7-Zip RAR Solid Compression Remote Code Execution (CVE-2018-10115)

A remote code execution vulnerability exists in the RAR component of 7-Zip. This vulnerability is due to improper handling of solid compression...

Jenkins CI Server Policy Bypass (CVE-2018-1999001)

A policy bypass vulnerability exists in Jenkins CI Server. This vulnerability is due to insufficient validation of login requests. A successful attack could lead to policy bypass...

Microsoft Scripting Engine Memory Corruption (CVE-2018-8391)

A memory corruption vulnerability exists in Microsoft Windows. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

Zenworks Configuration Management Buffer Overflow - Ver2 (CVE-2015-0786)

A buffer overflow vulnerability exists in Zenworks Configuration Management. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system or cause application crashes...

Roundcube Webmail archive.php IMAP Command Injection (CVE-2018-9846)

An IMAP command injection vulnerability exists in Roundcube Webmail. The vulnerability is due to improper handling of the "uid" parameter within certain HTTP requests. A remote attacker can exploit this vulnerability by enticing an authenticated user to visit a page which sends a request to the...

Microsoft Edge Scripting Engine Memory Corruption (CVE-2018-0953)

A memory corruption vulnerability exists in Microsoft Edge. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

Trend Micro OfficeScan Proxy.php Command Injection (CVE-2017-11394)

A command injection vulnerability exists in Trend Micro's OfficeScan. The vulnerability is due to improper validation of HTTP parameters within the Proxy.php script. A remote, authenticated attacker could exploit the vulnerability by sending a crafted request to the vulnerable system...

Trend Micro Control Manager cmdHandlerLicenseManager SQL Injection (CVE-2017-11384)

An SQL injection vulnerability exists in Trend Micro Control Manager. The vulnerability is due to improper validation of the user-supplied input for cmdHandlerLicenseManager.dll. A remote, unauthenticated attacker could exploit this vulnerability by sending a crafted request to the target server...

HPE Intelligent Management Center dbman RestoreZipFile Command Injection (CVE-2017-5821)

A command injection vulnerability exists in the dbman component of HPE Intelligent Management Center. The vulnerability is due to missing validation of user-provided parameters when handling RestoreZipFile commands. A remote, unauthenticated attacker can exploit the vulnerability by sending a...

Microsoft Windows Search Remote Code Execution (CVE-2017-8543)

A remote code execution vulnerability exists in Windows Search Service. The vulnerability is due to out of bounds memory access. A remote attacker can exploit this issue by sending specially crafted SMB requests. A successful exploitation could lead to arbitrary code execution...

Microsoft Malware Protection Engine Denial of Service (CVE-2017-8535)

A memory corruption vulnerability has been reported in Microsoft Malware Protection Engine. A remote attacker can exploit this issue by enticing a target user to open a specially crafted file. A successful exploitation could lead to a denial of service...

Microsoft Windows COM Elevation of Privilege (CVE-2017-0214)

An elevation of privilege vulnerability exists in Microsoft Windows. The vulnerability is due to an error in the way Windows validate input before loading type libraries. A remote attacker can exploit this vulnerability to execute arbitrary code...

Microsoft Windows Uniscribe Information Disclosure (MS17-011: CVE-2017-0085)

An information disclosure vulnerability exists in Microsoft Windows. The vulnerability is due to the way Windows Uniscribe handles objects in the memory. A remote attacker can exploit this vulnerability by enticing the target user to open a specially crafted ttf file...

Microsoft Office Information Disclosure (MS17-014: CVE-2017-0105)

An information disclosure vulnerability exists in Microsoft Office. The vulnerability is due to an error in the way Microsoft Office improperly discloses the contents of its memory. A remote attacker can exploit this issue by enticing a victim to open a specially crafted file...

Microsoft Office Memory Corruption (MS17-014: CVE-2017-0030)

A remote code execution vulnerability exists in Microsoft Office. The vulnerability is due to an error in the way Microsoft Office handles objects in memory while parsing specially crafted files. A remote attacker can exploit this issue by enticing a victim to open a specially crafted file...

Microsoft Windows SMB2 Tree Connect Response Denial of Service (MS17-012: CVE-2017-0016)

A denial of service vulnerability has been reported in Microsoft Windows SMB2. The vulnerability is due to insufficient sanitization over SMB2 Tree Connect response messages...

Microsoft Bowser.sys Information Disclosure (MS16-135: CVE-2016-7218)

An information disclosure vulnerability exists in Microsoft Windows regarding bowser.sys . A local attacker could exploit this vulnerability by running a specially crafted malicious executable file. Successful exploitation of this vulnerability could lead to information disclosure...

Apache OpenMeetings Event Description Cross-Site Scripting (CVE-2016-2163)

A cross-site scripting vulnerability has been reported in the event handling component of Apache OpenMeetings. The vulnerability is due to insufficient validation of input for event descriptions. A remote, authenticated attacker could exploit this vulnerability by scheduling an event with a craft...

