FreePBX config php Code Execution (CVE-2014-1903)

FreePBX is an open source software implementation of a telephone Private Branch eXchange PBX. A code execution vulnerability exists in FreePBX software. Remote attacker can exploit this vulnerability to inject arbitrary PHP functions and commands...

Microsoft Publisher Function Pointer Overwrite (MS11-091) - Ver2 (CVE-2011-1508)

A memory corruption vulnerability has been reported in Microsoft Publisher. The vulnerability is due to the way Microsoft Publisher does not properly handle memory for function pointers while parsing specially crafted Publisher files. A remote attacker may exploit this vulnerability by enticing a...

Internet Explorer JavaScript window() Memory Corruption (MS05-054) - Ver2 (CVE-2005-1790)

Microsoft Internet Explorer is a web browser capable of displaying HTML encoded pages, downloading files, etc. This application has a built-in JavaScript interpreter. It is also capable of using Document Object Model DOM objects, in particular by providing access to them through JavaScript. A...

Symantec Endpoint Protection Manager XML External Entity Denial Of Service (CVE-2013-5014)

A XML external entity XXE vulnerability exists in Symantec Endpoint Protection Manager SEPM. This is due to an incorrectly configured XML parser in the management console that readily processes XML external entities. A remote unauthenticated attacker may exploit this vulnerability via specially...

Windows Media Player ActiveX Missing Codec Code Execution - Ver2 (CVE-2010-0268)

A code execution vulnerability has been reported in Microsoft Windows Xp, Microsoft Windows Media Player and Microsoft Windows 2000. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

Microsoft Windows InformationCardSigninHelper Class ActiveX Control Code Execution - ver 2 (CVE-2013-3918)

A remote code execution vulnerability exists in the InformationCardSigninHelper Class ActiveX control, icardie.dll. When the InformationCardSigninHelper Class ActiveX control is instantiated in Internet Explorer, the control may corrupt the system state in such a way that an attacker could run...

Multiple Products XML Public External Entity Information Disclosure (CVE-2013-3617; CVE-2013-4152; CVE-2013-6429; CVE-2014-0002; CVE-2014-0423)

A XML external entity XXE vulnerability exists in multiple products. The vulnerability is due to incorrectly configured XML parsing which accepts XML external entities from untrusted sources. A remote, unauthenticated attacker can leverage this vulnerability by sending a malicious request to the...

Sun Java Web Start Splashscreen GIF Decoding Buffer Overflow - Improved Performance (CVE-2008-2086)

The Sun Java Web Start is a component of the Java 2 Runtime Environment JRE. It allows for the network deployment of Java applications. This component enables stand-alone Java applications to be downloaded from a remote network location and invoked on a target machine. There exists a memory...

Honeywell Multiple Products HscRemoteDeploy.dll ActiveX Control Code Execution (CVE-2013-0108)

A code execution vulnerability exists in Honeywell HscRemoteDeploy.dll ActiveX Control. The vulnerability is due a failure to validate user input that can lead to the execution of an arbitrary HTA application. An attacker can exploit this vulnerability by enticing a user to visit a specially...

Snort Back Orifice Pre-Processor Buffer Overflow - Improved Performance (CVE-2005-3252)

A buffer overflow exists in Snort product. The flaw is caused by an insufficient boundary checks in the handling of Back Orifice messages. An attacker may leverage this vulnerability to execute arbitrary code in the security context of the affected product, normally root. In case of an attack whe...

Microsoft Windows Media Player MIDI Code Execution (MS12-004; CVE-2012-0003)

A remote code execution vulnerability has been reported in Windows Media Player. The vulnerability is due to an error in Windows Media Player while handling specially crafted MIDI files. A remote attacker may exploit this vulnerability by enticing a target user to open a specially crafted MIDI fi...

Oracle Java Applet2ClassLoader Remote Code Execution (CVE-2010-4452)

Java Technology is a programming platform which aims to provide a system for developing and deploying cross-platform applications. It is distributed in the form of various tools such as Java Runtime Environment JRE and Java Development Kit JDK. A remote code execution vulnerability has been...

Microsoft Visio Packed Object Parsing Memory Corruption (CVE-2007-0936)

Microsoft Visio is a diagramming application that is part of the Microsoft Office suite. Microsoft Office is a popular productivity application suite released by Microsoft Corporation. It includes a word processor, a spreadsheet application, a presentation editor, and a number of other applicatio...

