based buffer over-read exists in libopencad 0.2.0 in the ReadMCHAR function in lib/dwg/io.cpp resulting in an application crash.


A heap-based buffer over-read exists in libopencad 0.2.0 in the ReadCHAR function in lib/dwg/io.cpp resulting in an application crash.


A heap-based buffer over-read in the getbits function in src/libmpg123/getbits.h in mpg123 through 1.25.5 allows remote attackers to cause a possible denial-of-service (out-of-bounds read) or possibly have unspecified other impact via a crafted mp3 file.


A heap-based buffer overflow was found in jhead in version 3.06 in Get16u() in exif.c when processing a crafted file.


A heap-based buffer overflow vulnerability was found in ImageMagick in versions prior to 7.0.11-14 in ReadTIFFImage() in coders/tiff.c. This issue is due to an incorrect setting of the pixel array size which can lead to a crash and segmentation fault.


A heap-based buffer overflow vulnerability exists in MP4Box in GPAC 1.0.1 via the gp_rtp_builder_do_mpeg12_video function which allows attackers to possibly have unspecified other impact via a crafted file in the MP4Box command


A heap-based buffer overflow vulnerability exists in the Palette box parser functionality of Accusoft ImageGear 19.10. A specially-crafted file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.


A heap-based buffer overflow vulnerability exists in the XWD parser functionality of Accusoft ImageGear 19.10. A specially-crafted file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.


A heap-based buffer overflow vulnerability exists in the DecoderStream::Append functionality of Accusoft ImageGear 19.10. A specially-crafted file can lead to code execution. An attacker can provide a malicious file to trigger this vulnerability.


A heap-based buffer overflow in Fortinet FortiWeb version 6.4.1 and 6.4.0 version 6.3.15 and below version 6.2.6 and below allows attacker to execute unauthorized code or commands via crafted HTTP requests to the LogReport API controller.


Multiple heap-based buffer overflows in Sound eXchange (SoX) 14.4.1 and earlier allow remote attackers to have unspecified impact via a crafted WAV file to the (1) start_read or (2) AdpcmReadBlock function.


Multiple heap-based buffer overflows in RealNetworks RealPlayer 11.0 through 11.1 RealPlayer SP 1.0 through 1.1.5 and Linux RealPlayer 11.0.2.1744 allow remote attackers to have an unspecified impact via a crafted header in an IVR file.


A heap-based buffer overflow exists in the third-party product Gigasoft v5 and prior included in GE Communicator 3.15 and prior. A malicious HTML file that loads the ActiveX controls can trigger the vulnerability via unchecked function calls.


Multiple heap-based buffer overflows in the read_attribute function in GnuTLS before 3.3.26 and 3.5.x before 3.5.8 allow remote attackers to have unspecified impact via a crafted OpenPGP certificate.


Multiple heap-based buffer overflows in the (1) str_repeat and (2) wordwrap functions in ext/standard/string.c in PHP before 5.1.5 when used on a 64-bit system have unspecified impact and attack vectors a different vulnerability than CVE-2006-1990.


A heap-based buffer overflow exists in stbi__bmp_load_cont in stb_image.h in catimg 2.4.0.


A heap-based buffer overflow exists in nph-viewgif.cgi in the 2.0.7 through 2.2.26 legacy versions of the NCBI ToolBox.


A heap-based buffer overflow in the awarrensmtp component of Sophos XG Firewall v17.5 MR11 and older potentially allows an attacker to run arbitrary code remotely.


Multiple heap-based buffer overflows in the urftopdf filter in cups-filters 1.0.25 before 1.0.47 allow remote attackers to execute arbitrary code via a large (1) page or (2) line in a URF file.

buffer overflow
arbitrary code execution


Multiple heap-based buffer overflows in OpenJPEG 1.3 and earlier might allow remote attackers to execute arbitrary code via unspecified vectors.


A heap-based buffer overflow was found in openjpeg in color.c:379:42 in sycc420_to_rgb when decompressing a crafted .j2k file. An attacker could use this to execute arbitrary code with the permissions of the application compiled against openjpeg.


A heap-based buffer overflow in Delta Electronics TPEditor: v1.98.06 and prior may be exploited by processing a specially crafted project file. Successful exploitation of this vulnerability may allow an attacker to execute arbitrary code.