Rockwell Automation MicroLogix Remote Code Execution (CVE-2016-5645)

A remote code execution vulnerability exists in Rockwell Automation MicroLogix. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...

Solarwinds Virtualization Manager Apache Commons Collections Insecure Deserialization (CVE-2016-3642)

An insecure deserialization vulnerability has been reported in Solarwinds Virtualization Manager. This vulnerability is due to the inclusion of the vulnerable version of Apache Commons Collections library in the classpath combined with insecure deserialization. A remote, unauthenticated attacker...

Microsoft Browser Spoofing (MS16-084: CVE-2016-3276)

A spoofing vulnerability exists in Microsoft Internet Explorer and EDGE browsers. The vulnerability is due to improper parsing of HTTP content. A remote attacker can exploit this issue by enticing a target victim to open a specially crafted web page...

Microsoft Office Memory Corruption (MS16-088: CVE-2016-3281)

A remote code execution vulnerability exists in Microsoft Office. The vulnerability is due to an error in the way Microsoft Office improperly handles objects in memory while parsing specially crafted files. A remote attacker can exploit this issue by enticing a victim to open a specially crafted...

Microsoft Windows RPC Authentication Downgrade (MS16-047: CVE-2016-0128; CVE-2016-2118)

A security bypass vulnerability, also referred to as BadLock, exists in Microsoft Windows clients connecting to Samba Servers. The vulnerability is due to an authentication design weakness...

Microsoft Windows OLE Memory Remote Code Execution (MS16-030: CVE-2016-0092)

A remote code execution vulnerability has been reported in Microsoft Windows. The vulnerability is caused due to a missing bound checks. A remote attacker can exploit this issue by enticing a victim to open a specially crafted file...

Microsoft Office Memory Corruption (MS15-128: CVE-2015-6106)

A remote code execution vulnerability exists in Microsoft Office. The vulnerability is due to an error in the way Microsoft Office improperly handles objects in memory while parsing specially crafted files. A remote attacker can exploit this issue by enticing a victim to open a specially crafted...

Labtam ProFTP Client Banner Buffer Overflow (CVE-2009-3976)

Labtam ProFTP is vulnerable to a buffer overflow, caused by improper bounds checking. A remote attacker could exploit this vulnerability via an overly long welcome message to overflow a buffer and execute arbitrary code on the system with elevated privileges or cause the service to crash...

Microsoft Internet Explorer Memory Corruption (MS15-094: CVE-2015-2487)

A remote code execution vulnerability has been reported in Microsoft Internet Explorer. The vulnerability is due to an error in the way that Internet Explorer accesses an object that has not been correctly initialized or has been deleted. A remote attacker can exploit this issue by enticing a use...

Microsoft Internet Explorer Information Disclosure (MS15-094: CVE-2015-2483)

An information disclosure vulnerability has been reported in Microsoft Internet Explorer. The vulnerability is due to an error in Microsoft Internet Explorer while handling unsafe command line parameters. A remote attacker can exploit this issue by enticing a user to open a specially crafted...

Microsoft Graphics Component Remote Code Execution (MS15-080: CVE-2015-2458)

Remote code execution vulnerabilities exist in Microsoft Windows. The vulnerability is due to an error in the way Microsoft Windows Adobe Type Manager Library improperly handles specially crafted OpenType fonts. A remote attacker can exploit this issue by enticing a victim to open a specially...

Microsoft Windows OpenType Font Parsing Remote Code Execution (MS15-080: CVE-2015-2460)

A remote code execution vulnerability has been reported in Microsoft Windows. The vulnerability is due to an error in the way the OpenType Font OTF driver handles objects in memory. A remote attacker can exploit this issue by enticing a target user to open a specially crafted web page or email...

Microsoft SQL Server Remote Code Execution (MS15-058; CVE-2015-1762)

A remote code execution vulnerability exists in Microsoft SQL Server. The vulnerability is caused when Microsoft SQL Server incorrectly handles internal function calls to uninitialized memory. An attacker could exploit the vulnerability if a privileged user runs a specially crafted query on an...

HTTP Methods (CAN-2003-0109; CVE-2007-1560; CVE-2015-1499)

...

Microsoft Windows GDI+ WMF Parsing Buffer Overflow (MS08-052) - Ver2 (CVE-2008-3014)

Windows Metafile WMF is a 16-bit metafile image format optimized for the Windows operating system that can contain both vector information and bitmap information. A remote code execution vulnerability has been discovered in the way GDI+ allocates memory for WMF image files. The vulnerability is d...

Microsoft DirectShow Size Validation Remote Code Execution (MS09-028) - Ver2 (CVE-2009-1539)

Microsoft DirectShow is used for streaming media on Microsoft Windows operating systems. It is used for high-quality capture and playback of multimedia streams. The vulnerability is due to an error in the Microsoft DirectShow component that fails to properly validate certain size fields within...

