13538 matches found
ESF pfSense webgui deletefile Directory Traversal (CVE-2015-2295)
A directory traversal vulnerability has been reported in Electric Sheep Fencing pfSense firewall. This vulnerability is due to insufficient validation of the deletefile HTTP request parameter in "/systemfirmwarerestorefullbackup.php". By convincing an authenticated user to click on a crafted link...
Microsoft Windows Group Policy Remote Code Execution (MS15-011; CVE-2015-0008)
A remote code execution vulnerability exists in Microsoft Windows. The vulnerability is due to the way Group Policy receives and applies policy data when a domain-joined system connects to a domain controller. An attacker can exploit this vulnerability by convincing a victim with a...
WordPress Holding Pattern Theme Arbitrary File Upload (CVE-2015-1172)
An unauthorized file upload vulnerability has been reported in WordPress Holding Pattern Theme. A remote attacker could exploit this vulnerability by uploading a file to a server running the vulnerable application. Successful exploitation of this vulnerability could allow a remote attacker to...
HP Network Node Manager I ovopi.dll Buffer Overflow (CVE-2014-2624)
Multiple buffer overflow vulnerabilities exist in HP Network Node Manager I NNMi. These vulnerabilities are caused by copying user supplied data into stack-based buffers without sufficient validation in ovopi.dll. By sending a crafted request to the vulnerable product on port 696/UDP, a remote...
FreePBX config php Code Execution (CVE-2014-1903)
FreePBX is an open source software implementation of a telephone Private Branch eXchange PBX. A code execution vulnerability exists in FreePBX software. Remote attacker can exploit this vulnerability to inject arbitrary PHP functions and commands...
Symantec Endpoint Protection Manager XML External Entity Denial Of Service (CVE-2013-5014)
A XML external entity XXE vulnerability exists in Symantec Endpoint Protection Manager SEPM. This is due to an incorrectly configured XML parser in the management console that readily processes XML external entities. A remote unauthenticated attacker may exploit this vulnerability via specially...
Microsoft Internet Explorer SVG AnimateMotion Memory Corruption - Ver2 (CVE-2008-0077)
A memory corruption vulnerability has been reported in Microsoft Internet Explorer. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...
MS-SQL Server Protocol - General Settings - Ver2 (CVE-2002-1123)
...
Microsoft Windows InformationCardSigninHelper Class ActiveX Control Code Execution - ver 2 (CVE-2013-3918)
A remote code execution vulnerability exists in the InformationCardSigninHelper Class ActiveX control, icardie.dll. When the InformationCardSigninHelper Class ActiveX control is instantiated in Internet Explorer, the control may corrupt the system state in such a way that an attacker could run...
Multiple Products XML Public External Entity Information Disclosure (CVE-2013-3617; CVE-2013-4152; CVE-2013-6429; CVE-2014-0002; CVE-2014-0423)
A XML external entity XXE vulnerability exists in multiple products. The vulnerability is due to incorrectly configured XML parsing which accepts XML external entities from untrusted sources. A remote, unauthenticated attacker can leverage this vulnerability by sending a malicious request to the...
Sun Java Web Start Splashscreen GIF Decoding Buffer Overflow - Improved Performance (CVE-2008-2086)
The Sun Java Web Start is a component of the Java 2 Runtime Environment JRE. It allows for the network deployment of Java applications. This component enables stand-alone Java applications to be downloaded from a remote network location and invoked on a target machine. There exists a memory...
Honeywell Multiple Products HscRemoteDeploy.dll ActiveX Control Code Execution (CVE-2013-0108)
A code execution vulnerability exists in Honeywell HscRemoteDeploy.dll ActiveX Control. The vulnerability is due a failure to validate user input that can lead to the execution of an arbitrary HTA application. An attacker can exploit this vulnerability by enticing a user to visit a specially...
Snort Back Orifice Pre-Processor Buffer Overflow - Improved Performance (CVE-2005-3252)
A buffer overflow exists in Snort product. The flaw is caused by an insufficient boundary checks in the handling of Back Orifice messages. An attacker may leverage this vulnerability to execute arbitrary code in the security context of the affected product, normally root. In case of an attack whe...
