13538 matches found
StackStorm Web UI Remote Code Execution (CVE-2019-9580)
A remote code execution vulnerability exists in StackStorm Web UI. Successful exploitation could lead to arbitrary code execution...
WordPress WooCommerce Plugin Cross-site Scripting (CVE-2019-9168)
A cross-site scripting vulnerability exists in WordPress WooCommerce Plugin. Successful exploitation of this vulnerability would allow remote attackers to inject an arbitrary web script into the affected system...
Nuxeo NuxeoUnknownResource Expression Language Injection (CVE-2018-16341)
An Expression Language injection vulnerability exist in Nuxeo Content Management System. A remote, authenticated attacker can exploit this vulnerability by sending a crafted request to the target server...
Apache CouchDB Command Execution (CVE-2018-8007)
A command execution vulnerability has been reported in CouchDB. The vulnerability is due to a design flaw where certain configuration options that specify paths for operating system level binaries launched by CouchDB are modifiable via HTTP. A remote, authenticated attacker could exploit this...
Nagios XI API Key Regeneration Privilege Escalation (CVE-2018-15711)
A privilege escalation vulnerability exists in the API component of Nagios XI. A remote, authenticated attacker can exploit this vulnerability by sending a crafted request to the target system. Successful exploitation of this vulnerability would allow a remote attacker to gain unauthorized access...
Digium Asterisk Denial of Service (CVE-2018-7286)
A denial of service vulnerability exists in Digium Asterisk. The vulnerability is due to improper handling of prematurely closed TCP connections after a SIP INVITE request. Successful exploitation could result in denial of service conditions on the target service...
Trend Micro Control Manager sCloudService GetPassword SQL Injection (CVE-2018-3604)
An SQL injection vulnerability exists in the Trend Micro Control Manager. The vulnerability is due to improper validation of user-supplied input on SOAP sCloudService requests invoking the GetPassword method. Successful exploitation of the vulnerability could allow the attacker to execute arbitra...
7-Zip RAR Solid Compression Remote Code Execution (CVE-2018-10115)
A remote code execution vulnerability exists in the RAR component of 7-Zip. This vulnerability is due to improper handling of solid compression...
Jenkins CI Server Policy Bypass (CVE-2018-1999001)
A policy bypass vulnerability exists in Jenkins CI Server. This vulnerability is due to insufficient validation of login requests. A successful attack could lead to policy bypass...
Microsoft Scripting Engine Memory Corruption (CVE-2018-8391)
A memory corruption vulnerability exists in Microsoft Windows. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...
Zenworks Configuration Management Buffer Overflow - Ver2 (CVE-2015-0786)
A buffer overflow vulnerability exists in Zenworks Configuration Management. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system or cause application crashes...
Microsoft Edge Scripting Engine Memory Corruption (CVE-2018-0953)
A memory corruption vulnerability exists in Microsoft Edge. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...
Trend Micro OfficeScan Proxy.php Command Injection (CVE-2017-11394)
A command injection vulnerability exists in Trend Micro's OfficeScan. The vulnerability is due to improper validation of HTTP parameters within the Proxy.php script. A remote, authenticated attacker could exploit the vulnerability by sending a crafted request to the vulnerable system...
Trend Micro Control Manager cmdHandlerLicenseManager SQL Injection (CVE-2017-11384)
An SQL injection vulnerability exists in Trend Micro Control Manager. The vulnerability is due to improper validation of the user-supplied input for cmdHandlerLicenseManager.dll. A remote, unauthenticated attacker could exploit this vulnerability by sending a crafted request to the target server...
HPE Intelligent Management Center dbman RestoreZipFile Command Injection (CVE-2017-5821)
A command injection vulnerability exists in the dbman component of HPE Intelligent Management Center. The vulnerability is due to missing validation of user-provided parameters when handling RestoreZipFile commands. A remote, unauthenticated attacker can exploit the vulnerability by sending a...
Microsoft Windows Search Remote Code Execution (CVE-2017-8543)
A remote code execution vulnerability exists in Windows Search Service. The vulnerability is due to out of bounds memory access. A remote attacker can exploit this issue by sending specially crafted SMB requests. A successful exploitation could lead to arbitrary code execution...
Microsoft Malware Protection Engine Denial of Service (CVE-2017-8535)
A memory corruption vulnerability has been reported in Microsoft Malware Protection Engine. A remote attacker can exploit this issue by enticing a target user to open a specially crafted file. A successful exploitation could lead to a denial of service...
Microsoft Windows COM Elevation of Privilege (CVE-2017-0214)
An elevation of privilege vulnerability exists in Microsoft Windows. The vulnerability is due to an error in the way Windows validate input before loading type libraries. A remote attacker can exploit this vulnerability to execute arbitrary code...
