NTPsec ntpd ctl_getitem Out of Bounds Read (CVE-2019-6443)

An out of bounds read vulnerability has been reported in NTPsec ntpd. The vulnerability is due to insufficient validation of the length of a message in a NTP packet. A remote unauthenticated user can exploit this vulnerability by sending a crafted packet to the target server...

Zoho ManageEngine OpManager SQL Injection (CVE-2018-20173)

A SQL injection vulnerability exists in ManageEngine. This vulnerability is due to insufficient validation of parameters. Successful exploitation could lead to arbitrary SQL code execution...

Dovecot Out of Bounds Read (CVE-2017-14461)

An out of bounds read vulnerability exists in Dovecot IMAP server. This vulnerability is due to incorrect indexing of specially crafted emails. Successful exploitation may result in information disclosure or denial of service conditions...

IDenticard PremiSys Hardcoded Backdoor Account (CVE-2019-3906)

Hardcoded Backdoor Account exist in the IDenticard PremiSys . The vulnerability is due to service contains hardcoded credentials. Successful exploitation can allow admin access to the service via the Premisys WCF Service endpoint...

Rockwell Automation Allen-Bradley CompactLogix Cross-Site Scripting (CVE-2016-2279)

A cross site scripting vulnerability has been reported in Rockwell Scada System. The vulnerability is due to lack of sanitization of user supplied input data. A remote attacker can exploit this vulnerability to execute arbitrary HTML and script code in a browser session in the context of the...

Foxit Reader JavaScript XFA Use After Free (CVE-2018-3850)

A use after free vulnerability exists in Foxit Reader. This vulnerability is due to improper handling of freed JavaScript XML Forms Architecture objects...

Microsoft Edge and Internet Explorer Chakra Out of Bounds Read (CVE-2018-8145)

An out of bounds read vulnerability exists in Microsoft Edge. Successful exploitation of this vulnerability could allow a remote attacker to obtain sensitive information...

Microsoft Browser Scripting Engine Memory Corruption (CVE-2018-8288)

A memory corruption vulnerability exists in Microsoft Browser. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

Microsoft Word Memory Corruption (CVE-2018-0797)

An Office RTF remote code execution vulnerability exists in Microsoft Office software. The vulnerability is due to an error in the way the Office software handles RTF files. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user...

Microsoft Edge Scripting Engine Memory Corruption (CVE-2018-0777)

A remote code execution vulnerability has been reported in Microsoft Edge. The vulnerability is due to an Out-of-Bounds write in the JavaScript engine. A remote attacker can exploit this issue by enticing a victim to open a specially crafted web page that could cause memory corruption in a way th...

Microsoft Edge Scripting Engine Memory Corruption (CVE-2018-0774)

A remote code execution vulnerability exists in Microsoft Edge. The vulnerability is due to the way that the scripting engine handles objects in memory in Microsoft Edge. The vulnerability could corrupt memory in such a way that an attacker could execute arbitrary code in the context of the curre...

Symantec Messaging Gateway performRestore Command Injection (CVE-2017-6327)

A command injection vulnerability exists in Symantec Messaging Gateway. The cause of the vulnerability due to combination of an authentication bypass in LoginAction and a lack of sanitization on user input...

Microsoft Windows Kernel Information Disclosure (CVE-2017-0175)

An information disclosure vulnerability exists within Microsoft Windows. The vulnerability is caused when Microsoft Windows kernel improperly handles objects in memory. Successfully exploiting this vulnerability can result in Elevation-of-Privilege...

Rockwell Automation Logix Controller Stack Buffer Overflow (CVE-2016-9343)

A stack buffer overflow vulnerability exists in Rockwell Automation Logix Controllers. The vulnerability is due to insufficient bounds checking. A successful exploitation could lead to arbitrary code execution...

Microsoft Windows COM Elevation of Privilege (MS17-012: CVE-2017-0100)

An elevation of privilege vulnerability has been reported in Microsoft Windows. The vulnerability is due to an error in the way Windows COM session moniker enforces RunAs permissions when registering DCOM objects. A remote attacker can exploit this vulnerability to execute arbitrary code...

Microsoft Windows Uniscribe Remote Code Execution (MS16-147: CVE-2016-7274)

A remote code execution vulnerability exists in Microsoft Windows. The vulnerability is due to the way Windows Uniscribe handles objects in the memory. A remote attacker can exploit this vulnerability by enticing the target user to open a specially crafted ttf file...

DotNetNuke Administration Authentication Bypass (CVE-2015-2794)

An authentication bypass vulnerability exists in DotNetNuke. Successful exploitation of this vulnerability would allow remote attackers to gain access to sensitive information and gain unauthorized access into the affected system...

PHP ZIP Archive Heap Overflow (CVE-2016-3078)

A heap overflow vulnerability exists in PHP, due to an integer overflow when reading ZIP files. A remote attacker can exploit this vulnerability by sending a crafted ZIP archive to a web application running a vulnerable version of PHP. A successful attack can result in remote code execution under...

