Drupal Core stream wrapper Insecure Deserialization (CVE-2019-6339)

An insecure deserialization vulnerability exists in Drupal Core. The vulnerability is in a stream wrapper when performing file operations. Successful exploitation of this vulnerability could result in arbitrary code execution under the security context of the web server...

Microsoft Internet Explorer Security Feature Bypass (CVE-2019-0768)

A security bypass vulnerability exists in Microsoft Internet Explorer. Successful exploitation of this vulnerability would allow remote attackers to bypass security tests and protocols on the affected system...

Advanced Package Tool Remote Code Execution (CVE-2019-3462)

A remote code execution vulnerability exists in Advanced Package Tool. The vulnerability is due to lack of sanitation on Location headers in HTTP responses. Successful exploitation could result in installation and execution of altered packages...

Rockwell Automation Allen Bradley Micrologix 1400 Series Device Power Cycle Denial of Service (CVE-2017-12088; CVE-2017-12089; CVE-2017-12090; CVE-2017-12092; CVE-2017-12093)

A denial of service vulnerability exists in Rockwell Automation Allen Bradley Micrologix 1400 Series. A remote, unauthenticated attacker can exploit the vulnerability by sending crafted packets to the target system...

Dell OpenManage Network Manager Authentication Bypass (CVE-2018-15768)

An authentication bypass vulnerability exists in Dell OpenManage Network Manager. The vulnerability is due to a misconfiguration in the /etc/sudoers file. Successful exploitation of this vulnerability would allow remote attackers to obtain sensitive information and gain unauthorized access into t...

Netgear DGN2200 dnslookup.cgi Command Injection (CVE-2017-6334)

A command injection vulnerability exists in NETGEAR DGN2200 Router. The vulnerability is due to insufficient input validation in the router's web administration. Successful exploitation of this vulnerability could allow a remote attacker with valid login details to execute arbitrary code...

Microsoft Windows Graphics Component Remote Code Execution (MS17-013: CVE-2017-0108)

A remote code execution vulnerability has been reported in Microsoft Windows. The vulnerability is due to the way the Windows Uniscribe handles objects in memory. A remote attacker could exploit this vulnerability by enticing the target user to open a specially crafted website...

Pivotal Spring Security OAuth SpelView Code Execution (CVE-2016-4977)

A remote code execution vulnerability exists in Pivotal Spring Security OAuth. The vulnerability is caused when processing authorization requests using the whitelabel views and when the responsetype parameter value is executed as Spring SpEL. This enables a malicious user to trigger remote code...

Microsoft Internet Explorer Memory Corruption (MS15-065: CVE-2015-2384)

A remote code execution vulnerability has been reported in Microsoft Internet Explorer. The vulnerability is due to an error where Internet Explorer treats CTreeNode object as a CGeneratedTreeNode object. A remote attacker can exploit this issue by enticing a user to open a specially crafted...

Web Clients HTTP URL JavaScript Function Cross-Site Scripting (CVE-2015-1159; CVE-2015-6099; CVE-2015-6972; CVE-2017-0068)

A cross-site scripting vulnerability has been reported in multiple web clients. The vulnerability is due to improper input validation. A remote attacker could exploit this vulnerability to execute arbitrary scripting or HTML code in the user's browser session...

Internet Explorer Malformed IFRAME Buffer Overflow (MS04-040) - Ver2 (CVE-2004-1050)

Internet Explorer IE is a popular web browser developed by Microsoft corporation. A buffer overflow vulnerability has been reported in Microsoft Internet Explorer. The vulnerability is in the way Microsoft Internet Explorer parses certain parameters of an IFRAME tag. An attacker can exploit this...

Red Hat JBoss Seam InterfaceGenerator Information Disclosure (CVE-2013-6448)

An information disclosure vulnerability exists in Red Hat JBoss Seam Framework. This is due to a design flaw in the InterfaceGenerator handler that allows it to expose details of all classes on the server's classpath. A remote unauthenticated attacker may exploit this vulnerability on a web...

FreePBX config php Code Execution (CVE-2014-1903)

FreePBX is an open source software implementation of a telephone Private Branch eXchange PBX. A code execution vulnerability exists in FreePBX software. Remote attacker can exploit this vulnerability to inject arbitrary PHP functions and commands...

Symantec Endpoint Protection Manager XML External Entity Denial Of Service (CVE-2013-5014)

A XML external entity XXE vulnerability exists in Symantec Endpoint Protection Manager SEPM. This is due to an incorrectly configured XML parser in the management console that readily processes XML external entities. A remote unauthenticated attacker may exploit this vulnerability via specially...

System V TTYPROMPT Buffer Overflow - Ver2 (CVE-2001-0797)

A buffer overflow vulnerability has been reported in various System V based operating systems. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...

