Microsoft .NET XML Digital Signature Spoofing (MS13-040; CVE-2013-1336)

A spoofing vulnerability has been reported when the Microsoft .NET Framework fails to properly validate the signature of specially crafted XML files. Successful exploitation would allow an attacker to modify the contents of an XML file without invalidating the signature associated with the file...

Microsoft Windows RDP ActiveX Control Remote Code Execution (MS13-029; CVE-2013-1296)

A remote code execution vulnerability in the way the Remote Desktop ActiveX control, mstscax.dll, attempts to access an object in memory that has been deleted. An attacker could exploit this vulnerability by convincing the user to visit a specially crafted webpage. An attacker who successfully...

EMC AutoStart ftAgent.exe Multiple Integer Overflow Vulnerabilities (CVE-2012-0409)

Multiple buffer overflow vulnerabilities have been reported in EMC AutoStart...

IBM Lotus Notes URL Handler Command Execution (CVE-2012-2174)

A command execution vulnerability has been reported in IBM Lotus Notes...

Gimp Script-Fu Server Buffer Overflow (CVE-2012-2763)

A buffer overflow vulnerability has been reported in the Script-Fu scheme interpreter server component of GIMP...

Scada Modbus Incorrect Packet Length (CVE-2013-0662)

...

Novell iPrint Client GetDriverSettings Stack Buffer Overflow (CVE-2011-3173)

Novell iPrint Client is an application that allows users to install and manage printers, or submit print job from a web browser. Novell iPrint Client is bundled with a set of ActiveX controls that implement various functions. A stack buffer overflow exists in Novell iPrint Client. The vulnerabili...

Microsoft Office PowerPoint Legacy Files (CVE-2010-2572)

Microsoft PowerPoint is a popular graphics software for preparing slides and presentations. A remote attacker could exploit this issue via a malformed PowerPoint file. Successful exploitation of this vulnerability may allow execution of arbitrary code on a target system. The vulnerability is due ...

Microsoft MPEG Layer-3 Codecs Memory Corruption (MS10-052; CVE-2010-1882)

Microsoft DirectShow is used for streaming media on Microsoft Windows operating systems. A remote code execution vulnerability has been reported in the Microsoft DirectShow MP3 filter. The vulnerability is within the MPEG Layer-3 Audio Codec for Microsoft DirectShow l3codecx.ax. The Microsoft MPE...

Symantec Backup Exec System Recovery Manager Unauthorized File Upload (CVE-2008-0457)

Symantec Backup Exec System Recovery Manager is a complete, disk-based system recovery solution for Microsoft Windows based servers, desktops, and laptops that allows businesses to recover from system loss or disasters. A file upload vulnerability exists in the Symantec Backup Exec System Recover...

RSA Authentication Agent for Web Buffer Overflow (CVE-2005-1471)

The RSA Authentication Agent for Web for Internet Information Services IIS provides protection for selected web pages by securing them with the RSA SecurID authentication mechanism. When a user attempts to access a resource that is secured with the RSA SecurID, the RSA Agent authenticates the use...

Multiple Vendors AgentX receive_agentx Stack Buffer Overflow (CVE-2010-1318)

AgentX++ is a C++ object API written by Frank Fock. It is an implementation of the AgentX protocol which is used in multiple applications; including RealNetworks Helix Server and Helix Mobile Server. A stack buffer overflow vulnerability has been reported in multiple products that use the AgentX+...

UPX Compressed PE Executable Files (CVE-2005-2920)

ClamAV AntiVirus is an open source product that provides anti-virus scanning utilities and an anti-virus library. The product is capable of decoding several archive formats in order to scan their internal items for viruses. One of such archive formats is the UPX Ultimate Packer for eXecutables fi...

Oracle Database DBMS TNS Listener Denial of Service (CVE-2009-0991)

Oracle Database Server is an enterprise-level relational database application suite. To extend the functionality of the Oracle Database Server, extra packages of related program objects, e.g., procedures, functions, variables, constants, cursors, and exceptions, are provided in order to better...

