Microsoft Graphics Filters TIFF Image Converter Buffer Overflow (MS10-105; CVE-2010-3949; CVE-2010-3950)

Tagged Image File Format TIFF is a container format for storing images, including photographs and line art. A buffer overflow vulnerability has been discovered in the way that Microsoft Office parses specially crafted TIFF image files. The vulnerability is due to an error in Microsoft Office TIFF...

Microsoft IIS Directory Authentication Bypass (MS10-065; CVE-2010-1899; CVE-2010-2731)

IIS is a collection of Internet services packaged with several versions of the Windows operating system. An elevation of privilege vulnerability has been reported in Microsoft Internet Information Services IIS. The vulnerability is due to the way IIS parses specially crafted URLs. An attacker may...

Novell iManager eDirectory Plugin Schema Buffer Overflow (CVE-2009-4486)

A stack buffer overflow vulnerability exists in the Novell iManager eDirectory plugin. The vulnerability is due to improper validation of user input by a sub-application. A remote, authenticated attacker can exploit this vulnerability by sending specially crafted parameters to the application...

Microsoft Windows RRAS Memory Corruption (CVE-2006-2370)

Microsoft Remote Access Connection Manager service, RASMAN, provides the functionality to remotely configure and manage various services. One such service that can be managed remotely is the Routing and Remote Access Service, RRAS. Routing and Remote Access Service makes it possible for a compute...

Adobe Photoshop CS4 ABR File Processing Buffer Overflow (APSB10-13; CVE-2010-1296)

Adobe Photoshop CS4 is a graphics editing program that features a 3D engine. A buffer overflow vulnerability has been reported in Adobe Photoshop CS4. The vulnerability is due to an error in Adobe Photoshop CS4 that fails to properly handle malformed ABR files. By convincing a user to open a...

Sun Java Runtime Environment Abstract Windowing Toolkit Memory Corruption (CVE-2008-5359)

There exists a buffer overflow vulnerability in Sun Java Runtime Environment JRE. The vulnerability is caused due to improper checking of parameters passed to natively implemented class methods. A remote attacker may leverage this vulnerability to inject and execute arbitrary code on the target...

Preemptive Protection against Multiple Vendors OPIE Off-by-one Stack Buffer Overflow Vulnerability

A stack buffer overflow vulnerability has been reported in OPIE. OPIE, "One time Passwords In Everything", is a login and password package installed on the server and the client, which makes untrusted networks safer against password-sniffing packet analysis software. OPIE is shipped with DragonFl...

AOL Instant Messenger Away Message Buffer Overflow (CVE-2004-0636)

AOL Instant Messenger AIM is an instant messaging and presence computer program which allows registered users to communicate in real time. AOL Instant Messenger AIM registers itself as the handler of URL scheme aim. There exists a vulnerability in the way AOL Instant Messenger AIM parses an away...

Microsoft Data Analyzer ActiveX Control Remote Code Execution (MS10-008; CVE-2010-0252)

Microsoft Data Analyzer is a data analysis software for Microsoft Office XP. Microsoft Data Analyzer allows analyzing and visualizing data and data trends, and is integrated with SQL Server Analysis Services. Reports and graphs generated could be saved as Excel or PowerPoint files. A remote code...

Oracle Database Server Workspace Manager Multiple SQL Injection (CVE-2008-3982)

Oracle Database Server is an enterprise-level relational database application suite. To extend the functionality of the Oracle Database Server, extra packages of related program objects, i.e., procedures, functions, variables, constants, cursors, and exceptions, are provided in order to better...

Sun Java GIF File Handling Memory Corruption (CVE-2007-0243)

Java Technology is a programing platform developed by Sun Microsystems which aims to provide a system for developing and deploying cross-platform applications. Java is used in a wide variety programs that are deployed on personal computers as well as embedded devices and cell phones. Java is wide...

Ipswitch IMail Server IMAP SUBSCRIBE Command Stack Buffer Overflow (CVE-2007-2795)

Ipswitch IMail Server is a messaging service suite that supports numerous Internet standard electronic mail exchanging protocols. The IMail IMAP server is an implementation of the server side of the IMAP protocol. There exists a buffer overflow vulnerability in the way Ipswitch IMail Server handl...