Redis Lua Scripting Component getnum Integer Overflow (CVE-2015-8080)

An integer overflow vulnerability has been reported in Redis. This vulnerability is due to the vulnerable server incorrectly parsing specific Lua scripts. A remote authenticated attacker can exploit this vulnerability by sending a specially crafted RESP message to the target server. Successful...

Advantech WebAccess AspVCObj.AspDataDriven ActiveX GetWideStrCpy Stack Buffer Overflow (CVE-2014-9208)

A stack buffer overflow vulnerability exists in Advantech's WebAccess SCADA software. The vulnerability is due to insufficient input validation of an argument to GetWideStrCpy in the AspVCObj.AspDataDriven ActiveX control. A remote, unauthenticated attacker can exploit this vulnerability by...

Oracle Database Client System Analyzer Arbitrary File Upload Code Execution (CVE-2010-3600)

A directory traversal and remote code-execution vulnerability exists in Oracle Database Server 11 and Enterprise Manager Grid Control 10. The vulnerability is found in a JSP application and permits a directory traversal. Successful exploit will allow a remote attacker to execute arbitrary code on...

Ca eTrust PestPatrol Antispyware ActiveX Buffer Overflow106 - Ver2 (CVE-2009-4225)

A buffer overflow vulnerability has been reported in Ca Etrust Pestpatrole Ppctl.dll Activex and Computer Associates eTrust PestPatrol. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system or cause application crashes...

FreePBX Framework Asterisk Recording Interface unserialize Code Execution (CVE-2014-7235)

A code execution vulnerability exists in FreePBX. The vulnerability is due to an input validation issue in the index.php file of the recordings directory...

SlimFTPd LIST Command Buffer Overflow (CVE-2005-2373)

A buffer overflow vulnerability exists in SlimFTPd server. The vulnerability is due to insufficient bounds verification on certain FTP service commands. A remote unauthenticated attacker can exploit this vulnerability by sending a specially crafted FTP LIST service command to the target server...

Joomla Component com_projectfork Local File Inclusion (CVE-2009-2100)

A file inclusion vulnerability has been reported in Joomlapraise Com Projectfork. Successful exploitation of this vulnerability would allow a remote attacker to list directories on the affected system...

Oracle Database Server Insecure User Input Stack Buffer Overflow (CVE-2013-3751)

A stack buffer overflow vulnerability has been reported in Oracle Database Server. The vulnerability is due to insufficient validation of user supplied input when parsing XML document data in a SQL/XML query. A remote, authenticated attacker could exploit this vulnerability by sending a malicious...

HP Universal CMDB Default Credentials Arbitrary File Upload (CVE-2014-2617)

A code execution vulnerability exists in HP Universal CMDB. The vulnerability is due to the use of hard-coded credentials when processing HTTP requests. A remote attacker can upload arbitrary files to arbitrary locations using the default credentials...

McAfee ePolicy Orchestrator Remote Code Execution (CVE-2013-0140; CVE-2013-0141)

A remote code execution vulnerability has been reported in McAfee ePolicy Orchestrator ePO. The vulnerability is due to an error in the ePO server that fails to properly sanitize user supplied data. A remote attacker can exploit this weakness to execute arbitrary code via a specially crafted http...

PoPToP PPTP Negative Read Overflow Buffer Overflow - Ver2 (CVE-2003-0213)

A buffer overflow vulnerability has been reported in Poptop Pptp Server. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system or cause application crashes...

Adobe Flash Player for Linux ActionScript ASnative Command Execution - Ver2 (CVE-2008-5499)

A command execution vulnerability has been reported in Adobe Flash Player. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...

EMC CMCNE FileUploadController Information Disclosure (CVE-2014-2276)

An information disclosure vulnerability has been reported in EMC Connectrix Manager Converged Network Edition. The vulnerability is due to insufficient input validation in the FileUploadController servlet when processing certain HTTP requests. A remote unauthenticated attacker can exploit this...

Microsoft XML Core Services DTD Cross-Domain Scripting (MS08-069) - Ver2 (CVE-2008-4029)

MSXML is an application for processing Extensible Stylesheet Language Transformation in an XML file that allows programmers to create high-performance XML-based applications. An information disclosure vulnerability has been reported in Microsoft XML Core Services MSXML. The vulnerability is due t...

VMware vCenter Chargeback Manager ImageUploadServlet Arbitrary File Upload (CVE-2013-3520)

An Arbitrary File Upload vulnerability has been reported in VMware vCenter Chargeback Manager...

ScadaTEC ScadaPhone and ModbusTagServer SCADA Remote Code Execution (CVE-2011-4535)

A stack buffer overflow vulnerability has been reported in ScadaTEC ScadaPhone and ModbusTagServer...