Multiple heap-based buffer overflow vulnerabilities in some web API controllers of FortiWeb 6.4.1 6.4.0 and 6.3.0 through 6.3.15 may allow a remote authenticated attacker to execute arbitrary code or commands via specifically crafted HTTP requests.


A heap-based buffer overflow could occur while parsing PICT PCX RCL or TIFF files in Autodesk Design Review 2018 2017 2013 2012 2011. This vulnerability can be exploited to execute arbitrary code.


Multiple heap-based buffer overflows in EMC RepliStor 6.2 SP2 and possibly earlier versions allow remote attackers to execute arbitrary code via crafted compressed data.


Multiple heap-based buffer overflows in Adobe Reader and Acrobat 10.x before 10.1.14 and 11.x before 11.0.11 on Windows and OS X allow attackers to execute arbitrary code via unknown vectors.


Multiple heap-based buffer overflows in the navigator.getGamepads function in the Gamepad API in Mozilla Firefox before 30.0 allow remote attackers to execute arbitrary code by using non-contiguous axes with a (1) physical or (2) virtual Gamepad device.


Multiple heap-based buffer overflows in imlib2 1.4.3 allow context-dependent attackers to execute arbitrary code via a crafted (1) ARGB (2) XPM or (3) BMP file related to the IMAGE_DIMENSIONS_OK macro in lib/image.h.


Multiple heap-based buffer overflows in vp6.w5s (aka the VP6 codec) in Winamp before 5.59 Beta build 3033 might allow remote attackers to execute arbitrary code via a crafted VP6 (1) video file or (2) video stream.


Multiple heap-based buffer overflows in Adobe Reader and Acrobat 7.x before 7.1.4 8.x before 8.1.7 and 9.x before 9.2 might allow attackers to execute arbitrary code via unspecified vectors.


Multiple heap-based buffer overflows in ovlogin.exe in HP OpenView Network Node Manager (OV NNM) 7.01 7.51 and 7.53 allow remote attackers to execute arbitrary code via a long (1) userid or (2) passwd parameter.


Multiple heap-based buffer overflows in ovsessionmgr.exe in HP OpenView Network Node Manager (OV NNM) 7.01 7.51 and 7.53 allow remote attackers to execute arbitrary code via a long (1) userid or (2) passwd parameter to ovlogin.exe.


Multiple heap-based buffer overflows in WsMp3 daemon (WsMp3d) 0.0.10 and earlier allow remote attackers to execute arbitrary code via long HTTP requests.


Multiple heap-based buffer overflows in the imlib BMP image handler allow remote attackers to execute arbitrary code via a crafted BMP file.


Multiple heap-based buffer overflows in 3S-Smart CODESYS Gateway Server before 2.3.9.47 allow remote attackers to execute arbitrary code via opcode (1) 0x3ef or (2) 0x3f0.


Multiple heap-based buffer overflows in libeffects in the Audio Policy Service in mediaserver in Android before 5.1.1 LMY48I allow attackers to execute arbitrary code via a crafted application aka internal bug 21953516.


Multiple heap-based buffer overflows in Audacious AdPlug 2.0 and earlier allow remote user-assisted attackers to execute arbitrary code via the size specified in the package header of (1) CFF (2) MTK (3) DMO and (4) U6M files.


Multiple heap-based buffer overflows in AOL Nullsoft WinAmp before 5.31 allow user-assisted remote attackers to execute arbitrary code via a crafted (1) ultravox-max-msg header to the Ultravox protocol handler or (2) unspecified Lyrics3 tags.


A heap-based buffer overflow in PotPlayerMini.exe in PotPlayer 1.7.8556 allows remote attackers to execute arbitrary code via a .wav file with large BytesPerSec and SamplesPerSec values and a small Data_Chunk_Size value.


Multiple heap-based buffer overflows in the (1) CBookBase::SetDefTableStyle and (2) CBookBase::SetDefPivotStyle functions in Hancom Office 2014 VP allow remote attackers to execute arbitrary code via a crafted Hangul Hcell Document (.cell) file.


Multiple heap-based buffer overflows in Advantech WebAccess before 8.1 allow remote attackers to execute arbitrary code via unspecified vectors.