Borland StarTeam Multicast Service HTTP Handling Buffer Overflow (CVE-2008-0311)

StarTeam is a revision control and SCM software system, originally produced by Starbase Corporation, and acquired by Borland in 2003. The system is backed by a relational database, that retains all changes made to a project during its evolution. Borland StarTeam can be installed as a component of...

Ipswitch IMail Server SMTP Service Buffer Overflow (CVE-2006-4379)

The Ipswitch IMail Server is a mail server product geared towards medium to large size organizations. It contains implementations of POP3, IMAP4, and SMTP servers. The SMTP server module is installed and started in a default installation. There exists a vulnerability in the SMTP module of the...

Microsoft IIS ASP Scripts Source Code Disclosure (CVE-2005-2678)

The Internet Information Server IIS is a Web server packaged with several versions of the Windows operating system. The server is capable of serving static, as well as dynamic content. The server is equipped with the Active Server Pages ASP technology which is utilized for dynamic content...

IBM Lotus Sametime Server Multiplexer Stack Buffer Overflow (CVE-2008-2499)

IBM Lotus Sametime is an enterprise instant messaging and web conferencing application created by the Lotus Software division of IBM. Lotus Sametime provides enterprise instant messaging functionality, presence information, and web conferencing using standard protocols. The Lotus Sametime server...

Microsoft Excel TXO and OBJ Records Parsing Memory Corruption (MS08-074; CVE-2008-4265; CVE-2009-0100)

Microsoft Excel is a popular spreadsheet application. A remote code execution vulnerability has been identified in the Microsoft Excel. The vulnerability is due to a memory corruption error in Microsoft Excel when loading Excel records. An attacker can exploit this flaw to execute arbitrary code ...

Oracle Secure Backup NDMP CONNECT_CLIENT_AUTH Command Buffer Overflow (CVE-2008-5444)

Oracle Database Server is an enterprise-level relational database application suite. Oracle Secure Backup is a backup solution allowing for single point of management of data present on network attached storage NAS devices and distributed hosts. Oracle Secure Backup is using NDMP protocol to...

Preemptive Protection against Sun Solaris sadmind Buffer Overflow Vulnerability

A vulnerability was reported in Sun Solaris Solstice AdminSuite daemon sadmind. Solstice AdminSuite is a set of applications for distributed system administration. sadmind is a daemon used by SolsticeAdminsuite to control the servers running Sun Solaris operating system. One of the sadmind...

Update IPS-1 with a Protection against Apple QuickTime and Apple QuickDraw Vulnerabilities

Several vulnerabilities have been identified within various versions of Apple QuickTime and Apple QuickDraw that, if exploited, would allow a remote attacker to execute arbitrary code on a vulnerable system...

Internet Explorer VML Rect Fill Method Buffer Overflow (MS06-055; CVE-2006-4868)

Microsoft Internet Explorer is the most widely used Internet browser. Microsoft Internet Explorer fails to handle Vector Markup Language VML tags. VML is a set of XML tags for drawing vector graphics. A remote attacker may trigger this vulnerability to execute arbitrary code on the target system...

Oracle MySQL Cluster Remote Code Execution (CVE-2022-21490)

A remote code execution vulnerability exists in Oracle MySQL Cluster. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

Acrontum Filesystem-Template Package Command Injection (CVE-2022-21186)

A command injection vulnerability exists in Acrontum Filesystem-Template package. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...

Pixelimity Arbitrary File Upload (CVE-2022-28590)

An arbitrary file upload vulnerability exists in Pixelimity. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

TOTOLink 720R Command Injection (CVE-2022-38534; CVE-2022-38535)

A command injection vulnerability exists in TOTOLink 720R. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...

Microsoft Windows Scripting Languages Remote Code Execution (CVE-2022-41118)

A remote code execution vulnerability exists in Microsoft Windows. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

Selenium Grid Cross-Site Request Forgery (CVE-2022-28108)

A cross-site request forgery vulnerability exists in Selenium Grid. Successful exploitation of this vulnerability could result in code execution on the affected system...

