Microsoft Windows Server Service RPC Request Buffer Overflow (MS08-067; CVE-2008-4250)

Microsoft Server Service provides support for Remote Procedure Call RPC, resource sharing, and named pipe communication over the network. A remote code execution vulnerability has been discovered in Microsoft Windows Server Service. The vulnerability is due to an error in the Server service that...

Preemptive Protection against Oracle WebLogic Server Apache Connector HTTP Version String Buffer Vulnerability

A string buffer overflow vulnerability has been reported in Oracle BEA WebLogic Server Apache Connector. BEA WebLogic Server is a Java Application Server platform that supports various databases including Oracle. A remote attacker may exploit this vulnerability to execute arbitrary code on a...

IPS-1 Updates against Adobe, Microsoft Windows, Microsoft DirectShow and OpenOffice.org Vulnerabilities

Vulnerabilities in versions of Adobe, Microsoft Windows, Microsoft DirectShow and OpenOffice.org would, if exploited, might allow remote or local attackers to execute arbitrary code on a vulnerable system...

Borland Interbase Database Service Create-Request Buffer Overflow (CVE-2007-3566)

Borland InterBase is a SQL-92 compliant relational database management system for Linux, Microsoft Windows, and Solaris operating systems. A buffer overflow vulnerability has been reported in Borland InterBase. The vulnerability is due to a boundary error in Borland InterBase that fails to proper...

Microsoft Excel Version Information Handling Code Execution (MS07-036; CVE-2007-1756; CVE-2007-3030; CVE-2008-0081)

Microsoft Excel is a popular spreadsheet application. Multiple vulnerabilities have been identified in Microsoft Excel. A remote attacker could exploit these issues via a malformed Excel file. Successful exploitation of these vulnerabilities may allow execution of arbitrary code on a target syste...

Update Protection against Microsoft Internet Explorer Memory Corruption Vulnerabilities (MS06-042)

Microsoft Internet Explorer is prone to multiple memory corruption vulnerabilities. The application fails to properly handle un-initialized COM objects and chained Cascading Style Sheets CSS. This flaw allows attackers to cause denial of service and possibly to execute arbitrary code by convincin...

TP-Link TL-WR840N Command Injection (CVE-2022-25064)

A command injection vulnerability exists in TP-Link TL-WR840N. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...

ZEROF Web Server SQL Injection (CVE-2022-25322)

An SQL injection vulnerability exists in ZEROF Web Server. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system...

Rails Remote Code Execution (CVE-2020-8163)

A remote code execution vulnerability exists in Rails. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

Advantech iView SQL Injection (CVE-2022-2136)

A SQL injection vulnerability exists for Advantech iView. This vulnerability is due to improper input validation for the ipaddress parameter during the updatePROMFile process...

Adobe ColdFusion Improper Input Validation (APSB22-44: CVE-2022-42340)

An improper input validation vulnerability exists in Adobe ColdFusion. Successful exploitation of this vulnerability could allow a remote attacker to damage users system...

Citrix NetScaler SD-WAN Remote Code Execution (CVE-2017-6316)

A remote code execution vulnerability exists in Citrix NetScaler SD-WAN. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

Feehi CMS Remote Code Execution (CVE-2020-21322)

A remote code execution vulnerability exists in Feehi CMS. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

Netgear R6020 Command Injection (CVE-2021-41383)

A command injection vulnerability exists in Netgear R6020. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...

F5 BIG-IQ Command Injection (CVE-2021-23024)

A command injection vulnerability exists in F5 BIG-IQ. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...

Xiaomi Mi WiFi R3G Remote Code Execution (CVE-2019-18370)

A remote code execution vulnerability exists in Xiaomi Mi WiFi R3G. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

Teachers Record Management System SQL Injection (CVE-2021-26822)

An SQL injection vulnerability exists in Teachers Record Management System. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system...

Web Servers Buffer Overflow Attempt (CVE-2020-3119; CVE-2020-3120; CVE-2020-3172; CVE-2020-8450)

A buffer overflow vulnerability can be exploited by sending a parameter with size larger than can be stored in a buffer. Successful exploitation could result in execution of arbitrary code on the target system or denial of service conditions...