Multiple heap-based buffer overflows in 3Com 3CServer allow remote authenticated users to execute arbitrary code via long FTP commands as demonstrated using the STAT command.


Multiple heap-based buffer overflows in Adobe Flash CS3 Professional on Windows and Flash MX 2004 allow remote attackers to execute arbitrary code via an SWF file containing long control parameters.


A heap-based Buffer Overflow vulnerability exists in gaussian_blur at libavfilter/vf_edgedetect.c which might lead to memory corruption and other potential consequences.


A heap-based Buffer Overflow vulnerability exists in FFmpeg 4.2 at libavfilter/vf_colorconstancy.c: in slice_get_derivative which crossfade_samples_fltp which might lead to memory corruption and other potential consequences.


A heap-based Buffer Overflow vulnerability exists in FFmpeg 4.2 in get_block_row at libavfilter/vf_bm3d.c which might lead to memory corruption and other potential consequences.


A heap-based Buffer Overflow vulnerability exists in FFmpeg 4.2 at libavfilter/af_afade.c in crossfade_samples_fltp which might lead to memory corruption and other potential consequences.


A heap-based Buffer Overflow vulnerability exists FFmpeg 4.2 at libavfilter/vf_floodfill.c which might lead to memory corruption and other potential consequences.


A heap-based Buffer Overflow vulnerability exists FFmpeg 4.2 at libavfilter/vf_edgedetect.c in gaussian_blur which might lead to memory corruption and other potential consequences.


A heap-based Buffer Overflow vulnerability exists in FFmpeg 4.2 in filter_intra at libavfilter/vf_bwdif.c which might lead to memory corruption and other potential consequences.


A heap-based Buffer Overflow vulnerability exists in FFmpeg 4.2 in filter_frame at libavfilter/vf_fieldorder.c which might lead to memory corruption and other potential consequences.


A heap-based Buffer Overflow vulnerability exists in FFmpeg 4.2 at ff_fill_rectangle in libavfilter/drawutils.c which might lead to memory corruption and other potential consequences.


A heap-based Buffer Overflow vulnerabililty exists in FFmpeg 4.2 in filter_frame at libavfilter/vf_bitplanenoise.c which might lead to memory corruption and other potential consequences.


A heap-based Buffer Overflow vulnerability exits in FFmpeg 4.2 in deflate16 at libavfilter/vf_neighbor.c which might lead to memory corruption and other potential consequences.


A heap-based Buffer Overflow vulnerability in FFmpeg 4.2 at libavcodec/get_bits.h when writing .mov files which might lead to memory corruption and other potential consequences.


A heap-based buffer over-read occurs in AP4_BitStream::WriteBytes in Codecs/Ap4BitStream.cpp in Bento4 v1.5.1-627. Remote attackers could leverage this vulnerability to cause an exception via crafted mp4 input which leads to a denial of service.


A heap-based buffer over-read was found in the function decompileCALLFUNCTION in util/decompile.c in Ming 0.4.8 which allows attackers to cause a denial of service via a crafted file.


A heap-based buffer over-read was found in the function OpCode (called from decompileINCR_DECR line 1474) in util/decompile.c in Ming 0.4.8 which allows attackers to cause a denial of service via a crafted file.


A heap-based buffer over-read was found in the function OpCode (called from decompileSETMEMBER) in util/decompile.c in Ming 0.4.8 which allows attackers to cause a denial of service via a crafted file.


A heap-based buffer over-read was found in the function decompileIF in util/decompile.c in Ming 0.4.8 which allows attackers to cause a denial of service via a crafted file.


A heap-based buffer over-read was found in the function OpCode (called from decompileINCR_DECR line 1440) in util/decompile.c in Ming 0.4.8 which allows attackers to cause a denial of service via a crafted file.


A heap-based buffer over-read in SampleImage() in MagickCore/resize.c in ImageMagick 7.0.6-8 Q16 allows remote attackers to cause a denial of service via a crafted file.


A heap-based buffer over-read was discovered in AP4_BitStream::ReadBytes in Codecs/Ap4BitStream.cpp in Bento4 version 1.5.0-617. The vulnerability causes an application crash which leads to remote denial of service.


A heap-based buffer over-read was discovered in the tcpreplay-edit binary of Tcpreplay 4.3.0 beta1 during the incremental checksum operation. The issue gets triggered in the function csum_replace4() in incremental_checksum.h causing a denial of service.