Symantec AppStream Client LaunchObj ActiveX Control (CVE-2008-4388)

The AppStream Client is part of a Software Virtualization Solution SVS which allows streaming of virtual applications to users in an enterprise environment using the AppStream Server. It provides centralized delivery and licensing mechanism which allows controlled access to any Windows Applicatio...

Microsoft Windows WMF Handling Arbitrary Code Execution (CVE-2005-4560)

There exists a code execution vulnerability in Microsoft Windows. The vulnerability is created by unrestricted access to GDI functions through WMF files. An attacker can exploit this vulnerability to supply and execute arbitrary code through calling a specific GDI function via a crafted WMF file...

Microsoft Exchange Server Buffer Overflow (CVE-2005-0560)

Microsoft Exchange Server is a messaging and collaboration server. It is an extensive application designed to provide email and scheduling capabilities for medium to large organizations. The server has the capability to communicate with email clients and other servers using the SMTP protocol. A...

SHOUTcast Filename Format String (CVE-2004-1373)

SHOUTcast is a free distributed streaming audio system developed by Nullsoft. It is widely used by Internet-based radio stations. The SHOUTcast server implements a subset of the HTTP protocol to communicate with clients. A client-server session starts with the client requesting an audio stream fr...

Novell eDirectory HTTP Server Redirection Buffer Overflow (CVE-2006-5478)

Novell eDirectory is a Lightweight Directory Access Protocol LDAP server, intended for use as a part of an identity management solution. The product is made available for multiple platforms including NetWare, Unix-like systems, and Windows. A code execution vulnerability has been reported in the...

Internet Explorer History Index Script Injection (MS09-019; CVE-2009-1140)

Microsoft Internet Explorer is the most widely used Internet browser. An information disclosure vulnerability has been reported in Microsoft Internet Explorer. The vulnerability is due to the way Internet Explorer caches data and incorrectly allows the cached content to be called, potentially...

Update Protection against IBM Access Support ActiveX GetXMLValue Method Buffer Overflow

IBM Access Support ActiveX Control contains a buffer overflow vulnerability. The IBM Access Support ActiveX control is used by the vendor to collect system information, such as make, model, serial number, OS version, etc. This control is available on the IBM / Lenovo web site, and may also come...

Schneider Electric IGSS Buffer Overflow (CVE-2021-22802)

A buffer overflow exists in Schneider Electric IGSS. This vulnerability is due to insufficient input validation...

Belkin Wemo UPnP API OS Command Injection (CVE-2019-12780)

A command injection vulnerability exists in Belkin Wemo. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...

WordPress Booking Calendar Plugin SQL Injection (CVE-2018-20556)

A command execution vulnerability exists in WordPress Plugin Booking Calendar . Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...

OpenCart Remote Code Execution (CVE-2022-24108)

A remote code execution vulnerability exists in Skyoftech So Listing Tabs module for OpenCart. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

Zoho ManageEngine Command Injection (CVE-2021-43319)

A command injection vulnerability exists in ManageEngine Network Configuration Manager. This vulnerability is due to insufficient validation in the ipaddress field of the ping functionality in add device web interface...

GitHub Repository Hestiacp Command Injection (CVE-2022-2550)

A command injection vulnerability exists in GitHub Repository Hestiacp. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

VMWare Workspace One Access Authentication Bypass (CVE-2022-31656)

An authentication bypass vulnerability exists in VMWare Workspace One Access. Successful exploitation of this vulnerability would allow a remote attacker to obtain sensitive information and gain unauthorized access to the affected system...

Zoho Multiple Products Authentication Bypass (CVE-2022-29081)

An authentication bypass vulnerability exists in multiple Zoho products. Successful exploitation of this vulnerability would allow a remote attacker to obtain sensitive information...

FlashGet Buffer Overflow (CVE-2020-28967)

A buffer overflow vulnerability exists in the FlashGet download manager. The vulnerability is due to lack of proper validation of user data in 'current path directory' function...

