The web server in Integard Pro and Home before 2.0.0.9037 and 2.2.x before 2.2.0.9037 has a buffer overflow via a long password in an administration login POST request, leading to arbitrary code execution. An SEH-overwrite buffer overflow already existed for the vulnerable software. This CVE is to track an alternate exploitation method, utilizing an EIP-overwrite buffer overflow.

kernel: out of bounds array access in drivers/net/mlx4/port.c

In the Linux kernel before 2.6.37, an out of bounds array access happened in drivers/net/mlx4/port.c. When searching for a free entry in either mlx4_register_vlan() or mlx4_register_mac(), and there is no free entry, the loop terminates without updating the local variable free thus causing out of array bounds access.

kernel: range check issue in drivers/gpu/drm/radeon/atombios.c leads to buffer overflow

In the Linux kernel before 2.6.34, a range check issue in drivers/gpu/drm/radeon/atombios.c could cause an off by one (buffer overflow) problem. NOTE: At least one Linux maintainer believes that this CVE is incorrectly assigned and should be rejected because the value is hard coded and are not user-controllable where it is used

realvnc: Null pointer dereference flaw in ClientCutText message handling

A NULL pointer dereference flaw was found in the way LibVNCServer before 0.9.9 handled certain ClientCutText message. A remote attacker could use this flaw to crash the VNC server by sending a specially crafted ClientCutText message from a VNC client.

Trac 0.11.6 does not properly check workflow permissions before modifying a ticket. This can be exploited by an attacker to change the status and resolution of tickets without having proper permissions.

pithos before 0.3.5 allows overwrite of arbitrary files via symlinks.

It was found in FreeBSD 8.0, 6.3 and 4.9, and OpenBSD 4.6 that a null pointer dereference in ftpd/popen.c may lead to remote denial of service of the ftpd service.

Coppermine gallery before 1.4.26 has an input validation vulnerability that allows for code execution.

ConsoleKit: Policy restrictions break-out via remote Virtual Network Computing (VNC) session

In ConsoleKit before 0.4.2, an intended security policy restriction bypass was found. This flaw allows an authenticated system user to escalate their privileges by initiating a remote VNC session.

PmWiki before 2.2.21 has XSS.

udisks: arbitrary Linux kernel loading flaw

udisks before 1.0.3 allows a local user to load arbitrary Linux kernel modules.

Unspecified vulnerability in statusnet through 2010 due to the way addslashes are used in SQL string escapes..

Cross-site scripting (XSS) vulnerability in statusnet through 2010 in error message contents.

statusnet through 2010 allows attackers to spoof syslog messages via newline injection attacks.

php: XMLWriter information leak

PHP5 before 5.4.4 allows passing invalid utf-8 strings via the xmlTextWriterWriteAttribute, which are then misparsed by libxml2. This results in memory leak into the resulting output.

xpdf: corruption of the Gfx contexts states stack

poppler before 0.16.3 has malformed commands that may cause corruption of the internal stack.

xpdf: integer overflow in CharCodeToUnicode::addMapping

An integer overflow condition in poppler before 0.16.3 can occur when parsing CharCodes for fonts.

offlineimap before 6.3.4 added support for SSL server certificate validation but it is still possible to use SSL v2 protocol, which is a flawed protocol with multiple security deficiencies.

offlineimap before 6.3.2 does not check for SSL server certificate validation when "ssl = yes" option is specified which can allow man-in-the-middle attacks.

It was found in vanilla forums before 2.0.10 a potential linkbait vulnerability in dispatcher.