Advantech WebAccess HMI Designer Buffer Overflow (CVE-2021-33000)

A buffer overflow vulnerability exists in the project management file parsing component of Advantech WebAccess HMI Designer. The vulnerability is due to lack of proper validation while processing user supplied NMultistateLamp object data...

Sourcecodester Online Event Booking and Reservation System SQL Injection (CVE-2021-42667)

An SQL injection vulnerability exists in Sourcecodester Online Event Booking and Reservation System. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system...

Feehi CMS Remote Code Execution (CVE-2020-21322)

A remote code execution vulnerability exists in Feehi CMS. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

F5 BIG-IQ Command Injection (CVE-2021-23024)

A command injection vulnerability exists in F5 BIG-IQ. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...

Xiaomi Mi WiFi R3G Remote Code Execution (CVE-2019-18370)

A remote code execution vulnerability exists in Xiaomi Mi WiFi R3G. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

Web Servers Buffer Overflow Attempt (CVE-2020-3119; CVE-2020-3120; CVE-2020-3172; CVE-2020-8450)

A buffer overflow vulnerability can be exploited by sending a parameter with size larger than can be stored in a buffer. Successful exploitation could result in execution of arbitrary code on the target system or denial of service conditions...

Furukawa Electric ConsciusMAP Insecure Deserialization (CVE-2020-12133)

An insecure deserialization vulnerability exists in Furukawa Electric ConsciusMAP. A successful attack could result in the execution of arbitrary code on the affected system...

Fortify Software Security Center Command Injection (CVE-2018-12463)

A command injection vulnerability exists in Fortify Security Center. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...

Elasticsearch Privilege Escalation (CVE-2020-7009)

A privilege escalation vulnerability exists in Elasticsearch. An attacker who is able to generate an API key can perform a series of steps that result in an API key being generated with elevated privileges...

Citrix ADC Reflected Cross Site Scripting (CVE-2020-8191)

A reflected cross-site scripting vulnerability exists in Citrix ADC and Citrix gateway. The vulnerability is due to insufficient input validation in the web-based management interface. Successful exploitation could result in execution of arbitrary scripts on the affected system...

Microsoft SQL Server Management Studio Information Disclosure (CVE-2019-1313)

An information disclosure vulnerability exists in microsoft sql server management studio. Successful exploitation of this vulnerability would allow a remote attacker to obtain sensitive information...

Cisco UCS Director Directory Traversal (CVE-2020-3250)

A directory traversal vulnerability exists in Cisco UCS Director. The vulnerability is due to insufficient validation of user input within the processing of the userAPIDownloadFile API...

Oracle E-Business Suite SQL Injection (CVE-2020-2586; CVE-2020-2587)

An SQL injection vulnerability exists in Oracle E-Business Suite. Successful exploitation of this vulnerability could result in the execution of arbitrary SQL statements with the privileges of the APPS database user...

WordPress Code Snippets Plugin Cross Site Request Forgery (CVE-2020-8417)

A cross site request forgery vulnerability exists in WordPress Code Snippets plugin. Successful exploitation of this vulnerability can result in the execution of arbitrary code on the affected system...

Microsoft Edge Chakra Scripting Engine Memory Corruption (CVE-2019-1308)

A memory corruption vulnerability exists in Microsoft Edge. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

Pulse Connect Secure Remote Code Execution (CVE-2019-11539)

A remote code execution vulnerability exists in Pulse Connect Secure. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

Schneider Electric Pelco Endura Authentication Bypass (CVE-2019-6814)

An authentication bypass vulnerability exists in Schneider Electric Pelco Endura. This allows remote attackers to perform administrative actions without authentication...

Microsoft Edge Chakra Scripting Engine Memory Corruption (CVE-2019-1103)

...

Microsoft Outlook Security Feature Bypass (CVE-2017-11774)

...

VMware Fusion Remote Code Execution (CVE-2019-5514)

A remote code execution vulnerability exists in VMware Fusion. Successful exploitation could lead to arbitrary code execution...

Rockwell Automation Multiple Controllers Open Redirect (CVE-2019-10955)

An open redirect vulnerability exists in Rockwell Automation MicroLogix and CompactLogix controllers. A remote unauthenticated attacker could exploit this vulnerability to redirect users to a malicious site via a malicious link...

ASUS HG100 Devices Denial of Service (CVE-2018-11492)

A denial-of-service vulnerability exists in ASUS HG100 devices. Successful exploitation of this vulnerability would allow a remote attacker to create a denial of service condition on the affected system...

