Subrion CMS Remote Code Execution (CVE-2018-19422)

A remote code execution vulnerability exists in Subrion CMS. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

HTTP Authenticated OS Command Injection (CVE-2020-17408; CVE-2020-24916; CVE-2020-25079; CVE-2020-3117; CVE-2020-7049)

A command injection vulnerability exists in web and application servers. Successful exploitation of this vulnerability could result in execution of arbitrary code on the target system...

Ruby On Rails Remote Code Execution (CVE-2020-8165)

A remote code execution vulnerability exists in Ruby On Rails. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

Pandora FMS Remote Code Execution (CVE-2020-5844)

A remote code execution vulnerability exists in Pandora FMS. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

MongoDB mongo-express Remote Code Execution (CVE-2019-10758)

A remote code execution vulnerability exists in MongoDB mongo-express. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

Apache Solr Remote Code Execution (CVE-2019-0193)

A remote code execution vulnerability exists in Apache Solr. Successful exploitation could result in execution of arbitrary code on the affected system...

WordPress Plainview Activity Monitor Plugin Command Injection (CVE-2018-15877)

A command injection vulnerability exists in WordPress Plainview Activity Monitor plugin. Successful exploitation of this vulnerability would allow remote attackers to execute arbitrary OS commands in the affected system...

Oracle Application Testing Suite Authentication Bypass (CVE-2016-0492)

An authentication bypass vulnerability exists in Oracle's Application Testing Suite. The vulnerability is due to insufficient input validation while processing HTTP requests. A remote attacker can exploit this vulnerability by sending crafted request to the vulnerable server...

Symantec Endpoint Protection ConsoleServlet ResetPassword Policy Bypass (CVE-2015-1486)

An authentication bypass vulnerability exists in Symantec Endpoint Protection. This vulnerability is due to a design flaw that lets unauthenticated users to retrieve a valid session token. A remote, unauthenticated attacker may exploit this vulnerability to create an admin account and access the...

Oracle Endeca Server createDataStore Remote Command Execution (CVE-2013-3763)

A command execution vulnerability exists in Oracle Endeca Server. The vulnerability is due to the controlSoapBinding web service exposing the createDataStore method which contains a flaw that allows for the injection of arbitrary commands. A remote, unauthenticated attacker could exploit this...

InduSoft Thin Client ISSymbol ActiveX Heap Buffer Overflow (CVE-2011-0340)

A heap buffer overflow vulnerability has been reported in the InduSoft Thin Client. The vulnerability is due to lack of input validation of a certain parameter. A remote attacker can exploit this vulnerability by enticing a target user to visit a crafted web page using Internet Explorer. Successf...

Oracle Database Application Express Component APEX Password Hash Disclosure (CVE-2009-0981)

Oracle Application Express APEX is a component of Oracle database server products. It is a web application development environment, with which developers can create and deploy database-backed applications via a web-based interface. An information disclosure vulnerability exists in the Application...

Schneider Electric Struxureware Data Center Expert Command Injection (CVE-2021-22795)

A command-injection vulnerability exists in Schneider Electric Struxureware Data Center Expert. The vulnerability is due to improper validation of user-supplied input...

Schneider Electric Struxureware Data Center Expert Directory Traversal (CVE-2021-22794)

A directory traversal vulnerability exists in Schneider Electric Struxureware Data Center Expert. The vulnerability is due to improper validation of user-supplied input...

Omron CX-One Stack Buffer Overflow (CVE-2020-27261)

A stack-based overflow exists in the CX-Position module of OMRON CX-One. The vulnerability is due to input validation error when processing NCI configuration files...

Microsoft Windows Uniscribe Memory Corruption (CVE-2010-2738)

A memory corruption vulnerability exists in Microsoft Windows. The vulnerability is due to improper input validation of a table in the TrueType font layout. Remote attacker could trigger this flaw by enticing a user to open a specially crafted TTF file. Successful exploitation could result in a...

Tiki Wiki CMS Authentication Bypass (CVE-2020-15906)

An authentication bypass vulnerability exists in Tiki Wiki CMS. Successful exploitation of this vulnerability could allow a remote attacker to gain unauthorized access to the affected system...