Microsoft Office Excel Legacy Files (CVE-2009-3131; CVE-2010-1251; CVE-2010-1252; CVE-2010-3230)

Microsoft Excel is a popular spreadsheet application. A remote code execution vulnerability has been identified in Microsoft Excel. The vulnerability is due to an error in Microsoft Office Excel that fails to properly parse Office Excel legacy files. A remote attacker could trigger this flaw by...

Ipswitch Collaboration Suite SMTP Format String (CVE-2005-2931)

Ipswitch Collaboration Suite bundles the Ipswitch IMail Server. The IMail Server contains implementations of POP3, IMAP4, and SMTP servers. The SMTP server is installed and started in a default installation. There exists a format String vulnerability in the SMTP module of Ipswitch Collaboration...

Sun Java Web Start JNLP File Argument Injection (CVE-2005-0836)

The Sun Java Web Start is a component of the Java 2 Runtime Environment JRE. It allows for the network deployment of Java applications. This component enables stand-alone Java applications to be downloaded from a remote network location and invoked on a target machine. A vulnerability has been...

Microsoft DirectShow Video ActiveX Control Stack Buffer Overflow (CVE-2008-0015)

The Microsoft Video Control object is a Microsoft ActiveX control that connects Microsoft DirectShow filters for use in capturing, recording, and playing video. A stack buffer overflow vulnerability has been discovered in Microsoft DirectShow. The flaw is in the way Microsoft Video ActiveX contro...

Novell eDirectory HTTP Request Content-Length Heap Buffer Overflow

A remote code execution vulnerability exists in Novell eDirectory. Novell eDirectory is a cross-platform directory server used for identity management. Novell eDirectory utilizes various protocols to provide information services to various platforms, including HTTP-based SOAP. Novell eDirectory...

IPS-1 Protection Updates for yardradius and Cisco IOS Vulnerabilities and IPS-1 Protocol and Protocol Subsystems Updates

A vulnerability in yardradius could allow a remote attacker to execute arbitrary code via a buffer overflow. A vulnerability in Cisco IOS 12.2T through 12.4 could allows remote attackers to bypass Authentication, Authorization, and Accounting AAA RADIUS authentication via a long username...

Macrovision InstallShield Update Service ActiveX Control Code Execution (CVE-2007-5660)

Macrovision InstallShield is a software tool for creating installers or software packages. This vulnerability is due to errors in the Macrovision InstallShield Update Service ActiveX Control when handling webpage scripts. To trigger this issue, an attacker may create a malicious web page that wil...

Blaster Attacks (CVE-2003-0352; CVE-2003-0353)

Buffer overflow in a certain DCOM interface for RPC in Microsoft Windows NT 4.0, 2000, XP, and Server 2003 allows remote attackers to execute arbitrary code via a malformed message, as exploited by the Blaster, MSblast, LovSAN, Nachi, and Welchia worms...

MS-RPC over CIFS Inspection Properties (CVE-2003-0533)

DCE/RPC stands for Distributed Computing Environment / Remote Procedure Calls. It is a Remote Procedure Call system that allows software to work across multiple computers, as if it were all working on the same computer. This system allows programmers to write distributed software without having t...

Barangay Management System Arbitrary File Upload (CVE-2022-34120)

An arbitrary file upload vulnerability exists in Barangay Management System. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

Exam Reviewer Management System Arbitrary File Upload (CVE-2022-40878)

An arbitrary file upload vulnerability exists in Exam Reviewer Management System. Successful exploitation of this vulnerability allows an attacker to execute arbitrary code on the vulnerable system with administrative privileges...

Bolt CMS Arbitrary File Upload (CVE-2022-36532)

An arbitrary file upload vulnerability exists in Bolt CMS. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

Fortinet FortiOS Cross Site Scripting (CVE-2018-13380)

A cross site scripting vulnerability exists in Fortinet FortiOS. Successful exploitation of this vulnerability would allow remote attackers to inject an arbitrary web script into the affected system...

Zimbra Collaboration Directory Traversal (CVE-2022-27925; CVE-2022-37042)

A Directory Traversal vulnerability exists in Zimbra Collaboration. Successful exploitation of this vulnerability could allow a remote attacker to disclose or access arbitrary files on the vulnerable server...

Mitel MiVoice Connect Command Injection (CVE-2022-29499)

A command injection vulnerability exists in Mitel MiVoice Connect. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...

