CVE Vulnerability Catalog

An attacker may exploit the SQL injection vulnerability to construct queries without proper sanitization. Functions in DBVisitor.dll, exposed through SOAP interfaces, are vulnerable to SOAP injection, potentially leading to unexpected SQL actions and access to records in the database or execution of arbitrary code.

Multiple unspecified vulnerabilities in J2k-Codec allow remote attackers to execute arbitrary code via a crafted JPEG 2000 file.

The DNP Master Driver in the OSIsoft PI Interface before version 3.1.2.54 for DNP3 allows remote attackers to cause a denial of service (interface shutdown) via a crafted TCP packet.

VMware vSphere Client versions 4.0, 4.1, 5.0 before Update 3, and 5.1 before Update 2 improperly validate updates to Client files, allowing remote attackers to trigger the downloading and execution of an arbitrary program.

The Modbus slave/outstation driver in IOServer OPC Server version 1.0.20 and earlier allows remote attackers to cause a denial of service through a crafted packet, leading to out-of-bounds read and daemon crash.

The network interface configuration page in Sophos Web Appliance before version 3.8.2 allows remote administrators to execute arbitrary commands via shell metacharacters in the address parameter.

The Change Password dialog box in Sophos Web Appliance before version 3.8.2 allows remote authenticated users to change the admin user password via a crafted request.

SQL injection vulnerability in default.asp in CIS Manager CMS allows remote attackers to execute arbitrary SQL commands via the TroncoID parameter.

SQL injection vulnerability in OrbitScripts Orbit Open Ad Server before version 1.1.1 allows remote attackers to execute arbitrary SQL commands via the site_directory_sort_field parameter to guest/site_directory.

MongooseIM through version 1.3.1 rev. 2 does not properly restrict the processing of compressed XML elements, allowing remote attackers to cause a denial of service (resource consumption) via a crafted XMPP stream, known as an 'xmppbomb' attack.

The net/IOService.java file in Tigase before version 5.2.1 does not properly restrict the processing of compressed XML elements, allowing remote attackers to cause a denial of service (resource consumption) via a crafted XMPP stream, known as an 'xmppbomb' attack.

Prosody before 0.9.4 does not properly restrict the processing of compressed XML elements, allowing remote attackers to cause a denial of service (resource consumption) via a crafted XMPP stream, known as an 'xmppbomb' attack.

The mod_compression.lua plugin in Prosody before version 0.9.4 and Lightwitch Metronome through version 3.4 negotiates stream compression while a session is unauthenticated. This allows remote attackers to cause a denial of service via compressed XML elements in an XMPP stream, known as an 'xmppbomb' attack.

The mod_compression.lua plugin in Lightwitch Metronome up to version 3.4 does not properly restrict the processing of compressed XML elements, allowing remote attackers to cause a denial of service (resource consumption) via a crafted XMPP stream, known as an 'xmppbomb' attack.

Isode M-Link before version 16.0v7 does not properly restrict the processing of compressed XML elements, allowing remote attackers to cause a denial of service (resource consumption) via a crafted XMPP stream, known as an 'xmppbomb' attack.

In Openfire versions before 3.9.2, there is a vulnerability in nio/XMLLightweightParser.java that does not properly restrict the processing of compressed XML elements. This allows remote attackers to cause a denial of service (resource consumption) via a crafted XMPP stream, known as an 'xmppbomb' attack.

SAP Business Object Processing Framework (BOPF) for ABAP has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors.

SAP Print and Output Management has hardcoded credentials, which makes it easier for remote attackers to obtain access via unspecified vectors.

The Security Audit Log facility in SAP Enhancement Package (EHP) 6 for SAP ERP 6.0 allows remote attackers to modify or delete arbitrary log classes via unspecified vectors.

SAP Enterprise Portal does not properly restrict access to the Federation configuration pages, allowing remote attackers to gain privileges via unspecified vectors.