ShopWind Remote Code Execution (CVE-2022-30453)

A remote code execution vulnerability exists in ShopWind. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

Citrix SD-WAN SQL Injection (CVE-2019-12989)

An SQL injection vulnerability exists in Citrix SD-WAN. Successful exploitation of this vulnerability could result in the execution of arbitrary SQL statements on the affected system...

WordPress LearnPress Plugin Cross-Site Scripting (CVE-2021-39348)

A stored cross-site scripting vulnerability exists in LearnPress Plugin for WordPress. The vulnerability is due to insufficient sanitization of user-supplied data in Profile Settings page...

Millken Doyocms SQL Injection (CVE-2021-26739)

An SQL injection vulnerability exists in Millken Doyocms. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system...

Millken Doyocms Arbitrary File Upload (CVE-2021-26740)

An arbitrary file upload vulnerability exists in Millken Doyocms. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

Draytek VigorConnect Arbitrary File Upload (CVE-2021-20125)

An arbitrary file upload vulnerability exists in Draytek VigorConnect. Successful exploitation of this vulnerability could allow an unauthenticated attacker to upload arbitrary files to the affected system...

TOTOLINK Technology Router Authentication Bypass (CVE-2021-35327)

An authentication bypass vulnerability exists in TOTOLINK Technology Router. Successful exploitation of this vulnerability would allow remote attackers to gain unauthorized access into the affected system...

Xymon xymond Remote Code Execution (CVE-2016-2056)

A remote code execution vulnerability exists in Xymon xymond. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...

WordPress Core Cross Site Scripting (CVE-2019-16223)

A cross site scripting vulnerability exists in WordPress Core. Successful exploitation of this vulnerability would allow remote attackers to inject an arbitrary web script into the affected system...

MantisBT SQL Injection (CVE-2020-28413)

An SQL injection vulnerability exists in MantisBT. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system...

PHP Arbitrary File Upload (CVE-2020-12255; CVE-2020-23828)

Malicious PHP files can be uploaded to a server due to improper validation. Successful exploitation could result in execution of arbitrary code on the target system...

Apache Dubbo Remote Code Execution (CVE-2020-1948)

A remote code execution vulnerability exists in Apache Dubbo. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

Rasilient PixelStor Remote Code Execution (CVE-2020-6756)

A remote code execution vulnerability exists in Rasilient PixelStor. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

Nitro Pro PDF Use After Free (CVE-2020-6074)

A use-after-free vulnerability exists in Nitro Pro PDF. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

Elasticsearch MachineLearning XML External Entities (CVE-2018-17247)

An XML external entities vulnerability exists in Machine Learning's findfilestructure API. If a policy allowing external network access has been added to Elasticsearch's Java Security Manager then an attacker could send a specially crafted request capable of leaking content of local files on the...

Microsoft VBScript Remote Code Execution (CVE-2020-1403)

A remote code execution vulnerability exists in Microsoft Windows. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

Pandora FMS Persistent Cross-Site Scripting (CVE-2020-13853)

A persistent cross site scripting vulnerability exists in Pandora FMS. Successful exploitation of this vulnerability would allow remote attackers to inject an arbitrary web script into the affected system...

Comtrend Command Injection (CVE-2020-10173)

A command injection vulnerability exists in Comtrend. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

Terramaster TOS Cross Site Scripting (CVE-2018-13334; CVE-2018-13335; CVE-2018-13357)

A cross site scripting exists in Terramaster TOS. Successful exploitation of this vulnerability would allow remote attackers to inject an arbitrary web script into the affected system...

Zoho ManageEngine Applications Manager SQL Injection (CVE-2019-11448)

A SQL injection vulnerability exists in Zoho ManageEngine Applications Manager. The vulnerability is due to improper validation of user-supplied input in PopupSLA.jsp. Successful exploitation could lead to arbitrary SQL code execution...

WECON LeviStudio Buffer Overflow (CVE-2019-6537)

A stack-based buffer overflow vulnerability exists in WECON LeviStudio DataLogTool. The vulnerability is due to improper validation of the length of user-supplied data prior to copying it to a fixed-length stack-based buffer. Successful exploitation could allow the attacker to execute arbitrary...