Horde Groupware PHP File Inclusion (CVE-2020-8866)

A file inclusion vulnerability exists in Horde Groupware. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

mIRC URI Handler Remote Code Execution (CVE-2019-6453)

A remote code execution vulnerability exists in mIRC. The vulnerability is due to improper sanitization of user-supplied data which may be passed to the application as an option. Successful exploitation could result in code execution on the target machine in the context of the application...

OMRON CX-One CX-Protocol Trace Type Confusion (CVE-2018-19027)

A type confusion vulnerability exists in OMRON CX-One CX-Protocol. This vulnerability occurs due to improper parsing of the project file...

Oracle Application Testing Suite DownloadServlet Directory Traversal (CVE-2019-2557)

A directory traversal vulnerability exists in Oracle Application Testing Suite. A remote authenticated attacker can exploit this vulnerability by sending a malicious request to the vulnerable server. Successful exploitation results in arbitrary file download from the target server...

Network Weathermap Persistent Cross-Site Scripting (CVE-2013-2618)

A cross-site scripting vulnerability has been reported in Network Weathermap. Successful exploitation of this vulnerability would allow remote attackers to inject arbitrary web script into the affected system...

Schneider Electric U.motion Builder nfcserver.php SQL Injection (CVE-2017-7973)

An SQL injection vulnerability exists in Schneider Electric U.motion Builder. The vulnerability is due to insufficient validation of the sessionid HTTP request parameter in requests made to nfcserver.php.A remote, unauthenticated user can exploit this vulnerability by sending a crafted HTTP reque...

Oracle Java SE MixerSequencer Object GM_Song Remote Code Execution (CVE-2010-0842)

A remote code execution vulnerability exists in Oracle Java SE 6u18 and prior. The vulnerability is caused by running specially crafted MIDI file within an RMF File. A remote attacker can exploit this issue by enticing a user to open a specially crafted file...

VIPA Controls WinPLC7 recv Stack-based Buffer Overflow (CVE-2017-5177)

A stack-based buffer overflow exists in VIPA Controls WinPLC7. The vulnerability is due to improper validation of a length field within received TCP packet data before copying the contents to a stack-based buffer. A remote attacker could exploit this vulnerability by sending maliciously crafted...

Microsoft Edge Scripting Engine Memory Corruption (MS16-129: CVE-2016-7202)

A buffer overrun vulnerability exists in Microsoft Edge and Microsoft Internet Explorer. The vulnerability is due to the way JavaScript engine handles objects in memory. A remote unauthenticated attacker could exploit this vulnerability by enticing the target user to open a specially crafted web...

Liferay Portal User Account Stored Cross Site Scripting (CVE-2016-3670)

A persistent XSS vulnerability exists in the user account creation process in Liferay Portal. The vulnerability is due to insufficient input validation of the firstName, middleName and lastName parameters. Successful exploitation could allow the attacker to inject arbitrary script code into a use...

Apache Struts Dynamic Method Remote Code Execution (CVE-2016-3081)

A remote code execution vulnerability exists in Apache's Struts 2 web application framework. The vulnerability is due to Dynamic Method invocation content. A remote unauthenticated attacker can exploit this vulnerability by sending a crafted HTTP request to a vulnerable server. A successful attac...

Oracle Application Testing Suite UploadFileAction fileType Directory Traversal (CVE-2016-0491)

A directory traversal vulnerability exists in Oracle Application Testing Suite. The vulnerability is due to insufficient input validation when processing HTTP request sent to URI "/olt/UploadFileUpload.do". A remote attacker can exploit this vulnerability by sending a malicious request to the...

Microsoft Windows Graphics Rendering Engine Buffer Overflow (MS04-032) - Ver2 (CVE-2004-0209)

The Microsoft Windows Metafile Format WMF is used to store pictures and other graphical renderings as either vector or bitmap-format graphical data. The vector data stored in WMF files is described as Microsoft Windows Graphics Device Interface GDI commands. The WMF format is the original 16-bit...

Microsoft DirectShow AVI Parser Heap Overflow - Ver2 (CVE-2010-0250)

A buffer overflow vulnerability has been reported in Microsoft DirectShow. The vulnerability is due to the way Microsoft DirectShow component handles specially crafted AVI files. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected...

Microsoft Windows LNK PIF Code Execution - Ver2 (CVE-2010-2568)

A code execution vulnerability has been reported in Microsoft Windows 7, Microsoft Windows Vista, Microsoft Windows Xp, Microsoft Windows 2003 Server, Microsoft Windows Server 2003 and Microsoft Windows Server 2008. Successful exploitation of this vulnerability could allow a remote attacker to...