A heap-based buffer over-read in H5O_attr_decode() in H5Oattr.c in the HDF HDF5 through 1.10.3 library allows attackers to cause a denial of service via a crafted HDF5 file. This issue was triggered while converting an HDF file to GIF file.


A heap-based buffer overflow in the vrend_renderer_transfer_write_iov function in vrend_renderer.c in virglrenderer through 0.8.0 allows guest OS users to cause a denial of service via VIRGL_CCMD_RESOURCE_INLINE_WRITE commands.


A heap-based buffer overflow vulnerability exists in HDF5 1.13.1-1 via H5F_addr_decode_len in /hdf5/src/H5Fint.c which could cause a Denial of Service.


A heap-based buffer overflow exists in Info-Zip UnZip version <= 6.00 in the processing of password-protected archives that allows an attacker to perform a denial of service or to possibly achieve code execution.


A heap-based buffer overflow in ReadGifImageDesc() in gifread.c in the HDF HDF5 through 1.10.3 library allows attackers to cause a denial of service via a crafted HDF5 file. This issue was triggered while converting a GIF file to an HDF file.


A heap-based Buffer Overflow Vulnerability exists FFmpeg 4.2 at libavfilter/vf_vmafmotion.c in convolution_y_8bit which could let a remote malicious user cause a Denial of Service.


A

heap-based

buffer

overflow

vulnerability

exists

in

LibreDWG

via

the

function

at

libredwg-0.10.1/src/decode_r2007.c:666:5

which

causes

a

denial

of

service

by

submitting

a

dwg

file.


A heap-based buffer overflow vulnerability exists in Academy Software Foundation OpenEXR 2.3.0 in chunkOffsetReconstruction in ImfMultiPartInputFile.cpp that can cause a denial of service via a crafted EXR file.


A heap-based buffer overflow vulnerability exists in GPAC v1.0.1 in the gf_isom_dovi_config_get function in MP4Box which causes a denial of service or execute arbitrary code via a crafted file.

denial of service
buffer overflow
arbitrary code execution


Multiple heap-based buffer overflows in OpenOffice.org before 2.4 allow remote attackers to cause a denial of service (crash) and possibly execute arbitrary code via a Quattro Pro (QPRO) file with crafted (1) Attribute and (2) Font Description records.


Multiple heap-based buffer overflows in Aircrack-ng before 1.1 allow remote attackers to cause a denial of service (crash) and execute arbitrary code via a (1) large length value in an EAPOL packet or (2) long EAPOL packet.


Multiple heap-based buffer overflows in Media Commands 1.0 allow remote attackers to execute arbitrary code or cause a denial of service (application crash) via a long string in a (1) M3U (2) M3l (3) TXT and (4) LRC playlist file.


Multiple heap-based buffer overflows in imlib 1.9.14 and earlier which is used by gkrellm and several window managers allow remote attackers to cause a denial of service (application crash) and execute arbitrary code via certain image files.


Multiple heap-based buffer overflows in VideoLAN VLC media player before 2.0.1 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted Real RTSP stream.


A heap-based buffer overflow in the Treck HTTP Server component before 6.0.1.68 allows remote attackers to cause a denial of service (crash/reset) or to possibly execute arbitrary code.


Multiple heap-based buffer overflows in cdg.c in the CDG decoder in VideoLAN VLC Media Player before 1.1.6 allow remote attackers to cause a denial of service (application crash) or possibly execute arbitrary code via a crafted CDG video.


A heap-based buffer overflow exists in the AP4_StdcFileByteStream::ReadPartial component located in /StdC/Ap4StdCFileByteStream.cpp of Bento4 version 06c39d9. This issue can lead to a denial of service (DOS).


A heap-based buffer overflow vulnerability in the function ok_jpg_decode_block_subsequent_scan() ok_jpg.c:1102 of ok-file-formats through 2020-06-26 allows attackers to cause a Denial of Service (DOS) via a crafted jpeg file.


A heap-based buffer overflow vulnerability in the function ok_jpg_decode_block_progressive() at ok_jpg.c:1054 of ok-file-formats through 2020-06-26 allows attackers to cause a Denial of Service (DOS) via a crafted jpeg file.