Oracle Secure Backup Administration Server uname Var Authentication Bypass (CVE-2010-0904)
Oracle Secure Backup is a backup solution allowing for single point of management of data present on network attached storage NAS devices and distributed hosts. An authentication bypass vulnerability has been reported in Oracle Secure Backup server. The vulnerability is due to a flaw in the logic...
Microsoft Excel OBJ Record Stack Overflow (MS10-038; CVE-2010-0822)
Microsoft Excel is a spreadsheet application released by the Microsoft Corporation. Its native file format is the Binary Interchange File Format BIFF, which is available is several versions. An Excel file contains information about the various spreadsheets that form an Excel workbook, the data an...
Microsoft Visio Packed Object Parsing Memory Corruption (CVE-2007-0936)
Microsoft Visio is a diagramming application that is part of the Microsoft Office suite. Microsoft Office is a popular productivity application suite released by Microsoft Corporation. It includes a word processor, a spreadsheet application, a presentation editor, and a number of other applicatio...
Microsoft Exchange Server Buffer Overflow (CVE-2005-0560)
Microsoft Exchange Server is a messaging and collaboration server. It is an extensive application designed to provide email and scheduling capabilities for medium to large organizations. The server has the capability to communicate with email clients and other servers using the SMTP protocol. A...
SHOUTcast Filename Format String (CVE-2004-1373)
SHOUTcast is a free distributed streaming audio system developed by Nullsoft. It is widely used by Internet-based radio stations. The SHOUTcast server implements a subset of the HTTP protocol to communicate with clients. A client-server session starts with the client requesting an audio stream fr...
Preemptive Protection against HP OpenView Network Node Manager Buffer Overflows
HP OpenView Network Node Manager NNM is a software application designed for management, maintenance and monitoring of networks and network devices. Several vulnerabilities were reported in HP OpenView Network Node Manager CGI applications, enabling a remote user to execute arbitrary code on the...
Update Protection against Microsoft Visio Remote Code Execution Vulnerabilities (MS07-030)
Multiple remote code execution vulnerabilities have been reported in Microsoft Visio. Microsoft Visio is diagram creation software for Microsoft Windows. A remote attacker can exploit these vulnerabilities via a specially crafted Visio file. Successful exploitation may allow execution of arbitrar...
Preemptive Protection against Microsoft Distributed Transaction Coordinator Vulnerability (MS06-018)
Microsoft Distributed Transaction Coordinator MSDTC is a system service that coordinates transactions for Microsoft Windows platforms. A vulnerability was detected in the MDTC, allowing a remote attacker with the ability to send a crafted message to cause an affected system to stop responding...
WSO2 Identity Server Cross Site Scripting (CVE-2018-8716)
A cross-site scripting vulnerability exists in WSO2 Identity Server. Successful exploitation of this vulnerability would allow remote attackers to inject arbitrary web script into the affected system...
IonizeCMS Remote Code Execution (CVE-2022-26272)
A remote code execution vulnerability exists in IonizeCMS. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...
Tenda AX3 Router Command Injection (CVE-2022-24148; CVE-2022-24150)
A command injection vulnerability exists in Tenda AX3 router. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...
Zoho ManageEngine Command Injection (CVE-2021-43319)
A command injection vulnerability exists in ManageEngine Network Configuration Manager. This vulnerability is due to insufficient validation in the ipaddress field of the ping functionality in add device web interface...
GitHub Repository Hestiacp Command Injection (CVE-2022-2550)
A command injection vulnerability exists in GitHub Repository Hestiacp. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...
VMWare Workspace One Access Authentication Bypass (CVE-2022-31656)
An authentication bypass vulnerability exists in VMWare Workspace One Access. Successful exploitation of this vulnerability would allow a remote attacker to obtain sensitive information and gain unauthorized access to the affected system...
Palo Alto Networks PAN-OS Command Injection (CVE-2020-2038)
A command injection vulnerability exists in Palo Alto Networks PAN-OS. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...
Zoho Multiple Products Authentication Bypass (CVE-2022-29081)
An authentication bypass vulnerability exists in multiple Zoho products. Successful exploitation of this vulnerability would allow a remote attacker to obtain sensitive information...
GitList Remote Code Execution (CVE-2018-1000533)
A remote code execution vulnerability exists in GitList. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...