Belkin Linksys WRT54G / WRT54GS apply.cgi POST Request Buffer Overflow (CVE-2005-2799)

A stack buffer overflow vulnerability has been reported in Belkin Linksys WRT54G and WRT54GS wireless routers...

HP Data Protector CRS Opcode 259 Stack Buffer Overflow (CVE-2013-2329)

A stack buffer overflow has been reported in HP Data Protector. The vulnerability is in the CRS.exe service, which listens on a randomly chosen port. The application fails to sanitize input with opcode 259, which can result in a stack buffer overflow. A remote, unauthenticated attacker can exploi...

Sun Java Web Start Splashscreen GIF Decoding Buffer Overflow - Improved Performance (CVE-2008-2086)

The Sun Java Web Start is a component of the Java 2 Runtime Environment JRE. It allows for the network deployment of Java applications. This component enables stand-alone Java applications to be downloaded from a remote network location and invoked on a target machine. There exists a memory...

phpBB viewtopic.php URL Decoding Code Execution (CVE-2004-1315)

A code injection and execution vulnerability has been reported in phpBB. The vulnerability is due to lack of input validation on the highlight parameter supplied to viewtopic.php. A remote attacker can exploit this issue by injecting malicious SQL code to the target server. Successful exploitatio...

Oracle AutoVue AutoVueX ActiveX Control SetMarkupMode Stack Buffer Overflow (CVE-2012-0549)

A stack buffer overflow vulnerability has been reported in Oracle AutoVue...

Microsoft Windows Media Player MIDI Code Execution (MS12-004; CVE-2012-0003)

A remote code execution vulnerability has been reported in Windows Media Player. The vulnerability is due to an error in Windows Media Player while handling specially crafted MIDI files. A remote attacker may exploit this vulnerability by enticing a target user to open a specially crafted MIDI fi...

Microsoft Windows NDISTAPI Code Execution (MS11-062; CVE-2011-1974)

This is a code execution vulnerability. The vulnerability is due to improper validation of user input by NDISTAPI. A remote attacker could trigger this flaw by convincing an unsuspecting victim to open a malicious file. Successful exploitation of this vulnerability may allow an attacker to gain...

Oracle Java IE Browser Plugin docbase Parameter Stack Buffer Overflow (CVE-2010-3552)

Java Technology is a programming platform which aims to provide a system for developing and deploying cross-platform applications. A remote attacker could exploit this issue by convincing a user to open a maliciously crafted HTML file with Internet Explorer, which will allow execution of arbitrar...

Trend Micro Internet Security Pro ActiveX extSetOwner Remote Code Execution (CVE-2010-3189)

Trend Micro's Internet Security Pro 2010 is a PC security suite which includes a large suite of features such as antivirus and antispyware protection, a firewall, keylogger detection, and more. The suite also includes remote backup and restore capabilities in addition to smart phone protection. A...

Free Download Manager Torrent File Parsing Multiple Buffer Overflows (CVE-2009-0184)

Free Download Manager is an open source free download accelerator and manager software distributed under GPL license. It includes various features and components, such as upload manager, Flash video download, Remote Control Server, BitTorrent support, smart file management, a powerful scheduler a...

Microsoft Internet Explorer CSS Import Use-After-Free Code Execution (MS11-003; CVE-2004-0842; CVE-2010-3971)

Microsoft Internet Explorer is a popular web browser provided by Microsoft Corporation. Its web engine is also incorporated into other Microsoft products including Outlook. The product supports Cascading Style Sheets. A vulnerability exists in the way Microsoft Internet Explorer renders web pages...

IBM eGatherer ActiveX RunEgatherer Function Buffer Overflow (CVE-2006-4221)

IBM Corporation is a large and well-known vendor of mainframe hardware, software, enterprise applications and servers, as well as desktop and workstation machines. As the vendor provides a broad level of support for its desktop computers, it includes an application designed to assist the user in...

HP OpenView Network Node Manager snmp.exe Oid Variable Buffer Overflow (CVE-2009-3849)

HP OpenView product consists of a suite of network and system management software applications developed by HP. It includes several optional modules and components, such as OpenView Quality Manager, OpenView Performance Insight, OpenView Network Node Manager, etc. A buffer overflow vulnerability...

Internet Explorer Drag and Drop Elevation of Privilege (MS04-038; CVE-2004-0839)

Microsoft Internet Explorer provides a number of ways to represent remote or local content. One of it's more powerful features is the Web folder view. The Web folder provides easy access to files located on a web server. A vulnerability exists in the way Internet Explorer uses the web folder view...

Microsoft Excel Document Malformed BIFF Record Heap Overflow (MS09-067; CVE-2009-3130)

Microsoft Excel is a popular spreadsheet application. A remote code execution vulnerability has been identified in Microsoft Excel. The vulnerability is due to an error in Microsoft Office Excel that fails to properly parse the Excel spreadsheet file format. A remote attacker could trigger this...