Jenkins Dependency Graph View Plugin Cross-Site Scripting (CVE-2019-10349)

A Cross-Site Scripting vulnerability exists in Jenkins Dependency Graph View plugin. Successful exploitation of this vulnerability would allow remote attackers to inject an arbitrary web script into the affected system...

HTTP URL Patterns (CAN-2004-1315)

...

HPE Lights-Out Authentication Bypass (CVE-2017-12542)

An authentication bypass vulnerability exists in HPE Lights-Out. Successful exploitation of this vulnerability would allow remote attackers to gain unauthorized access into the affected system...

VDOO Axis Camera Authentication Bypass (CVE-2018-10661; CVE-2018-10658; CVE-2018-10659; CVE-2018-10662; CVE-2018-10663; CVE-2018-10664)

An authentication bypass vulnerability exists in VDOO Axis Cameras. Successful exploitation of this vulnerability would allow remote attackers to obtain sensitive information and gain unauthorized access into the affected system...

Joomla LDAP Information Disclosure (CVE-2017-14596)

A LADP information disclosure vulnerability exists in Joomla!. Successful exploitation of this vulnerability allows an unprivileged remote attacker to extract all authentication credentials of the effected system...

Microsoft XML Core Services Remote Code Execution (KB2719615) - Ver2 (CVE-2012-1889)

A remote code execution vulnerability has been reported in Microsoft Internet Explorer. The vulnerability is caused due to a memory corruption when XML core Services attempts to access an object in memory that has not been initialized. A remote attacker may exploit this vulnerability by enticing ...

Microsoft IIS Request Header Buffer Overflow (MS10-065; CVE-2010-2730) - ver 2

A code execution vulnerability exists in Microsoft Internet Information Services IIS...

Belkin Linksys WRT110 Remote Command Execution (CVE-2013-3568)

A remote command execution vulnerability has been reported in Belkin Linksys WRT110 firmware. The vulnerability is due to the Web interface's failure to sanitize ping targets as well as a lack of CSRF tokens. A remote attacker could exploit this vulnerability by sending a malicious HTTP request t...

HP System Management Home Page Command Injection (CVE-2013-3576)

A Remote PHP Code Injection has been reported in HP System Management. The vulnerability is due to improper input validation. A remote attacker can exploit this issue by sending a malicious request containing a specially crafted parameter to the target server. Successful exploitation would result...

Multiple Vendors RPC librpc.dll Stack Buffer Overflow (CVE-2009-2754)

Remote Procedure Call RPC is a protocol that a program can use to request a service from a program located on another computer in a network. The librpc.dll handles the RPC protocol parsing. A buffer overflow vulnerability exists in IBM's Informix Dynamic Server and EMC's Legato Networker. The...

Oracle Database DBMS_JAVA.SET_OUTPUT_TO_JAVA Privilege Escalation (CVE-2010-0866; CVE-2010-0867)

Oracle Database Server is an enterprise-level relational database application suite. A vulnerability exists in Oracle Database 11g server that could allow users with limited privileges to execute SQL commands with System privileges on the server. The vulnerability is due to an access control...

Internet Explorer DHTML Objects Memory Corruption (MS07-069; CVE-2007-5347)

Microsoft Internet Explorer IE is a web browser application that is capable of rendering both static and dynamic web content. The application is primarily used for tasks related to web browsing, such as displaying HTML encoded pages, downloading files, etc. A memory corruption vulnerability exist...

Apple iTunes Protocol Handler Stack Buffer Overflow (CVE-2009-0950)

Apple iTunes is a multimedia player that supports a wide range of media formats. The software supports parsing and displaying picture files. When iTunes is installed, it registers itself with the host Operating System as a protocol handler for several application URL schemes. A buffer overflow...

HP OpenView Network Node Manager Multiple Parameters Buffer Overflow (CVE-2009-0920; CVE-2009-0921)

The Network Node Manager NNM is an HP OpenView product which manages networks.It determines and displays physical and logical connectivity in networks, as well as information referring to protocols running over the network. Multiple buffer overflow vulnerabilities were reported in HP OpenView...