Internet Explorer iepeers.dll Remote Code Execution - Ver2 (CVE-2010-0806)

Microsoft Internet Explorer is the most widely used Internet browser. A remote code execution vulnerability has been reported in Microsoft Internet Explorer. The vulnerability is due to the way Internet Explorer handles specific attributes. To trigger this issue, an attacker may create a maliciou...

Internet Explorer Same ID Property Remote Code Execution (MS12-037; CVE-2012-1875)

A remote code execution vulnerability has been reported in Microsoft Internet Explorer. The vulnerability is due to an error in the way Internet Explorer accesses an object that has been deleted. A remote attacker could trigger this vulnerability by enticing an unsuspecting victim to open a...

Microsoft Office File Malformed String Parsing Buffer Overflow (MS06-038) - ver 2 (CVE-2006-1540)

Microsoft Office is a popular productivity application suite released by Microsoft Corporation. It includes a word processor, a spreadsheet application, a presentation editor, and a number of other applications and components. A memory corruption vulnerability has been reported in several Microso...

Apache Struts2 ParametersInterceptor Remote Command Execution (CVE-2010-1870)

Apache Struts2 is a free framework for building Java web-based applications. A command execution vulnerability has been reported in the web application framework Apache Struts2. The vulnerability is due to insufficient input validation in the ParametersInterceptor component when parsing incoming...

Ingres Database uuid_from_char Stack Buffer Overflow (CVE-2007-3338)

Ingres Database is a relational DataBase Management System DBMS product developed by Ingres. Ingres Database is made available for both Windows and Unix-like platforms. The product is embedded by other software vendors, such as Computer Associates CA in its eTrust and Unicenter products. A stack...

Cisco Application Networking Manager Default User Credentials Security Bypass (CVE-2009-0616)

Cisco Application Networking Manager ANM is a network management application that manages Cisco Application Control Engine ACE modules or appliances. The vulnerability is due to a design error in the ANM that does not force credential changes during installation. A remote attacker may exploit thi...

Microsoft Windows Message Queuing Service String Buffer Overflow (MS05-017; CVE-2005-0059; CVE-2007-3039)

...

PHP Authentication Bypass (CVE-2022-31629)

An authentication bypass vulnerability exists in PHP. Successful exploitation will bypass authentication and allow the attacker to gain unauthorized access to the system...

Razer Sila Gaming Router Command Injection (CVE-2022-29013)

A command injection vulnerability exists in Razer Sila gaming router. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...

Edgecore ECS2020 Command Injection (CVE-2019-6288)

A command injection vulnerability exists in Edgecore ECS2020. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...

Codiad Web IDE Command Injection (CVE-2019-19208)

A command injection vulnerability exists in Codiad Web IDE. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...

Apache SkyWalking Storage SQL Injection (CVE-2020-13921)

An SQL injection vulnerability exists in Apache SkyWalking MySQL storage implementation. The vulnerability is due to insufficient validation of the user supplied input for wildcard alarm search query through GraphQL protocol...

Apache Tapestry Information Disclosure (CVE-2020-13953)

An information disclosure vulnerability exists in Apache Tapestry. This vulnerability is due to URL manipulation that allows Java webapp files inside WEB-INF to be listed and downloaded...

Zeroshell Remote Code Execution (CVE-2020-29390)

A remote code execution vulnerability exists in Zeroshell. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

CAYIN xPost Remote Code Execution (CVE-2020-7356)

A remote code execution vulnerability exists in CAYIN xPost. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

jQuery Cross Site Scripting (CVE-2020-11022; CVE-2020-11023)

A cross-site scripting vulnerability exists in jQuery. Successful exploitation of this vulnerability could result in execution of arbitrary scripts on the affected system...

Apache Spark Unauthenticated Remote Code Execution (CVE-2018-11770)

A remote code execution vulnerability exists in Apache Spark. Successful exploitation of this vulnerability could result in arbitrary code execution...

WordPress portable-phpMyAdmin Plugin Authentication Bypass (CVE-2012-5469)

An authentication bypass vulnerability exists in WordPress portable-phpMyAdmin Plugin. Successful exploitation of this vulnerability would allow remote attackers to obtain sensitive information and gain unauthorized access into the affected system...

Nagios XI Cmdsubsys Command Injection (CVE-2018-15709; CVE-2018-15710)

An command injection vulnerability has been reported in the Command subsystem component of Nagios XI. The vulnerability is due to insufficient validation of command options submitted to ajaxhelper.php for the submitcommand action and the existence of a local privilege escalation vulnerability tha...

Linksys WVBR0-25 Command Injection (CVE-2017-17411)

A command injection vulnerability exists in Linksys WVBR0-25. The vulnerability is due to insufficient input validation in the router's web management portal. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code...

