CWE:
 

Topic
Date
Author
High
Claymore Dual GPU Miner 10.5 Format String
03.02.2018
res1n
Med.
nsd Format String
18.12.2017
bashis
Low
OpenSSH 6.8 Insecure Functions
04.04.2015
Nicholas Lemonias
Med.
War FTP Daemon Format String DoS (LIST command)
01.04.2014
corelanc0d3r
High
Tftpd32 Client Side Format String
04.12.2013
Fara Rustein
High
Flightgear 2.0 / 2.4 Format String
09.05.2013
Kurono
High
Polycom H.323 Format String
16.03.2013
Moritz Jodeit
High
VMWare OVF Tools Format String
07.02.2013
Juan vazquez
High
EMC NetWorker Format String
01.09.2012
Aaron Portnoy
High
XM Easy Personal FTP Server 5.30 Format String
15.06.2012
mr_me
High
ComSndFTP 1.3.7 Beta Format String Overflow
09.06.2012
Dark2S Security Team/H...
High
sudo 1.8.3p1 Format String
31.01.2012
Phenoelit Group
High
7T Interactive Graphical SCADA System Multiple Security Vulnerabilities
07.04.2011
Luigi Auriemma
High
rpc.pcnfsd Remote Format String Exploit
21.07.2010
Rodrigo Rubira Branco
High
HP OpenView Network Node Manager Arbitrary Code
24.05.2010
HP
Low
Ipswitch WS_FTP 12 Professional Remote Format String
23.04.2010
AKA
High
aria2 upstream 1.6.1 remote Denial of Service
22.10.2009
Jan Lieskovsky
Med.
VMware Authorization Service <= 2.5.3 (vmware-authd.exe) Format String DoS
16.10.2009
shinnai
Med.
Regular Expression Denial of Service
23.09.2009
Alex Roichman
High
i.Scribe SMTP Client <= 2.00b (wscanf) Remote Format String PoC
27.08.2009
grTs;SiD.psycho
High
Vietcong 2 Format String
25.08.2009
null
Med.
MySQL <= 5.0.45 post auth format string vulnerability
10.07.2009
Kingcope
High
Format String Vulnerability: FortiClient Version 3
11.04.2009
dh layereddefense com
High
Wireshark <= 1.0.6 PN-DCP Format String Exploit PoC
03.04.2009
THCX
Med.
GeoVision LiveAudio ActiveX Control GetAudioPlayingTime() remote freed-memory access
28.03.2009
trotzkista
High
Xitami Web Server v2.5c2 LRWP Processing Format String PoC
26.03.2009
bratax
High
BMC PatrolAgent Version Logging Format String Vulnerability
31.01.2009
Anonymous
High
WS_FTP Home/Professional FTP Client Remote Format String PoC
22.08.2008
securfrog
High
Format string vulnerability in 5th street
12.07.2008
Nam Nguyen


CVEMAP Search Results

CVE
Details
Description
2018-09-22
Medium
CVE-2018-17336

Vendor: Freedesktop
Software: Udisks
 

 
UDisks 2.8.0 has a format string vulnerability in udisks_log in udiskslogging.c, allowing attackers to obtain sensitive information (stack contents), cause a denial of service (memory corruption), or possibly have unspecified other impact via a malformed filesystem label, as demonstrated by %d or %n substrings.

 
2018-09-06
Low
CVE-2018-15749

Vendor: Pulsesecure
Software: Pulse secure...
 

 
The Pulse Secure Desktop (macOS) 5.3RX before 5.3R5 and 9.0R1 has a Format String Vulnerability.

 
2018-07-27
Low
CVE-2017-7519

Vendor: CEPH
Software: CEPH
 

 
In Ceph, a format string flaw was found in the way libradosstriper parses input from user. A user could crash an application or service using the libradosstriper library.

 
2018-07-10
Medium
CVE-2018-1566

Vendor: IBM
Software: DB2
 

 
IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 could allow a local user to execute arbitrary code due to a format string error. IBM X-Force ID: 143023.

 
2018-06-20
High
CVE-2018-12590

Vendor: UBNT
Software: Edgeswitch f...
 

 
Ubiquiti Networks EdgeSwitch version 1.7.3 and prior suffer from an externally controlled format-string vulnerability due to lack of protection on the admin CLI, leading to code execution and privilege escalation greater than administrators themselves are allowed. An attacker with access to an admin account could escape the restricted CLI and execute arbitrary code.

 
2018-05-31
Medium
CVE-2015-9238

Updating...
 

 
secure-compare 3.0.0 and below do not actually compare two strings properly. compare was actually comparing the first argument with itself, meaning the check passed for any two strings of the same length.

 
2018-03-28
High
CVE-2018-0175

Vendor: Cisco
Software: IOS
 

 
Format String vulnerability in the Link Layer Discovery Protocol (LLDP) subsystem of Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software could allow an unauthenticated, adjacent attacker to cause a denial of service (DoS) condition or execute arbitrary code with elevated privileges on an affected device. Cisco Bug IDs: CSCvd73664.

 
2018-03-16
Medium
CVE-2018-7544

Vendor: Openvpn
Software: Openvpn
 

 
** DISPUTED ** A cross-protocol scripting issue was discovered in the management interface in OpenVPN through 2.4.5. When this interface is enabled over TCP without a password, and when no other clients are connected to this interface, attackers can execute arbitrary management commands, obtain sensitive information, or cause a denial of service (SIGTERM) by triggering XMLHttpRequest actions in a web browser. This is demonstrated by a multipart/form-data POST to http://localhost:23000 with a "signal SIGTERM" command in a TEXTAREA element. NOTE: The vendor disputes that this is a vulnerability. They state that this is the result of improper configuration of the OpenVPN instance rather than an intrinsic vulnerability, and now more explicitly warn against such configurations in both the management-interface documentation, and with a runtime warning.

 
2018-03-05
Low
CVE-2017-17132

Vendor: Huawei
Software: Vp9660 firmware
 

 
Huawei VP9660 V500R002C10 has a uncontrolled format string vulnerability when the license module output the log information. An authenticated local attacker could exploit this vulnerability to cause a denial of service.

 
2018-02-09
Medium
CVE-2018-6508

Vendor: Puppet
Software: Puppet
 

 
Puppet Enterprise 2017.3.x prior to 2017.3.3 are vulnerable to a remote execution bug when a specially crafted string was passed into the facter_task or puppet_conf tasks. This vulnerability only affects tasks in the affected modules, if you are not using puppet tasks you are not affected by this vulnerability.

 

 


Copyright 2018, cxsecurity.com

 

Back to Top