MySQL MaxDB WebDBM Server Buffer Overflow (CVE-2006-4305)

MaxDB is an open source database application suite developed by MySQL AB that is available for various operating systems. The software bundles an HTTP server component, named Webtool, to provide a web-based application interface. Clients can connect to the Webtool with a web browser and access...

Oracle Secure Backup Administration Server Authentication Bypass (CVE-2009-1977)

Oracle Secure Backup is a backup solution allowing for single point of management of data present on network attached storage NAS devices and distributed hosts. An authentication bypass vulnerability has been reported in Oracle Secure Backup server. The vulnerability is due to a flaw in the logic...

Internet Explorer History Index Script Injection (MS09-019; CVE-2009-1140)

Microsoft Internet Explorer is the most widely used Internet browser. An information disclosure vulnerability has been reported in Microsoft Internet Explorer. The vulnerability is due to the way Internet Explorer caches data and incorrectly allows the cached content to be called, potentially...

Update Protection against Microsoft Visio Remote Code Execution Vulnerabilities (MS07-030)

Multiple remote code execution vulnerabilities have been reported in Microsoft Visio. Microsoft Visio is diagram creation software for Microsoft Windows. A remote attacker can exploit these vulnerabilities via a specially crafted Visio file. Successful exploitation may allow execution of arbitrar...

Microsoft Windows Workstation Service Buffer Overflow (MS06-070; CVE-2006-4691)

The Server Service SRVSVC is one of the network services supplied by Microsoft. It supports file, print, and named-pipe sharing over Windows-based networks, and allows named pipe communication between applications running on distributed systems. By supplying malformed parameters to some of the AP...

WordPress Booking Calendar Plugin SQL Injection (CVE-2018-20556)

A command execution vulnerability exists in WordPress Plugin Booking Calendar . Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...

Zoho ManageEngine ApplicationManager Command Injection (CVE-2018-7890)

A command injection vulnerability exists in Zoho ManageEngine ApplicationManager. The vulnerability is due to improper validation of the user supplied parameters. A remote attacker can exploit this vulnerability by sending crafted parameters to the target system...

Tenda AC18 Router Command Injection (CVE-2022-31446)

A command injection vulnerability exists in Tenda AC18 Router. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...

VCFtools Use-after-free (CVE-2018-11130)

A use-after-free vulnerability exists in Vcftools Project VCFtools. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

Reverse Shell Commands Over HTTP Payload (CVE-2022-29078)

A reverse shell command Injection over HTTP vulnerability has been reported. A remote attacker can exploit this issue by sending a specially crafted request to the victim. Successful exploitation would allow an attacker to execute arbitrary code on the target machine...

Nokia BTS TRS Web Console Authentication Bypass (CVE-2021-31932)

An authentication bypass vulnerability exists in Nokia BTS TRS Web Console. Successful exploitation of this vulnerability would allow remote attacker to obtain sensitive information and gain unauthorized access into the affected system...

Oracle MySQL Cluster Stack Buffer Overflow (CVE-2022-21280)

A buffer overflow vulnerability exists in Oracle MySQL Cluster. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system or cause application crashes...

Apache Storm Remote Code Execution (CVE-2021-40865)

A remote code execution vulnerability exists in Apache Storm. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

TOTOLINK EX200 Command Injection (CVE-2021-43711)

A command injection vulnerability exists in TOTOLINK EX200. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

Apache Log4j Remote Code Execution (CVE-2021-44228; CVE-2021-45046)

A remote code execution vulnerability exists in Apache Log4j. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

GitList Remote Code Execution (CVE-2018-1000533)

A remote code execution vulnerability exists in GitList. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

Nascent RemKon Device Manager Remote Code Execution (CVE-2021-38613; CVE-2021-38611)

A remote code execution vulnerability exists in Nascent RemKon Device Manager. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

Mimosa PTP Devices Stored Cross Site Scripting (CVE-2020-25205)

A cross-site scripting vulnerability exists in Mimosa PTP Devices. Successful exploitation of this vulnerability would allow remote attackers to inject arbitrary web script into the affected system...

Microsoft Active Directory Certificate Services NTLM Relay (CVE-2021-36942; CVE-2022-26925)

An NTLM relay vulnerability exists in Microsoft Active Directory Certificate Services. A remote attack can coerce Windows hosts to authenticate to other machines via the MS-EFSRPC protocol and obtain its NTLM credential. Successful exploitation could lead to complete takeover of the target domain...

Invigo Automatic Device Management Remote Code Execution (CVE-2020-10580)

A remote code execution vulnerability exists in Invigo Automatic Device Management. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...