Microsoft Windows Uniscribe Information Disclosure (MS17-011: CVE-2017-0085)
An information disclosure vulnerability exists in Microsoft Windows. The vulnerability is due to the way Windows Uniscribe handles objects in the memory. A remote attacker can exploit this vulnerability by enticing the target user to open a specially crafted ttf file...
Microsoft Office Information Disclosure (MS17-014: CVE-2017-0105)
An information disclosure vulnerability exists in Microsoft Office. The vulnerability is due to an error in the way Microsoft Office improperly discloses the contents of its memory. A remote attacker can exploit this issue by enticing a victim to open a specially crafted file...
Microsoft Office Memory Corruption (MS17-014: CVE-2017-0030)
A remote code execution vulnerability exists in Microsoft Office. The vulnerability is due to an error in the way Microsoft Office handles objects in memory while parsing specially crafted files. A remote attacker can exploit this issue by enticing a victim to open a specially crafted file...
Microsoft Windows GDI Elevation of Privilege (MS17-013: CVE-2017-0025)
An elevation of privilege vulnerability exists in Windows Graphics Device Interface GDI. The vulnerability is caused when the Windows Graphics Device Interface fails to properly handle objects in memory. A remote attacker can exploit this vulnerability by running a specially crafted application...
Microsoft Bowser.sys Information Disclosure (MS16-135: CVE-2016-7218)
An information disclosure vulnerability exists in Microsoft Windows regarding bowser.sys . A local attacker could exploit this vulnerability by running a specially crafted malicious executable file. Successful exploitation of this vulnerability could lead to information disclosure...
Apache OpenMeetings Event Description Cross-Site Scripting (CVE-2016-2163)
A cross-site scripting vulnerability has been reported in the event handling component of Apache OpenMeetings. The vulnerability is due to insufficient validation of input for event descriptions. A remote, authenticated attacker could exploit this vulnerability by scheduling an event with a craft...
Rockwell Automation MicroLogix Remote Code Execution (CVE-2016-5645)
A remote code execution vulnerability exists in Rockwell Automation MicroLogix. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...
Solarwinds Virtualization Manager Apache Commons Collections Insecure Deserialization (CVE-2016-3642)
An insecure deserialization vulnerability has been reported in Solarwinds Virtualization Manager. This vulnerability is due to the inclusion of the vulnerable version of Apache Commons Collections library in the classpath combined with insecure deserialization. A remote, unauthenticated attacker...
Microsoft Browser Spoofing (MS16-084: CVE-2016-3276)
A spoofing vulnerability exists in Microsoft Internet Explorer and EDGE browsers. The vulnerability is due to improper parsing of HTTP content. A remote attacker can exploit this issue by enticing a target victim to open a specially crafted web page...
Microsoft Office Memory Corruption (MS16-088: CVE-2016-3281)
A remote code execution vulnerability exists in Microsoft Office. The vulnerability is due to an error in the way Microsoft Office improperly handles objects in memory while parsing specially crafted files. A remote attacker can exploit this issue by enticing a victim to open a specially crafted...
Microsoft Windows RPC Authentication Downgrade (MS16-047: CVE-2016-0128; CVE-2016-2118)
A security bypass vulnerability, also referred to as BadLock, exists in Microsoft Windows clients connecting to Samba Servers. The vulnerability is due to an authentication design weakness...
Microsoft Windows OLE Memory Remote Code Execution (MS16-030: CVE-2016-0092)
A remote code execution vulnerability has been reported in Microsoft Windows. The vulnerability is caused due to a missing bound checks. A remote attacker can exploit this issue by enticing a victim to open a specially crafted file...
Microsoft Office Memory Corruption (MS15-128: CVE-2015-6106)
A remote code execution vulnerability exists in Microsoft Office. The vulnerability is due to an error in the way Microsoft Office improperly handles objects in memory while parsing specially crafted files. A remote attacker can exploit this issue by enticing a victim to open a specially crafted...
Labtam ProFTP Client Banner Buffer Overflow (CVE-2009-3976)
Labtam ProFTP is vulnerable to a buffer overflow, caused by improper bounds checking. A remote attacker could exploit this vulnerability via an overly long welcome message to overflow a buffer and execute arbitrary code on the system with elevated privileges or cause the service to crash...
Microsoft Office Memory Corruption (MS15-116: CVE-2015-6038)
A remote code execution vulnerability exists in Microsoft Office. The vulnerability is caused when the Office software fails to properly validate templates. A remote attacker can exploit this issue by enticing a victim to open a specially crafted file...
Microsoft Internet Explorer Memory Corruption (MS15-094: CVE-2015-2487)
A remote code execution vulnerability has been reported in Microsoft Internet Explorer. The vulnerability is due to an error in the way that Internet Explorer accesses an object that has not been correctly initialized or has been deleted. A remote attacker can exploit this issue by enticing a use...