CactuShop invoice.asp Cross-Site Scripting (CVE-2010-1486)

A cross-site scripting vulnerability exists in Cactushop cactushop 3. Successful exploitation of this vulnerability would allow remote attackers to inject arbitrary web script into the affected system...

Furukawa Electric ConsciusMAP Insecure Deserialization (CVE-2020-12133)

An insecure deserialization vulnerability exists in Furukawa Electric ConsciusMAP. A successful attack could result in the execution of arbitrary code on the affected system...

Elasticsearch Privilege Escalation (CVE-2020-7009)

A privilege escalation vulnerability exists in Elasticsearch. An attacker who is able to generate an API key can perform a series of steps that result in an API key being generated with elevated privileges...

Citrix ADC Reflected Cross Site Scripting (CVE-2020-8191)

A reflected cross-site scripting vulnerability exists in Citrix ADC and Citrix gateway. The vulnerability is due to insufficient input validation in the web-based management interface. Successful exploitation could result in execution of arbitrary scripts on the affected system...

Cisco UCS Director Directory Traversal (CVE-2020-3250)

A directory traversal vulnerability exists in Cisco UCS Director. The vulnerability is due to insufficient validation of user input within the processing of the userAPIDownloadFile API...

WordPress Code Snippets Plugin Cross Site Request Forgery (CVE-2020-8417)

A cross site request forgery vulnerability exists in WordPress Code Snippets plugin. Successful exploitation of this vulnerability can result in the execution of arbitrary code on the affected system...

Adobe Flash Player Use After Free (APSB19-46: CVE-2019-8070)

A use-after-free vulnerability exists in Adobe Flash Player. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

Schneider Electric Pelco Endura Authentication Bypass (CVE-2019-6814)

An authentication bypass vulnerability exists in Schneider Electric Pelco Endura. This allows remote attackers to perform administrative actions without authentication...

Microsoft Edge Chakra Scripting Engine Memory Corruption (CVE-2019-1103)

...

Microsoft Outlook Security Feature Bypass (CVE-2017-11774)

...

VMware Fusion Remote Code Execution (CVE-2019-5514)

A remote code execution vulnerability exists in VMware Fusion. Successful exploitation could lead to arbitrary code execution...

Rockwell Automation Multiple Controllers Open Redirect (CVE-2019-10955)

An open redirect vulnerability exists in Rockwell Automation MicroLogix and CompactLogix controllers. A remote unauthenticated attacker could exploit this vulnerability to redirect users to a malicious site via a malicious link...

ASUS HG100 Devices Denial of Service (CVE-2018-11492)

A denial-of-service vulnerability exists in ASUS HG100 devices. Successful exploitation of this vulnerability would allow a remote attacker to create a denial of service condition on the affected system...

XAMPP cds-fpdf.php Multiple Vulnerabilities (CVE-2019-8923; CVE-2019-8924)

SQL injection and Cross-site scripting vulnerabilities exist in XAMPP. Successful exploitation of these vulnerabilities would allow remote attackers to inject SQL commands or arbitrary web script into the affected system...

WordPress WooCommerce Plugin Authentication Bypass (CVE-2018-20782)

An authentication bypass exists in WordPress WooCommerce Plugin. The vulnerability is due to insufficient data verification and lack of any cryptographic authentication. A remote attacker can exploit this vulnerability by sending a specially crafted HTTP request...

Zoho ManageEngine OpManager SQL Injection (CVE-2018-20173)

A SQL injection vulnerability exists in ManageEngine. This vulnerability is due to insufficient validation of parameters. Successful exploitation could lead to arbitrary SQL code execution...

Linksys ESeries OS Command Injection (CVE-2018-3953; CVE-2018-3954; CVE-2018-3955)

A command injection vulnerability exists in the Linksys E Series line of routers. An attacker can exploit these bugs by sending an authenticated HTTP request to the network configuration service. An attacker could then gain the ability to arbitrarily execute code on the machine...

Microsoft Edge Chakra Scripting Engine Memory Corruption (CVE-2018-8467)

A memory corruption vulnerability exists in Microsoft Edge. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

WellinTech KingView Buffer Overflow - Ver2 (CVE-2011-0406; CVE-2012-1830)

A buffer overflow vulnerability exists in WellinTech KingView. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system or cause application crashes...