Aruba ArubaOS Heap Overflow (CVE-2022-23677)

A heap overflow vulnerability exists in Aruba ArubaOS devices. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system or cause application crashes...

D-Link DIR-820L Command Injection (CVE-2022-26258)

A command injection vulnerability exists in D-Link DIR-820L. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...

Emerson XWEB 300D Directory Traversal (CVE-2021-45427)

A directory traversal vulnerability exists in Emerson XWEB 300D. Successful exploitation of this vulnerability could allow an attacker to access arbitrary files on the affected system...

GitLab Community and Enterprise Cross-Site Scripting (CVE-2021-22241)

A stored cross-site scripting vulnerability exists in the Community edition and Enterprise edition of GitLab. The vulnerability is due to improper input validation of the default branch name...

RaspAP Command Injection (CVE-2021-33357)

A command injection vulnerability exists in RaspAP. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...

Delta Electronics DIAEnergie SQL Injection (CVE-2021-38391)

An SQL injection exists in Delta Industrial Automation DIAEnergie. The vulnerability is due to an input validation error when processing the type parameter in the AMHandler.ashx endpoint...

Microsoft Exchange Server Remote Code Execution (CVE-2021-42321)

A remote code execution vulnerability exists in Microsoft Exchange Server. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

Apache HTTP Server Directory Traversal (CVE-2021-41773; CVE-2021-42013)

A directory traversal vulnerability exists in Apache HTTP Server. Successful exploitation of this vulnerability could allow an attacker to access arbitrary files on the affected system...

Nuance Winscribe Dictation SQL Injection (CVE-2021-37599)

An SQL injection vulnerability exists in Nuance Winscribe Dictation. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system...

Microsoft Windows Kernel Elevation of Privilege (CVE-2021-31979)

An elevation of privilege vulnerability exists in Microsoft Windows. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

HongCMS Directory Traversal (CVE-2020-18178)

A directory traversal vulnerability exists in HongCMS. Successful exploitation of this vulnerability could allow an attacker to access arbitrary files on the affected system...

Microsoft Scripting Engine Memory Corruption (CVE-2021-31959)

A memory corruption vulnerability exists in Microsoft Windows. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

Zen Cart IT-Recht Kanzlei Plugin SQL Injection (CVE-2020-6577)

An SQL injection vulnerability exists in Zen Cart IT-Recht Kanzlei Plugin. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system...

Invigo Automatic Device Management Command Injection (CVE-2020-10583)

A command injection vulnerability exists in Invigo Automatic Device Management. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...

Acunetix Web Scanner Privilege Escalation (CVE-2015-4027)

A privilege escalation vulnerability exists in Acunetix Web Vulnerability Scanner. Successful exploitation of this vulnerability would allow a remote attacker to gain unauthorized access to the affected system...

Kronos Web Time And Attendance Privilege Escalation (CVE-2020-8495)

A privilege escalation vulnerability exists in Kronos Web Time And Attendance. Successful exploitation of this vulnerability would allow a remote attacker to gain unauthorized access to the affected system...

Advantech iView exportTaskMgrReport Directory Traversal (CVE-2020-16245)

A directory traversal vulnerability exists in Advantech iView. The vulnerability is due to improper validation of user-supplied path before using in exportTaskMgrReport method...

SourceCodester Online Clothing Store SQL Injection (CVE-2020-28138)

An SQL injection vulnerability exists in SourceCodester Online Clothing Store. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system...

Szuray Video Encoder Firmware Command Injection (CVE-2020-24217)

A command injection vulnerability exists in Szuray Video Encoder Firmware. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...

Red Lion N-Tron Cross Site Scripting (CVE-2020-16206)

A cross-site scripting vulnerability exists in Red Lion N-Tron. Successful exploitation of this vulnerability would allow remote attackers to inject arbitrary web script into the affected system...

Telerik UI Arbitrary File Upload (CVE-2017-11317; CVE-2017-11357)

An arbitrary file upload vulnerability exists in Telerik UI. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

phpFileManager Remote Code Execution (CVE-2015-5958)

A remote code execution vulnerability exists in phpFileManager. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

WordPress Pie Register Plugin SQL Injection (CVE-2018-10969)

A command execution vulnerability exists in WordPress. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...