Sophos XG Firewall SQL Injection (CVE-2020-12271)
An SQL injection vulnerability exists in Sophos XG Firewall. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system...
WordPress XCloner Backup Plugin Remote Code Execution (CVE-2020-35948)
A remote code execution vulnerability exists in WordPress XCloner Backup plugin. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...
TP-Link Multiple Products Remote Code Execution (CVE-2020-35575)
A remote code execution vulnerability exists in Multiple TP-Link Products. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...
Web Servers Memory Corruption Attempt (CVE-2020-12000; CVE-2020-13934; CVE-2020-3239; CVE-2020-9490)
A memory corruption vulnerability can be exploited by malicious actors. Successful exploitation could cause damage to target systems...
Trend Micro InterScan Web Security Virtual Appliance Command Injection (CVE-2020-28580; CVE-2020-28581)
A command injection vulnerability exists in Trend Micro InterScan Web Security Virtual Appliance. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...
D-Link DAP-1360U Command Injection (CVE-2020-26582)
A command injection vulnerability exists in D-Link DAP-1360U. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...
Microsoft .NET Framework XPS File Parsing Remote Code Execution (CVE-2020-0605)
A remote code execution vulnerability exists in Microsoft .NET Framework XPS File Parsing. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...
AlienVault OSSIM Remote Code Execution (CVE-2017-6971)
A remote code execution vulnerability exists in AlienVault OSSIM. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...
Geniusocean News SQL Injection (CVE-2017-15981; CVE-2017-15982)
An SQL injection vulnerability exists in Geniusocean News. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary SQL commands on the affected system...
SuperWebMailer Remote Code Execution (CVE-2020-11546)
A remote code execution vulnerability exists in SuperWebMailer. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...
Phoenix Contact TC Router Command Injection (CVE-2020-9436)
A command injection vulnerability exists in Phoenix Contact TC Router. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...
Advantech WebAccess Remote Code Execution (CVE-2019-10987)
A remote code execution vulnerability exists in Advantech WebAccess. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...
Advantech WebAccess SCADA Buffer Overflow (CVE-2019-6550)
A stack-based buffer overflow vulnerability exists in Advantech WebAccess. The vulnerability is due to a lack of boundary checks while copying user-supplied data into a stack-based buffer within bwstwww.exe. Successful exploitation could lead to arbitrary code execution under context of...
Lighttpd Web Server Denial Of Service (CVE-2019-11072)
A denial-of-service vulnerability exists in Lighttpd server. This vulnerability is due to improper handling of URL when url-path-2f-decode is enabled. A remote, unauthenticated attacker can exploit this vulnerability by sending a maliciously crafted HTTP request to the target server. Successful...
Centreon Nagios Path Command Injection (CVE-2019-13024)
A command injection vulnerability exists in Centreon. Successful exploitation of this vulnerability would allow remote attackers to execute system arbitrary commands in the affected system...
BusyBox Project BusyBox udhcp Option Out of Bounds Read (CVE-2018-20679)
An out-of-bounds read vulnerability has been reported in the udhcp module of BusyBox. This vulnerability is due to insufficient validation of the length of certain options in a DHCP packets. A remote attacker could exploit this vulnerability by sending maliciously crafted messages to a DHCP clien...
Microsoft Office Information Disclosure - Ver 0 (CVE-2018-0950)
A vulnerability exists in RTF based emails which cause information disclosure through Outlook on Windows. The vulnerability is due to an error in the way Microsoft Office improperly discloses the contents of its memory. A remote attacker can exploit this issue by enticing a victim to open a...
JBoss Enterprise Application Platform Invoker Servlets Remote Code Execution (CVE-2012-0874)
A remote code execution vulnerability is exist in JBoss Enterprise Application Platform. A remote attacker can exploit this vulnerability to execute arbitrary code in the targeted system...
Microsoft Windows Theme API Remote Code Execution (CVE-2018-8413)
A remote code execution vulnerability exists in Microsoft Windows. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...
Apache Tika Chmparser Denial Of Service (CVE-2018-1339)
A denial-of-service vulnerability exists in Apache Tika. The vulnerability is due to improper handling of a Microsoft Compiled HTML Help file during enumerating its listing chunks...