Apache Tika Chmparser Denial Of Service (CVE-2018-1339)

A denial-of-service vulnerability exists in Apache Tika. The vulnerability is due to improper handling of a Microsoft Compiled HTML Help file during enumerating its listing chunks...

DNN Cookie Deserialization Remote Code Execution (CVE-2017-9822)

An object deserialization vulnerability exists in DotNetNuke web content management system. A remote unauthenticated attacker may exploit this vulnerability by sending a crafted file to the web application...

Microsoft Internet Explorer Information Disclosure (MS17-006: CVE-2017-0059)

Information disclosure vulnerabilities exists in Microsoft Internet Explorer. This vulnerability is due to improper handling of objects in memory. A successful exploitation could result in an out-of-bounds read and access to private user data...

Microsoft Windows Win32k Elevation of Privilege (MS16-074: CVE-2016-3219)

An elevation of privilege vulnerability exists in Microsoft Windows Win32k. A remote attacker can bypass the ProcessFontDisablePolicy check in win32k to load a custom font from an arbitrary file on disk. A successful exploitation could allow an attacker to run arbitrary code with elevated...

Adobe Acrobat And Reader JavaScript API code execution (APSB15-10: CVE-2015-3072; CVE-2015-3065; CVE-2015-3066; CVE-2015-3067; CVE-2015-3068; CVE-2015-3071; CVE-2015-3073)

A Restrictions Bypass Privileged JavaScript API Execution Vulnerability exists in Adobe Acrobat and Reader. The vulnerability is due to the use of trusted function which provides certain privileges that allows overwriting objects. A remote attacker can exploit this vulnerability by enticing the...

Web Servers Suspicious File Upload (CVE-2019-16113; CVE-2021-26918; CVE-2022-26645)

A remote attacker can upload a malicious file to a web server. Successful exploitation could result in the execution of arbitrary code in the security context of the web server...

Infinity Exploit Kit Landing Page (CVE-2013-1347; CVE-2013-2423; CVE-2013-2465; CVE-2014-0322; CVE-2014-0502; CVE-2014-1776)

Infinity is a web exploit kit that operates by delivering a malicious payload to the victim's computer. Remote attackers can infect users with Infinity exploit kit by enticing them to visit a malicious web page. Infinity Exploit Kit installs payloads on infected computer, which could result in da...

Microsoft Embedded OpenType Font Parser Directory Entry Code Execution - Ver2 (CVE-2009-2514)

A code execution vulnerability has been reported in Microsoft Windows. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

Microsoft .NET Framework WinForms Buffer Overflow (CVE-2013-0002)

A buffer overflow vulnerability exists in Microsoft .NET Framework Windows Form. The vulnerability is due to a race condition when handling the size of an array of objects prior to copying them into a global memory buffer.An attacker can remotely exploit this vulnerability by enticing a user to...

Preemptive Protection against Microsoft IIS FTP Server Telnet IAC Buffer Overflow Vulnerability (MS11-004)

A heap buffer overflow vulnerability has been reported within the Microsoft Internet Information Services IIS FTP Service. IIS is a collection of Internet services packaged with several versions of the Windows operating system. IIS includes a FTP server service for exchanging and manipulating fil...

Microsoft IIS Repeated Parameter Request Denial of Service (MS10-065; CVE-2010-1899)

IIS is a collection of Internet services packaged with several versions of the Windows operating system. A denial of service vulnerability has been reported in Microsoft Internet Information Services IIS. A remote attacker could use this issue to create a denial of service condition, thus crashin...

Preemptive Protection against Microsoft IIS Request Header Buffer Overflow Vulnerability (MS10-065)

A buffer overflow vulnerability has been reported in Microsoft Internet Information Services IIS with FastCGI enabled. IIS is a collection of Internet services packaged with several versions of the Windows operating system. FastCGI for IIS enables popular application frameworks that support the...

Preemptive Protection against Multiple Vendors librpc.dll Stack Buffer Overflow

A buffer overflow vulnerability exists in IBM's Informix Dynamic Server and EMC's Legato Networker. Informix is a family of relational database management system RDBMS products by IBM. The vulnerability is due to insufficient validation of user input during authentication by the RPC protocol...

Microsoft Excel Malformed Range Code Execution (MS06-012; CVE-2005-4131)

Microsoft Excel is a spreadsheet application released by the Microsoft Corporation. Its native file format is the Binary Interchange File Format BIFF, which is available is several versions. An Excel file contains information about the various spreadsheets that form an Excel workbook, the data an...

Update Protection against UltraVNC VNCViewer Authenticate Buffer Overflow

A buffer overflow vulnerability was reported in multiple Virtual Network Computing VNC based applications. Virtual Network Computing VNC is a graphical desktop sharing technology desigend to remotely control another computer. The flaw is due to improper validation of length value in network...