XAMPP cds-fpdf.php Multiple Vulnerabilities (CVE-2019-8923; CVE-2019-8924)

SQL injection and Cross-site scripting vulnerabilities exist in XAMPP. Successful exploitation of these vulnerabilities would allow remote attackers to inject SQL commands or arbitrary web script into the affected system...

WordPress WooCommerce Plugin Authentication Bypass (CVE-2018-20782)

An authentication bypass exists in WordPress WooCommerce Plugin. The vulnerability is due to insufficient data verification and lack of any cryptographic authentication. A remote attacker can exploit this vulnerability by sending a specially crafted HTTP request...

Microsoft Internet Explorer Remote Code Execution (CVE-2018-8619)

A remote code execution vulnerability exists in Microsoft Internet Explorer. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

Linksys ESeries OS Command Injection (CVE-2018-3953; CVE-2018-3954; CVE-2018-3955)

A command injection vulnerability exists in the Linksys E Series line of routers. An attacker can exploit these bugs by sending an authenticated HTTP request to the network configuration service. An attacker could then gain the ability to arbitrarily execute code on the machine...

Quagga aspath_put BGP Session Drop Denial of Service (CVE-2017-16227)

A denial-of-service vulnerability exists in Quagga. The vulnerability is due to an improper calculation of ASPATH. A remote attacker can exploit this vulnerability by sending a specially crafted request to the affected service. Successful exploitation would cause the target to crash, resulting in...

PowerDNS Recursor Improper Parameter Handling Remote Code Execution (CVE-2017-15092)

A remote code execution vulnerability exists in PowerDNS. The vulnerability is due to insufficient user input validation of a DNS query.A remote attacker can exploit this weakness to execute arbitrary code in the affected DNS server...

PHP Core timelib_meridian Heap Buffer Overflow (CVE-2017-16642)

A heap-based buffer overflow vulnerability exists in PHP core function timelibmeridian. The vulnerability is due to improper validation of user input. A remote attacker can exploit the vulnerability by sending a crafted request with a malformed time attribute...

Microsoft Edge Scripting Engine Memory Corruption (CVE-2017-8670)

A remote code execution Vulnerability exists in Microsoft Edge. The vulnerability is due to the way JavaScript engine renders when handling objects in memory. A remote unauthenticated attacker could exploit this vulnerability by enticing the target user to open a specially crafted web page...

IBM Informix Dynamic Server index.php testconn Heap Buffer Overflow (CVE-2017-1092)

A heap buffer overflow exists in IBM's Informix Dynamic Server and Informix Open Admin Tool. The vulnerability is due an input validation error when processing requests sent to index.php. A remote, unauthenticated attacker can exploit this vulnerability by sending a crafted request...

Mantis Bug Tracker verify.php confirm_hash Remote Password Reset (CVE-2017-7615)

A remote password reset vulnerability exists in Mantis Bug Tracker. The vulnerability is due to a lack of input validation on the confirmhash parameter when verifying password reset requests. A remote, unauthenticated attacker can exploit this vulnerability by sending a crafted HTTP request to th...

Microsoft Office DLL Loading (CVE-2017-0197)

A remote code execution vulnerability exists in Microsoft Office. The vulnerability is caused due to an incorrect link to a dynamic-link library file. A remote attacker can exploit this issue by enticing a victim to open a specially crafted file which will lead to arbitrary code execution...

NETGEAR Routers Authentication Bypass (CVE-2017-5521)

An authentication bypass vulnerability exists in Multiple NETGEAR Routers. Successful exploitation of this vulnerability would allow remote attackers to obtain sensitive information and gain unauthorized access into the affected system...

WordPress CM Download Manager Code Injection (CVE-2014-8877)

Content Management Download Manager for WordPress is prone to remote PHP-code execution vulnerability because it fails to validate user input. An attacker can exploit this issue to execute arbitrary PHP code within the context of the web server. This may aid in further attacks or lead to a full...

Imagemagick Compressed TIFF File Conversion Remote Code Execution (CVE-2016-8707)

An out-of-bounds write vulnerability exists in ImageMagick's convert utility. The vulnerability is due to improper handling of TIFF image data when deflating an Adobe Deflate compressed TIFF image. A remote attacker could exploit this vulnerability by providing a specially crafted TIFF image to a...

Microsoft Works and Office WkImgSrv.dll ActiveX Control Code Execution (CVE-2008-1898)

A vulnerability has been reported in Microsoft Works 7 and Microsoft Office 2003 and 2007. The vulnerability is due to a boundary error while handling an overly large argument. A remote attacker can exploit this issue by enticing a target victim to open a specially crafted web page that would pas...