A heap-based buffer overflow exists in the AP4_CttsAtom::AP4_CttsAtom component located in /Core/Ap4Utils.h of Bento4 version 06c39d9. This can lead to a denial of service (DOS).


A heap-based buffer overflow in the sixel_encoder_output_without_macro function in encoder.c of Libsixel 1.8.4 allows attackers to cause a denial of service (DOS) via converting a crafted PNG file into Sixel format.


Multiple heap-based buffer overflows in etxrw.dll in Kingsoft Spreadsheets 2012 8.1.0.3030 allow remote attackers to cause a denial of service (memory corruption and crash) or possibly execute arbitrary code via a crafted spreadsheet file.

denial of service
buffer overflow
memory corruption
arbitrary code execution


Multiple heap-based buffer overflows in EMC RepliStor 6.2 before SP5 and 6.3 before SP2 allow remote attackers to execute arbitrary code via a crafted message to (1) ctrlservice.exe or (2) rep_srv.exe possibly related to an integer overflow.

integer overflow
buffer overflow
arbitrary code execution


Vulnerability

in

the

Sun

ZFS

Storage

Appliance

Kit

(AK)

component

of

Oracle

Sun

Systems

Products

Suite

(subcomponent:

Object

Store).

The

supported

version

that

is

affected

is

prior

to

Difficult

to

exploit

vulnerability

allows

high

privileged

attacker

with

logon

to

the

infrastructure

where

Sun

ZFS

Storage

Appliance

Kit

(AK)

executes

to

compromise

Sun

ZFS

Storage

Appliance

Kit

(AK).

Successful

attacks

of

this

vulnerability

can

result

in

takeover

of

Sun

ZFS

Storage

Appliance

Kit

(AK).

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H).


Vulnerability

in

the

Oracle

VM

VirtualBox

component

of

Oracle

Virtualization

(subcomponent:

Core).

Supported

versions

that

are

affected

are

Prior

to

and

prior

to

Difficult

to

exploit

vulnerability

allows

high

privileged

attacker

with

logon

to

the

infrastructure

where

Oracle

VM

VirtualBox

executes

to

compromise

Oracle

VM

VirtualBox.

While

the

vulnerability

is

in

Oracle

VM

VirtualBox

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

takeover

of

Oracle

VM

VirtualBox.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H).


Vulnerability

in

the

Portable

Clusterware

component

of

Oracle

Database

Server.

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

high

privileged

attacker

having

Grid

Infrastructure

User

privilege

with

logon

to

the

infrastructure

where

Portable

Clusterware

executes

to

compromise

Portable

Clusterware.

While

the

vulnerability

is

in

Portable

Clusterware

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

takeover

of

Portable

Clusterware.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H).


Vulnerability

in

the

Core

RDBMS

component

of

Oracle

Database

Server.

Supported

versions

that

are

affected

are

and

Difficult

to

exploit

vulnerability

allows

high

privileged

attacker

having

Local

Logon

privilege

with

logon

to

the

infrastructure

where

Core

RDBMS

executes

to

compromise

Core

RDBMS.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

access

to

critical

data

or

complete

access

to

all

Core

RDBMS

accessible

data.

CVSS

Base

Score

(Confidentiality

impacts).

CVSS

Vector:

(CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:N/A:N).


Vulnerability

in

the

Portable

Clusterware

component

of

Oracle

Database

Server.

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

high

privileged

attacker

having

Grid

Infrastructure

User

privilege

with

logon

to

the

infrastructure

where

Portable

Clusterware

executes

to

compromise

Portable

Clusterware.

While

the

vulnerability

is

in

Portable

Clusterware

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

takeover

of

Portable

Clusterware.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

MySQL

Connectors

component

of

Oracle

MySQL

(subcomponent:

Connector/J).

Supported

versions

that

are

affected

are

and

prior.

Difficult

to

exploit

vulnerability

allows

high

privileged

attacker

with

logon

to

the

infrastructure

where

MySQL

Connectors

executes

to

compromise

MySQL

Connectors.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker.

Successful

attacks

of

this

vulnerability

can

result

in

takeover

of

MySQL

Connectors.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H).


Vulnerability

in

the

Oracle

VM

VirtualBox

component

of

Oracle

Virtualization

(subcomponent:

Core).