Quagga aspath_put BGP Session Drop Denial of Service (CVE-2017-16227)

A denial-of-service vulnerability exists in Quagga. The vulnerability is due to an improper calculation of ASPATH. A remote attacker can exploit this vulnerability by sending a specially crafted request to the affected service. Successful exploitation would cause the target to crash, resulting in...

PowerDNS Recursor Improper Parameter Handling Remote Code Execution (CVE-2017-15092)

A remote code execution vulnerability exists in PowerDNS. The vulnerability is due to insufficient user input validation of a DNS query.A remote attacker can exploit this weakness to execute arbitrary code in the affected DNS server...

IBM Informix Dynamic Server index.php testconn Heap Buffer Overflow (CVE-2017-1092)

A heap buffer overflow exists in IBM's Informix Dynamic Server and Informix Open Admin Tool. The vulnerability is due an input validation error when processing requests sent to index.php. A remote, unauthenticated attacker can exploit this vulnerability by sending a crafted request...

Imagemagick Compressed TIFF File Conversion Remote Code Execution (CVE-2016-8707)

An out-of-bounds write vulnerability exists in ImageMagick's convert utility. The vulnerability is due to improper handling of TIFF image data when deflating an Adobe Deflate compressed TIFF image. A remote attacker could exploit this vulnerability by providing a specially crafted TIFF image to a...

Nuuo NVR Log Parameter Unauthenticated Remote Code Execution (CVE-2016-5674)

A remote code execution was discovered in Nuuo Network Video Recording systems with Network Attached Storage. The vulnerability is due to Improper Input Validation in log parameter. An unauthenticated attacker may use this vulnerability to execute code on the vulnerable server...

Unitronics VisiLogic OPLC TeeChart ActiveX RemoveSeries Out of Bounds Array Indexing (CVE-2015-6478)

An out of bounds array indexing vulnerability exists in Unitronics VisiLogic OPLC. The vulnerability is due to use of user supplied value to calculate array index in the RemoveSeries method of the TeeChart.TChart ActiveX control. A remote attacker could exploit this vulnerability by enticing a...

Wordpress simple-ads-manager Information Disclosure (CVE-2015-2826)

An information disclosure vulnerability has been reported in "Wordpress simple-ads-manager plug-in". The vulnerability is due to improper sanitizing of the sam-ajax-admin.php script. Successful exploitation will allow a remote attacker to reveal the user's sensitive information...

Microsoft Windows DNS Server Spoofing - Ver2 (CVE-2007-3898)

There exits a vulnerability in Microsoft Windows DNS Server. The flaw is caused by predictable transaction identifiers in DNS requests generated. A remote attacker may leverage this vulnerability to use spoofed DNS responses to poison the DNS cache on the target system...

Lexmark MarkVision Enterprise GfdFileUploadServlet Directory Traversal - Ver2 (CVE-2014-8741)

A directory traversal vulnerability exists in Lexmark MarkVision Enterprise. The vulnerability is due to an input validation issue when processing user supplied data used for writing files to the system by the GfdFileUploadServlet servlet. A remote unauthenticated attacker could exploit this...

Microsoft Windows Kerberos KDC Elevation of Privilege (MS14-068; CVE-2014-6324)

A remote elevation of privilege vulnerability has been reported in Microsoft Windows Kerberos KDC. The vulnerability is due to improper validation of signatures in the Kerberos ticket. A remote attacker could use these elevated privileges to compromise any computer in the domain, including domain...

OpenSIS ajax.php modname Code Execution (CVE-2013-1349)

A remote code execution vulnerability has been reported in OpenSIS. The vulnerability is due to insufficient validation of modname parameter while parsing requests to ajax.php module. A remote attacker can exploit this vulnerability by sending a specially crafted request to the vulnerable server...

Microsoft Windows File Handling Component Remote Code Execution (MS14-019; CVE-2014-0315)

A remote code execution vulnerability has been reported in Microsoft Windows. The vulnerability is caused by Windows improperly restricting the path used for processing .bat and .cmd files. A remote attacker could trigger this flaw by placing a malicious executable in the working directory e.g. a...

Veritas Backup Exec Server Remote Registry Access Code Execution - Ver2 (CVE-2005-0771)

A code execution vulnerability has been reported in Veritas Backup Exec Server. Successful exploitation of this vulnerability could allow a remote attacker to modify the registry and execute arbitrary methods via RPC on the affected system...