Microsoft Windows ATMFD.DLL Elevation of Privilege (MS16-074: CVE-2016-3220)

An out of bound memory access vulnerability exists in Microsoft Windows ATMFD.DLL. The root cause is within atmfd.dll sub components that miscalculate indices to an array when dealing with a specially crafted ttf file. A successful exploitation could allow an attacker to run arbitrary code with...

Unitronics VisiLogic OPLC TeeChart ActiveX RemoveSeries Out of Bounds Array Indexing (CVE-2015-6478)

An out of bounds array indexing vulnerability exists in Unitronics VisiLogic OPLC. The vulnerability is due to use of user supplied value to calculate array index in the RemoveSeries method of the TeeChart.TChart ActiveX control. A remote attacker could exploit this vulnerability by enticing a...

Wordpress simple-ads-manager Information Disclosure (CVE-2015-2826)

An information disclosure vulnerability has been reported in "Wordpress simple-ads-manager plug-in". The vulnerability is due to improper sanitizing of the sam-ajax-admin.php script. Successful exploitation will allow a remote attacker to reveal the user's sensitive information...

Lexmark MarkVision Enterprise GfdFileUploadServlet Directory Traversal - Ver2 (CVE-2014-8741)

A directory traversal vulnerability exists in Lexmark MarkVision Enterprise. The vulnerability is due to an input validation issue when processing user supplied data used for writing files to the system by the GfdFileUploadServlet servlet. A remote unauthenticated attacker could exploit this...

Microsoft DirectShow MPEG 3 Channel Mode Memory Corruption - Ver2 (CVE-2010-1882)

A memory corruption vulnerability has been reported in Microsoft Windows XP, Microsoft Windows Server 2003 x64 64-bit and Microsoft Windows Server 2003. An attacker could exploit this vulnerability via an MPEG Layer-3 audio stream in a crafted media file or crafted streaming content. Successful...

Microsoft DLL Planting Remote Code Execution (MS15-020; CVE-2015-0096)

A remote code execution vulnerability has been reported in Microsoft Windows . The vulnerability is due to an error in the way Microsoft Windows improperly handles the loading of DLL files. A remote attacker can exploit this issue by enticing a user to open a specially crafted file...

Microsoft Windows SMB Security Feature Bypass (MS15-014; CVE-2015-0009)

A security feature bypass vulnerability exists in Microsoft Windows. The vulnerability is due to the way Group Policy settings are applied when SMB signing failures occur. An attacker can exploit this vulnerability by a man-in-the-middle attack that modifies domain controller responses to client...

Internet Explorer Same Origin Policy Bypass (CVE-2015-0072)

A same-origin policy bypass vulnerability has been reported in Microsoft Internet Explorer. A remote, unauthenticated attacker can exploit this vulnerability by enticing a user to open a web page. Successful exploitation can result in the disclosure of information about other web pages opened by...

Microsoft Windows Kerberos KDC Elevation of Privilege (MS14-068; CVE-2014-6324)

A remote elevation of privilege vulnerability has been reported in Microsoft Windows Kerberos KDC. The vulnerability is due to improper validation of signatures in the Kerberos ticket. A remote attacker could use these elevated privileges to compromise any computer in the domain, including domain...

DotNetNuke DNNArticle Module SQL Injection (CVE-2013-5117)

TODO...

op5 Monitor license.php Remote Command Execution (CVE-2012-0261)

A command execution vulnerability has been reported in op5 Monitor. The vulnerability is due to an input validation flaw related to the system-op5config component. A remote attacker can exploit this vulnerability to execute arbitrary shell commands via command injection...

Apache Struts ParametersInterceptor ClassLoader Security Bypass (CVE-2014-0094; CVE-2014-0112; CVE-2014-0113; CVE-2014-0114)

A security bypass vulnerability exists in Apache Struts. The vulnerability is due to inadequate validation of data processed by ParametersInterceptor allowing for manipulation of the ClassLoader. A remote attacker could exploit this vulnerability by providing a class parameter in a request...

Microsoft Windows File Handling Component Remote Code Execution (MS14-019; CVE-2014-0315)

A remote code execution vulnerability has been reported in Microsoft Windows. The vulnerability is caused by Windows improperly restricting the path used for processing .bat and .cmd files. A remote attacker could trigger this flaw by placing a malicious executable in the working directory e.g. a...