Supported

versions

that

are

affected

are

Prior

to

and

prior

to

Difficult

to

exploit

vulnerability

allows

high

privileged

attacker

with

logon

to

the

infrastructure

where

Oracle

VM

VirtualBox

executes

to

compromise

Oracle

VM

VirtualBox.

While

the

vulnerability

is

in

Oracle

VM

VirtualBox

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

takeover

of

Oracle

VM

VirtualBox.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

VM

VirtualBox

product

of

Oracle

Virtualization

(component:

Core).

Supported

versions

that

are

affected

are

Prior

to

and

prior

to

Easily

exploitable

vulnerability

allows

high

privileged

attacker

with

logon

to

the

infrastructure

where

Oracle

VM

VirtualBox

executes

to

compromise

Oracle

VM

VirtualBox.

While

the

vulnerability

is

in

Oracle

VM

VirtualBox

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

takeover

of

Oracle

VM

VirtualBox.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

MySQL

Server

component

of

Oracle

MySQL

(subcomponent:

Server:

Options).

Supported

versions

that

are

affected

are

and

prior.

Easily

exploitable

vulnerability

allows

high

privileged

attacker

with

network

access

via

multiple

protocols

to

compromise

MySQL

Server.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

hang

or

frequently

repeatable

crash

(complete

DOS)

of

MySQL

Server.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).


Vulnerability

in

the

MySQL

Server

component

of

Oracle

MySQL

(subcomponent:

Server:

Group

Replication

Plugin).

Supported

versions

that

are

affected

are

and

prior.

Difficult

to

exploit

vulnerability

allows

high

privileged

attacker

with

network

access

via

MySQL

Procotol

to

compromise

MySQL

Server.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

hang

or

frequently

repeatable

crash

(complete

DOS)

of

MySQL

Server.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:N/A:H).


Vulnerability

in

the

MySQL

Server

component

of

Oracle

MySQL

(subcomponent:

Server:

Optimizer).

Supported

versions

that

are

affected

are

and

prior.

Easily

exploitable

vulnerability

allows

high

privileged

attacker

with

network

access

via

multiple

protocols

to

compromise

MySQL

Server.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

ability

to

cause

a

hang

or

frequently

repeatable

crash

(complete

DOS)

of

MySQL

Server.

CVSS

Base

Score

(Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Oracle

WebLogic

Server

component

of

Oracle

Fusion

Middleware

(subcomponent:

WLS

Core

Components).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

high

privileged

attacker

with

network

access

via

HTTP

to

compromise

Oracle

WebLogic

Server.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

access

to

critical

data

or

complete

access

to

all

Oracle

WebLogic

Server

accessible

data

as

well

as

unauthorized

update

insert

or

delete

access

to

some

of

Oracle

WebLogic

Server

accessible

data.

CVSS

Base

Score

(Confidentiality

and

Integrity

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N).


Vulnerability

in

the

Core

RDBMS

component

of

Oracle

Database

Server.

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

high

privileged

attacker

having

Create

Session

Execute

Catalog

Role

privilege

with

network

access

via

Oracle

Net

to

compromise

Core

RDBMS.

Successful

attacks

of

this

vulnerability

can

result

in

takeover

of

Core

RDBMS.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H).


Vulnerability

in

the

PeopleSoft

Enterprise

PeopleTools

component

of

Oracle

PeopleSoft

Products

(subcomponent:

XML

Publisher).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

high

privileged

attacker

with

network

access

via

HTTP

to

compromise

PeopleSoft

Enterprise

PeopleTools.

Successful

attacks

of

this

vulnerability

can

result

in

takeover

of

PeopleSoft

Enterprise

PeopleTools.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:


Vulnerability

in

the

Core

RDBMS

component

of

Oracle

Database

Server.

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

high

privileged

attacker

having

Create

Any

Index

privilege

with

network

access

via

OracleNet

to

compromise

Core

RDBMS.

While

the

vulnerability

is

in

Core

RDBMS

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

access

to

critical

data

or

complete

access

to

all

Core

RDBMS

accessible

data

as

well

as

unauthorized

update

insert

or

delete

access

to

some

of

Core

RDBMS

accessible

data.

CVSS

Base

Score

(Confidentiality

and

Integrity

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:L/A:N).