WordPress WP Statistics Plugin SQL Injection (CVE-2022-25148)

An SQL injection vulnerability exists in WordPress WP Statistics Plugin. Successful exploitation of this vulnerability could result in the execution of arbitrary SQL statements on the affected system...

WordPress WooCommerce Gutenberg Blocks Plugin SQL Injection (CVE-2021-32789)

An SQL injection vulnerability exists in WordPress WooCommerce Gutenberg Blocks Plugin. Successful exploitation of this vulnerability could result in the execution of arbitrary SQL statements on the affected system...

VoIPmonitor Remote Code Execution (CVE-2021-30461)

A remote code execution vulnerability exists in VoIPmonitor. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

Linear eMerge Arbitrary File Upload (CVE-2019-7257)

A vulnerability exists in Linear eMerge E3 devices. Successful exploitation of this vulnerability could allow a remote attacker to damage users system...

Apache Druid Remote Code Execution (CVE-2021-25646)

A remote code execution vulnerability exists in Apache Druid. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

Trendmicro Threat Discovery Appliance Directory Traversal (CVE-2016-7552)

An authentication bypass vulnerability exists in TrendMicro Threat Discovery Appliance. Successful exploitation of this vulnerability would allow remote attackers to gain unauthorized access into the affected system...

TCPDF Phar Insecure Deserialization (CVE-2018-17057)

A remote code execution vulnerability exists in LimeSurvey. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

Horde Groupware Remote Code Execution (CVE-2020-8518)

A remote code execution vulnerability exists in Horde Groupware. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

PHPMailer Local Information Disclosure (CVE-2017-5223) - Ver2

An information disclosure vulnerability exists in PHPMailer. Successful exploitation of this vulnerability would allow a remote attacker to obtain sensitive information...

Piwigo Photo Gallery Project install script Directory Traversal - Ver2 (CVE-2013-1469)

A directory traversal vulnerability has been reported in Piwigo. Successful exploitation of this vulnerability would allow a remote attacker to list directories on the affected system...

Command Injection - Ver2 (CVE-2007-3010)

...

Sophos Web Protection Appliance patience.cgi Directory Traversal (CVE-2013-2641)

A directory traversal vulnerability has been reported in Sophos Web Protection Appliance, specifically on the /cgi-bin/patience.cgi component. A remote attacker can exploit this issue by reading arbitary files from the filesystem. These files include configuration files containing sensitive...

HP SiteScope SOAP Call runOMAgentCommand Command Injection (CVE-2013-2367)

A command injection vulnerability exists in HP SiteScope SOAP component...

Ipswitch TFTP Server Information disclosure (CVE-2009-1730)

A directory traversal vulnerability has been reported in Ipswitch TFTP Server. The vulnerability is caused due to improper validation of certain requests. A remote attacker can exploit this issue by sending a specially crafted TFTP packet to the target. Successful exploitation would allow an...

HP Power Manager formExportDataLogs Buffer Overflow (CVE-2009-3999)

HP Power Manager is a web-based application for managing a HP Uninterruptible Power System UPS through a browser-based management console. It allows to monitor, manage, and control a single UPS locally and remotely. A buffer overflow vulnerability was reported in HP Power Manager. The vulnerabili...

Trend Micro ServerProtect RPC Multiple Buffer Overflows (CVE-2007-1070; CVE-2007-2508; CVE-2007-4218)

Trend Micro ServerProtect is prone to multiple buffer overflow vulnerabilities. Trend Micro ServerProtect is a centrally managed virus protection console for enterprise-class servers. A remote attacker may exploit this issue to execute arbitrary code on a vulnerable system via a specially crafted...

Microsoft Windows Server Service RPC Request Buffer Overrun (MS06-040; CVE-2006-3439)

The Server Service SRVSVC is one of the network services supplied by Microsoft. It supports file, print, and named-pipe sharing over Windows-based networks, and allows named pipe communication between applications running on distributed systems. By supplying malformed parameters to some of the AP...

Airspan AirSpot 5410 Command Injection (CVE-2022-36267)

A command injection vulnerability exists in Airspan AirSpot 5410. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...

TP-Link TL-WR840N Command Injection (CVE-2022-25061)

A command injection vulnerability exists in TP-Link TL-WR840N. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...