CVE Vulnerability Catalog

SQL injection vulnerability in admin/admin.php in Sphider 1.3.6 allows remote attackers to execute arbitrary SQL commands via the filter parameter.

The Lead Octopus plugin for WordPress contains an SQL injection vulnerability in lib/optin/optin_page.php, allowing remote attackers to execute arbitrary SQL commands via the id parameter.

A directory traversal vulnerability in the Admin Center for Tivoli Storage Manager (TSM) in Rocket ServerGraph 1.2 allows remote attackers to create, execute, read, and delete arbitrary files by manipulating query parameters.

Multiple SQL injection vulnerabilities in TeamPass before version 2.1.20 allow remote attackers to execute arbitrary SQL commands through various parameters in PHP files.

TeamPass before 2.1.20 allows remote attackers to bypass access restrictions via a request to index.php followed by a direct request to a file that calls the session_start function before checking the CPM key.

TeamPass before version 2.1.20 allows remote attackers to bypass access restrictions via the language file path in a request to index.php or in a 'change_user_language' request to sources/main.queries.php.

The 'runshellscript echo.sh' script in Splunk before version 5.0.5 allows remote authenticated users to execute arbitrary commands via a crafted string.

CVE-2013-6771 is a directory traversal vulnerability in the collect script in Splunk before version 5.0.5 that allows remote attackers to execute arbitrary commands via a .. (dot dot) in the file parameter.

Unspecified vulnerability in the All Video Gallery (all-video-gallery) plugin before version 1.2.0 for WordPress may lead to unspecified impact and attack vectors.

CVE-2014-5089 is an SQL injection vulnerability in admin/options/logs.php in Status2k that allows remote authenticated administrators to execute arbitrary SQL commands via the log parameter.

Multiple SQL injection vulnerabilities in Sphider 1.3.6 and earlier, Sphider Pro, and Sphider-plus in admin/admin.php allow remote attackers to execute arbitrary SQL commands via the (1) site_id or (2) url parameter.

The NetBIOS name services daemon (nmbd) in Samba versions 4.0.x before 4.0.21 and 4.1.x before 4.1.11 allows remote attackers to execute arbitrary code via unspecified vectors that modify heap memory.

In ctdb versions before 2.3 in OpenSUSE 12.3 and 13.1, temporary files were not created securely, leading to unspecified impacts related to 'several temp file vulnerabilities'.

In the Yealink VoIP Phone SIP-T38G, in the cgi-bin/cgiServer.exx file, remote authenticated users can execute arbitrary commands by calling the system method in the body of a request. Examples include running unauthorized services, changing directory permissions, and modifying files.

The sctp_assoc_update function in the Linux kernel through version 3.15.8, when SCTP authentication is enabled, allows remote attackers to cause a denial of service through NULL pointer dereference.

The Linux kernel before version 3.15.8 on the s390 platform has a vulnerability that improperly restricts address-space control operations in PTRACE_POKEUSR_AREA requests. This allows local users to gain read and write access to kernel memory, potentially leading to privilege escalation.

The kgsl graphics driver for Linux kernel 3.x improperly prevents write access to IOMMU context registers, allowing local users to select a custom page table. Consequently, they can write to arbitrary memory locations by using a crafted GPU command stream.

The License Measurement servlet in SAP Solution Manager 7.1 allows remote attackers to bypass authentication via unspecified vectors, related to a verb tampering attack and SAP_JTECHS.

SQL injection vulnerability in the Unified Task List (UTL) Portlet for IBM WebSphere Portal 7.x and 8.x through 8.0.0.1 CF12 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

WeBid version 1.1.1 allows remote attackers to conduct an LDAP injection attack via the (1) js or (2) cat parameter.