Vulnerability

in

the

Hyperion

Data

Relationship

Management

product

of

Oracle

Hyperion

(component:

Access

and

Security).

The

supported

version

that

is

affected

is

Difficult

to

exploit

vulnerability

allows

high

privileged

attacker

with

network

access

via

HTTP

to

compromise

Hyperion

Data

Relationship

Management.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker.

Successful

attacks

of

this

vulnerability

can

result

in

takeover

of

Hyperion

Data

Relationship

Management.

CVSS

Base

Score

(Confidentiality

Integrity

and

Availability

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H).


Vulnerability

in

the

Hyperion

Financial

Reporting

product

of

Oracle

Hyperion

(component:

Security

Models).

The

supported

version

that

is

affected

is

Difficult

to

exploit

vulnerability

allows

high

privileged

attacker

with

network

access

via

HTTP

to

compromise

Hyperion

Financial

Reporting.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

creation

deletion

or

modification

access

to

critical

data

or

all

Hyperion

Financial

Reporting

accessible

data.

CVSS

Base

Score

(Integrity

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:U/C:N/I:H/A:N).


Vulnerability

in

the

Oracle

Hyperion

Workspace

component

of

Oracle

Hyperion

(subcomponent:

UI

and

Visualization).

The

supported

version

that

is

affected

is

Easily

exploitable

vulnerability

allows

high

privileged

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Hyperion

Workspace.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

read

access

to

a

subset

of

Oracle

Hyperion

Workspace

accessible

data.

CVSS

Base

Score

(Confidentiality

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N).


Vulnerability

in

the

Oracle

Applications

Manager

component

of

Oracle

E-Business

Suite

(subcomponent:

Oracle

Diagnostics

Interfaces).

Supported

versions

that

are

affected

are

and

Easily

exploitable

vulnerability

allows

high

privileged

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Applications

Manager.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

creation

deletion

or

modification

access

to

critical

data

or

all

Oracle

Applications

Manager

accessible

data

as

well

as

unauthorized

access

to

critical

data

or

complete

access

to

all

Oracle

Applications

Manager

accessible

data.

CVSS

Base

Score

(Confidentiality

and

Integrity

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N).


Vulnerability

in

the

Hyperion

Profitability

and

Cost

Management

product

of

Oracle

Hyperion

(component:

Modeling).

The

supported

version

that

is

affected

is

Difficult

to

exploit

vulnerability

allows

high

privileged

attacker

with

network

access

via

HTTP

to

compromise

Hyperion

Profitability

and

Cost

Management.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker

and

while

the

vulnerability

is

in

Hyperion

Profitability

and

Cost

Management

attacks

may

significantly

impact

additional

products.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

Hyperion

Profitability

and

Cost

Management

accessible

data

as

well

as

unauthorized

read

access

to

a

subset

of

Hyperion

Profitability

and

Cost

Management

accessible

data.

CVSS

Base

Score

(Confidentiality

and

Integrity

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:H/PR:H/UI:R/S:C/C:L/I:L/A:N).


Vulnerability

in

the

MySQL

Server

component

of

Oracle

MySQL

(subcomponent:

InnoDB).

Supported

versions

that

are

affected

are

and

prior.

Difficult

to

exploit

vulnerability

allows

high

privileged

attacker

with

network

access

via

multiple

protocols

to

compromise

MySQL

Server.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

update

insert

or

delete

access

to

some

of

MySQL

Server

accessible

data.

CVSS

Base

Score

(Integrity

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:H/PR:H/UI:N/S:U/C:N/I:L/A:N).


Vulnerability

in

the

Oracle

Hyperion

Planning

component

of

Oracle

Hyperion

(subcomponent:

Smart

View).

The

supported

version

that

is

affected

is

Easily

exploitable

vulnerability

allows

high

privileged

attacker

with

network

access

via

HTTP

to

compromise

Oracle

Hyperion

Planning.

Successful

attacks

require

human

interaction

from

a

person

other

than

the

attacker.

Successful

attacks

of

this

vulnerability

can

result

in

unauthorized

access

to

critical

data

or

complete

access

to

all

Oracle

Hyperion

Planning

accessible

data.

CVSS

Base

Score

(Confidentiality

impacts).

CVSS

Vector:

(CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:N/A:N).