GitList Remote Code Execution (CVE-2018-1000533)

A remote code execution vulnerability exists in GitList. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

WordPress XCloner Backup Plugin Remote Code Execution (CVE-2020-35948)

A remote code execution vulnerability exists in WordPress XCloner Backup plugin. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

OpenPLC WebServer Remote Code Execution (CVE-2021-31630)

A remote code execution vulnerability exists in OpenPLC WebServer. Successful exploitation of this vulnerability could allow an authenticated attacker to execute arbitrary code on the affected system...

Pyres Termod4 Remote Code Execution (CVE-2020-23160)

A remote code execution vulnerability exists in Pyres Termod4. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

PHPGurukul Car Rental Arbitrary File Upload (CVE-2021-26809)

An arbitrary file upload vulnerability exists in PHPGurukul Car Rental. Successful exploitation of this vulnerability could allow a remote attacker to damage users system...

Trend Micro InterScan Web Security Virtual Appliance Command Injection (CVE-2020-28580; CVE-2020-28581)

A command injection vulnerability exists in Trend Micro InterScan Web Security Virtual Appliance. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...

QNAP Photo Station Remote Code Execution (CVE-2019-7192; CVE-2019-7193; CVE-2019-7194; CVE-2019-7195)

A remote code execution vulnerability exists in QNAP NAS. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

D-Link DAP-1360U Command Injection (CVE-2020-26582)

A command injection vulnerability exists in D-Link DAP-1360U. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...

Tenda Routers Command Injection (CVE-2020-10987; CVE-2018-14558)

A command injection vulnerability exists in Tenda Routers. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...

SuperWebMailer Remote Code Execution (CVE-2020-11546)

A remote code execution vulnerability exists in SuperWebMailer. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

Phoenix Contact TC Router Command Injection (CVE-2020-9436)

A command injection vulnerability exists in Phoenix Contact TC Router. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

Adobe Font Manager Library Remote Code Execution Vulnerability (CVE-2020-1020)

A remote code execution vulnerability exists in Microsoft Windows. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

Advantech WebAccess Remote Code Execution (CVE-2019-10987)

A remote code execution vulnerability exists in Advantech WebAccess. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

Advantech WebAccess SCADA Buffer Overflow (CVE-2019-6550)

A stack-based buffer overflow vulnerability exists in Advantech WebAccess. The vulnerability is due to a lack of boundary checks while copying user-supplied data into a stack-based buffer within bwstwww.exe. Successful exploitation could lead to arbitrary code execution under context of...

Lighttpd Web Server Denial Of Service (CVE-2019-11072)

A denial-of-service vulnerability exists in Lighttpd server. This vulnerability is due to improper handling of URL when url-path-2f-decode is enabled. A remote, unauthenticated attacker can exploit this vulnerability by sending a maliciously crafted HTTP request to the target server. Successful...

Centreon Nagios Path Command Injection (CVE-2019-13024)

A command injection vulnerability exists in Centreon. Successful exploitation of this vulnerability would allow remote attackers to execute system arbitrary commands in the affected system...

BusyBox Project BusyBox udhcp Option Out of Bounds Read (CVE-2018-20679)

An out-of-bounds read vulnerability has been reported in the udhcp module of BusyBox. This vulnerability is due to insufficient validation of the length of certain options in a DHCP packets. A remote attacker could exploit this vulnerability by sending maliciously crafted messages to a DHCP clien...

Asterisk PJSIP Invalid Media Attribute Denial Of Service (CVE-2018-1000099)

A denial-of-service vulnerability exists in Asterisk PJSIP. The vulnerability is due to improper validation of SDP Media Attributes. Successful exploitation can result in denial-of-service conditions...

Dell OpenManage Network Manager Authentication Bypass (CVE-2018-15768)

An authentication bypass vulnerability exists in Dell OpenManage Network Manager. The vulnerability is due to a misconfiguration in the /etc/sudoers file. Successful exploitation of this vulnerability would allow remote attackers to obtain sensitive information and gain unauthorized access into t...

Nikto CSV Injection Remote Code Execution (CVE-2018-11652)

A CSV Injection Vulnerability exists in Nikto 2.1.6. A successful attacker could inject arbitrary OS command directly into a CSV report. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

Web servers PHPMyAdmin Suspicious Table Hyperlink (CVE-2017-1000499)

A PhpMyAdmin user could be subject to a phishing attack. This is due to the way PhpMyAdmin handles modify requests. A successful attack could lead to malicious SQL command execution...