Irfanview JPEG2000 jp2 Stack Buffer Overflow (CVE-2012-0897)

A buffer overflow vulnerability has been reported in Irfanview JPEG2000 v4.3.2.0 jp2 QCD parsing...

Plixer Scrutinizer NetFlow and sFlow Analyzer HTTP Authentication Bypass (CVE-2012-2626)

An authentication bypass vulnerability has been reported in Plixer Scrutinizer NetFlow and sFlow Analyzer...

Ruby on Rails JSON Processor YAML Deserialization Code Execution (CVE-2013-0333)

A code execution vulnerability has been reported in Ruby on Rails. The vulnerability is due to an input validation error when JSON Processor deserializes YAML. A remote unauthenticated attacker can exploit this vulnerability to execute arbitrary code within the context of the underlying web serve...

Microsoft ASP.NET PKCS Padding Information Disclosure (MS10-070; CVE-2010-3332)

An information disclosure vulnerability has been reported in ASP.NET. This vulnerability is caused by ASP.NET providing web clients details in error messages when decrypting certain ciphertext. Successful exploitation of this vulnerability could allow the attacker to read and tamper with data. If...

Novell ZENworks Configuration Management PreBoot Opcode Buffer Overflow (CVE-2011-3176)

A stack buffer overflow vulnerability has been reported in Novell ZENworks Configuration Management...

Microsoft Windows Assembly Execution Vulnerability (MS12-005; CVE-2012-0013)

A remote code execution vulnerability has been reported in Microsoft Windows Packager...

Microsoft Office Web Components Arbitrary Code Execution (CVE-2009-1136)

A code execution vulnerability has been reported in Microsoft office web components. The vulnerability is due to insecure design of certain methods within ActiveX controls. A remote attacker may exploit this vulnerability by enticing a target user to open a malicious web-page. Successful...

CA Total Defense Suite UNCWS Multiple Report Stored Procedure SQL Injections (CVE-2011-1653)

CA Total Defense combines CA Anti-Virus, CA Anti-Spyware, CA Gateway Security and CA Host-Based Intrusion Prevention System. The unified network control UNC offers network access protection by validating endpoints requesting network access. Multiple SQL Injection vulnerabilities have been reporte...

Nullsoft Winamp MIDI Timestamp Stack Buffer Overflow (CVE-2010-4370)

Winamp is a popular multimedia player, produced by Nullsoft, which is capable of playing many formats of audio and video files. Winamp can play CD tracks, MP3 music files or MPEG video files, as well as numerous other formats. Among the audio files supported by Winamp are MIDI files and MUS files...

Novell iManager Tree Name Denial of Service (CVE-2010-1930)

Novell iManager is a web-based administration console that provides management of many other Novell products. The iManager service itself is a Java web application running on top of the Tomcat application container. A denial of service vulnerability exists in Novell iManager. The vulnerability is...

Internet Explorer HTML Tag Memory Corruption (MS06-013; CVE-2006-1188)

Microsoft Internet Explorer IE is the most widely used web browser application today. The browser is capable of processing HTML, scripting languages, and interpretation of various other popular Internet specifications. There are numerous versions of the HTML standard that are interpreted by the...

Oracle Database Server DBMS_EXPORT_EXTENSION Package Privilege Escalation (CVE-2006-2081)

Oracle Database Server is an enterprise-level relational database application suite. To extend the functionality of the Oracle Database Server, extra packages of related program objects are provided in order to better manage the data. The included stored procedures and functions, or subprograms,...

Macromedia JRun 4 mod_jrun Buffer Overflow (CVE-2004-0646)

Macromedia JRun is an application server used to deploy J2EE Java 2 Enterprise Edition applications, JSPs Java Server Pages, and other Java applications. It can be used as a stand-alone web server or can be accessed through other web servers including Apache. Apache can communicate with the JRun...

AOL Instant Messenger Away Message Buffer Overflow (CVE-2004-0636)

AOL Instant Messenger AIM is an instant messaging and presence computer program which allows registered users to communicate in real time. AOL Instant Messenger AIM registers itself as the handler of URL scheme aim. There exists a vulnerability in the way AOL Instant Messenger AIM parses an away...

Microsoft PowerPoint File Path Handling Buffer Overflow (MS10-004; CVE-2010-0029)

Microsoft PowerPoint is a popular graphics software for preparing slides and presentations. A remote code execution vulnerability has been identified in Microsoft PowerPoint. The vulnerability is due to a stack overflow in Microsoft PowerPoint when it tries to copy an overly long file name to a...

Update Protection against Sun Java System Application Server HTTP TRACE Vulnerability

Sun Java System Application Server 7 and 7 2004Q2 enables the HTTP TRACE method which can be leveraged by attackers to gain access to sensitive user information. The HTTP TRACE method returns the contents of client HTTP requests in the entity-body of the TRACE response. A local or remote...