CVE Vulnerability Catalog

Radio Thermostat CT80 and CT50 with firmware 1.4.64 and earlier does not restrict access to the API, allowing remote attackers to change the operation mode, wifi connection settings, temperature thresholds, and other settings.

Corel PaintShop Pro X5 and X6 has an untrusted search path vulnerability that allows local users to execute arbitrary code and conduct DLL hijacking attacks. This affects versions 16.0.0.113, 15.2.0.2, and earlier.

Multiple SQL injection vulnerabilities in FrontAccounting (FA) before version 2.3.21 allow remote attackers to execute arbitrary SQL commands via unspecified vectors.

A stack-based buffer overflow in the FindConfigChildeKeyList method in the XNSSDKDEVICE.XnsSdkDeviceCtrlForIpInstaller.1 ActiveX control in Samsung iPOLiS Device Manager before version 1.8.7 allows remote attackers to execute arbitrary code via a long value.

The DNP3 NG driver in COPA-DATA zenon versions 7.10 and 7.11, as well as the DNP3 Process Gateway in version 7.11 SP0 and earlier, allow remote attackers to cause a denial of service by sending a crafted DNP3 packet over TCP, leading to an infinite loop and process crash.

The ATEN CN8000 remote-access unit with firmware 1.6.154 and earlier allows remote attackers to cause a denial of service via unspecified vectors.

ownCloud Server before 5.0.15 and 6.0.x before 6.0.2 is vulnerable to an LDAP injection attack that can be conducted by remote attackers via unspecified vectors, as demonstrated using a 'login query.'

The Spoon module version 0.24 for Perl improperly uses the Storable::thaw function, allowing remote attackers to execute arbitrary code via a crafted request that is not properly handled during deserialization.

The HTML::EP module version 0.2011 for Perl improperly uses the Storable::thaw function in Session::Cookie, allowing remote attackers to execute arbitrary code via a crafted request that is not properly handled during deserialization.

The App::Context module versions 0.01 through 0.968 for Perl improperly uses the Storable::thaw function, allowing remote attackers to execute arbitrary code via a crafted request to App::Session::Cookie or App::Session::HTMLHidden, which are not properly handled when deserialized.

Multiple SQL injection vulnerabilities in Videos Tube 1.0 allow remote attackers to execute arbitrary SQL commands via the url parameter to (1) videocat.php or (2) single.php.

The Participants Database plugin for WordPress before version 1.5.4.9 has an SQL injection vulnerability in the Export CSV page, allowing remote attackers to execute arbitrary SQL commands.

A stack-based buffer overflow in AccessServer32.exe in Ericom AccessNow Server allows remote attackers to execute arbitrary code via a request for a non-existent file.

ownCloud Server before 6.0.3 does not properly check permissions, allowing remote authenticated users to access other users' contacts via the address book or rename files via unspecified vectors.

PHPDocX, used in ownCloud Server before version 5.0.15 and 6.0.x before version 6.0.2, allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity (XXE) attack.

SabreDAV before 1.7.11, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity (XXE) attack.

PHPExcel versions before 1.8.0, used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, do not disable external entity loading in libxml. This allows remote attackers to read arbitrary files, cause denial of service, or possibly have other impact via an XML External Entity (XXE) attack.

getID3() before 1.9.8, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity (XXE) attack.

A vulnerability in the Dell ML6000 and Quantum Scalar i500 systems allows remote attackers to execute arbitrary commands via shell metacharacters in a pathname parameter.

SQL injection vulnerability in the Contextual Related Posts plugin before version 1.8.10.2 for WordPress allows remote attackers to execute arbitrary SQL commands via unspecified vectors.