CVE Vulnerability Catalog

ARRIS VAP2500 before FW08.41 does not properly validate passwords, allowing remote attackers to bypass authentication.

Unspecified vulnerability in the management portal in ARRIS VAP2500 before FW08.41 allows remote attackers to execute arbitrary commands via unknown vectors.

Enalean Tuleap before 7.5.99.6 allows remote attackers to execute arbitrary commands via the User-Agent header, which is provided to the passthru PHP function.

The Apptha WordPress Video Gallery (contus-video-gallery) plugin version 2.5 has multiple SQL injection vulnerabilities that may allow remote attackers to execute arbitrary SQL commands.

Multiple SQL injection vulnerabilities in recover.php in Pligg CMS 2.0.1 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) id or (2) n parameter.

Multiple SQL injection vulnerabilities in Raritan Power IQ versions 4.1.0 and 4.2.1 allow remote attackers to execute arbitrary SQL commands via the (1) sort or (2) dir parameter to license/records.

LibreOffice versions before 4.3.5 allow remote attackers to cause a denial of service (invalid write operation and crash) and possibly execute arbitrary code via a crafted RTF file.

A heap-based buffer overflow in libFLAC before version 1.3.1 in stream_decoder.c allows remote attackers to execute arbitrary code via a crafted .flac file.

A stack-based buffer overflow in stream_decoder.c in libFLAC before version 1.3.1 allows remote attackers to execute arbitrary code via a crafted .flac file.

Wibu-Systems CodeMeter Runtime before version 5.20 uses weak permissions (read and write access for all users) for codemeter.exe, allowing local users to gain privileges via a Trojan horse file.

The WinCC server in Siemens SIMATIC WinCC versions 7.0 through SP3, 7.2 before Update 9, and 7.3 before Update 2; SIMATIC PCS 7 versions 7.1 through SP4, 8.0 through SP2, and 8.1; and TIA Portal 13 before Update 6 allows remote attackers to execute arbitrary code via crafted packets.

An unspecified vulnerability in JustSystems Ichitaro 2008-2014 allows remote attackers to execute arbitrary code via a crafted file.

Use-after-free vulnerability in decode_slice.cpp in Cisco OpenH264 1.2.0 and earlier allows remote attackers to execute arbitrary code via an encoded media file.

Buffer overflow in decode.cpp in Cisco OpenH264 1.2.0 and earlier allows remote attackers to execute arbitrary code via an encoded media file.

The ConfigSaveServlet servlet in ManageEngine OpUtils before build 71024 allows remote attackers to disclose files via a crafted filename, related to 'saveFile'.

The ViewPoint web application in Dell SonicWALL Global Management System (GMS) before version 7.2 SP2, SonicWALL Analyzer before version 7.2 SP2, and SonicWALL UMA before version 7.2 SP2 allows remote authenticated users to execute arbitrary code via unspecified vectors.

The web interface in Aruba Networks AirWave before version 7.7.14 and 8.x before version 8.0.5 allows remote authenticated users to gain privileges and execute arbitrary commands via unspecified vectors.

CVE-2014-8367 is an SQL injection vulnerability in Aruba Networks ClearPass Policy Manager (CPPM) versions 6.2.x, 6.3.x before 6.3.6, and 6.4.x before 6.4.2, allowing remote attackers to execute arbitrary SQL commands.

Mountall version 1.54, used in Ubuntu 14.10, does not properly handle the umask when using the mount utility, allowing local users to bypass intended access restrictions.