Microsoft Browser Embedded Media Player Memory Corruption (MS10-082) - Ver2 (CVE-2010-2745)

Windows Media Player is a feature of the Windows operating system for personal computers. It is used for playing audio and video. A remote code execution vulnerability has been reported in Windows Media Player. The vulnerability is due to an error in the Windows Media Player that improperly...

Microsoft Excel Sheet Name Memory Corruption - Ver2 (CVE-2007-3490)

Microsoft Excel is a popular spreadsheet application that is usually released as part of the Microsoft Office suite. The application can create complex spreadsheets with multiple workbooks, formulae, and various data sources. The proprietary file format used for storing Microsoft Excel documents ...

EMC AlphaStor Device Manager Command Injection Improved performance - Ver2 (CVE-2013-0928)

A command injection vulnerability has been reported in EMC AlphaStor Device Manager. The vulnerability is due to improper input validation. An attacker could exploit this vulnerability by sending a malicious request containing a specially crafted parameter to the target server. Successful...

MySQL yaSSL Certificate Packet Stack Overflow - Ver2 (CVE-2009-4484)

A buffer overflow vulnerability has been reported in MySQL. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system or cause application crashes...

Microsoft Word OneTableDocumentStream Remote Code Execution (MS15-012; CVE-2015-0065)

A remote code execution vulnerability has been reported in Microsoft Word. The vulnerability is caused when Microsoft Word does not properly handle objects in memory while parsing specially crafted Office files. A remote attacker can exploit this issue by enticing a user to open a specially craft...

Apple QuickTime Text Track Descriptors Heap Buffer Overflow - Ver2 (CVE-2012-0664)

A heap buffer overflow vulnerability has been reported in Apple QuickTime. The vulnerability is due to improper validation of parameters lengths. A remote attacker can exploit this vulnerability by enticing a victim to open a specially crafted QuickTime Text file with an affected version of...

Microsoft PowerPoint Converter TPrint Record Handling Error (MS09-017) - Ver2 (CVE-2009-0227)

Microsoft PowerPoint is a popular graphics software for preparing slides and presentations. A stack buffer overrun vulnerability has been identified in Microsoft PowerPoint. The vulnerability is due to a memory corruption error in Microsoft PowerPoint when reading sound data from specially crafte...

InterNetNews Control Message Handling Buffer Overflow - Ver2 (CVE-2004-0045)

The InterNetNews package INN is a complete Usenet system. It includes innd, an NNTP server, and nnrpd, a newsreading server. A vulnerability exists in the NNTP server component of InterNetNews INN, which can be exploited to compromise a vulnerable system. The vulnerability is caused due to a...

OpenSSL Large Client Master Key Exploit Buffer Overflow - Ver2 (CVE-2002-0656)

A buffer overflow vulnerability has been reported in multiple products. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system or cause application crashes...

Mac OS X Safari Archive Metadata Command Execution - Ver2 (CVE-2006-0397)

A command execution vulnerability has been reported in Apple Mac OS X and Apple Mac OS X Server. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary commands on the affected system...

MovableType Unsanitized Input SQL Injection (CVE-2014-9057)

An SQL injection vulnerability was discovered in Movable Type. This vulnerability allows unauthenticated attackers to execute SQL code on the server...

Microsoft Windows SChannel Buffer Overflow (MS14-066; CVE-2014-6321)

A remote code execution vulnerability exists in Microsoft SChannel. The vulnerability is due to improper processing of specially crafted packets that leads to a buffer overflow. A remote, unauthenticated attacker can exploit this vulnerability by sending specially crafted packets to the target...

AlienVault OSSIM Framework Backup Command Execution (CVE-2014-5158)

A command execution vulnerability exists in AlienVault OSSIM Framework. The vulnerability is due to insufficient sanitization of user supplied data that is used to execute backup commands. A remote unauthenticated attacker could exploit this vulnerability by sending a crafted request to the...

Microsoft Internet Explorer Memory Corruption (MS14-056; CVE-2014-4141)

A remote code execution vulnerability has been reported in Microsoft Internet Explorer. The vulnerability is due to an error in the way that Internet Explorer accesses an object that has not been correctly initialized or has been deleted. A remote attacker can exploit this issue by enticing a use...

Symantec Web Gateway Multiple PHP Pages Cross Site Scripting (CVE-2014-1652)

A cross-site scripting vulnerability exists in Symantec Web Gateway. Successful exploitation could result in attacker-controlled script code being executed in the browser context of the Symantec Web Gateway management console. The vulnerability is due to improper validation of "variable",...

Advantech WebAccess SCADA webvact.ocx GotoCmd Buffer Overflow (CVE-2014-0765)

A stack buffer overflow has been reported in Advantech's WebAccess SCADA software. This vulnerability is due to insufficient input validation on the GotoCmd parameter of the webvact.ocx ActiveX control, a part of the WebAccess Client. A remote, unauthenticated attacker could exploit this...