CVE Vulnerability Catalog

SQL injection vulnerability in Ecava IntegraXor SCADA Server Stable 4.1.4360 and earlier and Beta 4.1.4392 and earlier allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

Ecava IntegraXor SCADA Server versions 4.1.4360 and earlier and Beta 4.1.4392 and earlier allow remote attackers to read or write to arbitrary files, potentially leading to sensitive information disclosure or denial of service (disk consumption) via the CSV export feature.

An SQL injection vulnerability in MPEX Business Solutions MX-SmartTimer before version 13.19.18 in Login.aspx allows remote attackers to execute arbitrary SQL commands via the ct100%24CPHContent%24password parameter.

The mPAY24 payment module before version 1.6 for PrestaShop has an SQL injection vulnerability in confirm.php that allows remote attackers to execute arbitrary SQL commands via the TID parameter.

IBM Storwize 3500, 3700, 5000, and 7000 devices and SAN Volume Controller 6.x and 7.x before 7.2.0.8 allow remote attackers to reset the administrator superuser password to its default value via a direct request to the administrative IP address.

A memory leak in Cisco TelePresence System Edge MXP Series Software F9.3.3 and earlier allows remote attackers to cause a management outage via multiple TELNET connections.

SQL injection vulnerability in the wt_directory extension before version 1.4.1 for TYPO3 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

CVE-2014-6239 is an SQL injection vulnerability in the Address visualization with Google Maps (st_address_map) extension before version 0.3.6, allowing remote attackers to execute arbitrary SQL commands.

Unspecified vulnerability in the LumoNet PHP Include (lumophpinclude) extension before 1.2.1 for TYPO3 allows remote attackers to execute arbitrary scripts via vectors related to extension links.

Unspecified vulnerability in the ke DomPDF extension before 0.0.5 for TYPO3 allows remote attackers to execute arbitrary code via unknown vectors.

CVE-2014-6233 describes an SQL injection vulnerability in the Flat Manager (flatmgr) extension before version 2.7.10 for TYPO3, allowing remote attackers to execute arbitrary SQL commands via unspecified vectors.

Unspecified vulnerability in the CWT Frontend Edit (cwt_feedit) extension before 1.2.5 for TYPO3 allows remote authenticated users to execute arbitrary code via unknown vectors.

The Ploticus module in PhpWiki 1.5.0 allows remote attackers to execute arbitrary code via shell metacharacters in a device option in the edit[content] parameter to index.php/HeIp.

In Plogger 1.0 RC1 and earlier, there is an unrestricted file upload vulnerability that allows remote authenticated users to execute arbitrary code by uploading a ZIP file containing a PHP file and a non-zero length PNG file.

Unspecified vulnerability in HP Network Node Manager i (NNMi) versions 9.0x, 9.1x, and 9.2x allows remote attackers to execute arbitrary code via unknown vectors.

Multiple unspecified vulnerabilities in Google Chrome before version 37.0.2062.120 may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

A use-after-free vulnerability in Blink, as used in Google Chrome before version 37.0.2062.120, allows remote attackers to cause a denial of service or possibly have unspecified other impact by leveraging improper handling of render-tree inconsistencies.

Adobe Flash Player and Adobe AIR in specific versions have a vulnerability that allows attackers to bypass intended access restrictions. This affects versions before 13.0.0.244 for Flash Player and before 15.0.0.249 for Adobe AIR on various platforms.

Microsoft Internet Explorer versions 6 through 11 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted website. This is a memory corruption vulnerability in the Internet Explorer browser.

Microsoft Internet Explorer versions 6 through 11 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site. This is a memory corruption vulnerability in the Internet Explorer browser.