Microsoft Internet Explorer Information Disclosure (MS15-094: CVE-2015-2483)
An information disclosure vulnerability has been reported in Microsoft Internet Explorer. The vulnerability is due to an error in Microsoft Internet Explorer while handling unsafe command line parameters. A remote attacker can exploit this issue by enticing a user to open a specially crafted...
Microsoft Graphics Component Remote Code Execution (MS15-080: CVE-2015-2458)
Remote code execution vulnerabilities exist in Microsoft Windows. The vulnerability is due to an error in the way Microsoft Windows Adobe Type Manager Library improperly handles specially crafted OpenType fonts. A remote attacker can exploit this issue by enticing a victim to open a specially...
Microsoft Windows OpenType Font Parsing Remote Code Execution (MS15-080: CVE-2015-2460)
A remote code execution vulnerability has been reported in Microsoft Windows. The vulnerability is due to an error in the way the OpenType Font OTF driver handles objects in memory. A remote attacker can exploit this issue by enticing a target user to open a specially crafted web page or email...
Microsoft SQL Server Remote Code Execution (MS15-058; CVE-2015-1762)
A remote code execution vulnerability exists in Microsoft SQL Server. The vulnerability is caused when Microsoft SQL Server incorrectly handles internal function calls to uninitialized memory. An attacker could exploit the vulnerability if a privileged user runs a specially crafted query on an...
HTTP Methods (CAN-2003-0109; CVE-2007-1560; CVE-2015-1499)
...
Microsoft Windows GDI+ WMF Parsing Buffer Overflow (MS08-052) - Ver2 (CVE-2008-3014)
Windows Metafile WMF is a 16-bit metafile image format optimized for the Windows operating system that can contain both vector information and bitmap information. A remote code execution vulnerability has been discovered in the way GDI+ allocates memory for WMF image files. The vulnerability is d...
Microsoft DirectShow Size Validation Remote Code Execution (MS09-028) - Ver2 (CVE-2009-1539)
Microsoft DirectShow is used for streaming media on Microsoft Windows operating systems. It is used for high-quality capture and playback of multimedia streams. The vulnerability is due to an error in the Microsoft DirectShow component that fails to properly validate certain size fields within...
Microsoft Browser Embedded Media Player Memory Corruption (MS10-082) - Ver2 (CVE-2010-2745)
Windows Media Player is a feature of the Windows operating system for personal computers. It is used for playing audio and video. A remote code execution vulnerability has been reported in Windows Media Player. The vulnerability is due to an error in the Windows Media Player that improperly...
Microsoft Excel Sheet Name Memory Corruption - Ver2 (CVE-2007-3490)
Microsoft Excel is a popular spreadsheet application that is usually released as part of the Microsoft Office suite. The application can create complex spreadsheets with multiple workbooks, formulae, and various data sources. The proprietary file format used for storing Microsoft Excel documents ...
EMC AlphaStor Device Manager Command Injection Improved performance - Ver2 (CVE-2013-0928)
A command injection vulnerability has been reported in EMC AlphaStor Device Manager. The vulnerability is due to improper input validation. An attacker could exploit this vulnerability by sending a malicious request containing a specially crafted parameter to the target server. Successful...
MySQL yaSSL Certificate Packet Stack Overflow - Ver2 (CVE-2009-4484)
A buffer overflow vulnerability has been reported in MySQL. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system or cause application crashes...
Microsoft Word OneTableDocumentStream Remote Code Execution (MS15-012; CVE-2015-0065)
A remote code execution vulnerability has been reported in Microsoft Word. The vulnerability is caused when Microsoft Word does not properly handle objects in memory while parsing specially crafted Office files. A remote attacker can exploit this issue by enticing a user to open a specially craft...
Apple QuickTime Text Track Descriptors Heap Buffer Overflow - Ver2 (CVE-2012-0664)
A heap buffer overflow vulnerability has been reported in Apple QuickTime. The vulnerability is due to improper validation of parameters lengths. A remote attacker can exploit this vulnerability by enticing a victim to open a specially crafted QuickTime Text file with an affected version of...
Microsoft PowerPoint Converter TPrint Record Handling Error (MS09-017) - Ver2 (CVE-2009-0227)
Microsoft PowerPoint is a popular graphics software for preparing slides and presentations. A stack buffer overrun vulnerability has been identified in Microsoft PowerPoint. The vulnerability is due to a memory corruption error in Microsoft PowerPoint when reading sound data from specially crafte...
InterNetNews Control Message Handling Buffer Overflow - Ver2 (CVE-2004-0045)
The InterNetNews package INN is a complete Usenet system. It includes innd, an NNTP server, and nnrpd, a newsreading server. A vulnerability exists in the NNTP server component of InterNetNews INN, which can be exploited to compromise a vulnerable system. The vulnerability is caused due to a...
OpenSSL Large Client Master Key Exploit Buffer Overflow - Ver2 (CVE-2002-0656)
A buffer overflow vulnerability has been reported in multiple products. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system or cause application crashes...