CVE Vulnerability Catalog
Translated CVE descriptions from NVD NIST - in English
CISA KEV catalog updated: (v2026.07.27)
Podatność CVE-2018-10627 dotyczy wszystkich wersji Echelon SmartServer 1, wszystkich wersji SmartServer 2 przed wydaniem 4.11.007 oraz wszystkich wersji i.LON 100. Atakujący może wykorzystać API SOAP do uzyskania dostępu i zmiany wrażliwych elementów konfiguracyjnych, takich jak nazwy użytkowników i hasła do serwerów WWW i FTP.
An issue was discovered in app/Controller/UsersController.php in MISP 2.4.92 that allows an adversary to bypass brute-force protection. This can be done by using the PUT HTTP method instead of POST in the login part, as the protection only covered POST requests.
Wersje curl od 7.20.0 do 7.59.0 zawierają podatność CWE-126: Buffer Over-read, która może prowadzić do odmowy usługi. Atakujący może oszukać curl, aby odczytał dane poza końcem bufora w pamięci, używanego do przechowywania pobranych treści RTSP.
W MyBiz MyProcureNet w wersji 5.0.0 odkryto problem, który pozwala atakującemu na przesłanie złośliwego pliku na serwer WWW. Atakujący może przesłać skrypt, który umożliwia wydawanie poleceń systemu operacyjnego.
Vulnerability in Spring Data Commons (versions 1.13 to 1.13.10, 2.0 to 2.0.5, and older unsupported versions) due to improper neutralization of special elements in the property binder. An unauthenticated remote attacker can supply specially crafted request parameters against Spring Data REST backed HTTP resources or use Spring Data's projection-based request payload binding, leading to remote code execution.
Malicious PATCH requests submitted to servers using Spring Data REST versions prior to 2.6.9 (Ingalls SR9), versions prior to 3.0.1 (Kay SR1) and Spring Boot versions prior to 1.5.9, 2.0 M6 can use specially crafted JSON data to run arbitrary Java code.
A vulnerability in Trustwave Secure Web Gateway (SWG) through version 11.8.0.27 allows remote attackers to append an arbitrary public key to the device's SSH Authorized Keys data, leading to remote root access.
The Biometric Shift Employee Management System allows arbitrary file download via directory traversal sequences in the form_file_name parameter in a download_form action.
Dozer improperly uses a reflection-based approach to type conversion, which might allow remote attackers to execute arbitrary code via a crafted serialized object.
The XXE vulnerability in the XML processing functionality in Play before version 2.2.6 and 2.3.x before 2.3.5 may allow remote attackers to read arbitrary files, cause denial of service, or have unspecified other impacts via crafted XML data.
The admin terminal in Hawt.io does not require authentication, allowing remote attackers to execute arbitrary commands via the k parameter.
A vulnerability in BAS920 and ISC2000 devices allows remote attackers to obtain sensitive information through a specific request. Attackers can gain credential information for the Supervisor/Administrator account.
A buffer overflow vulnerability in NetTransport Download Manager version 2.96L and earlier could allow remote HTTP servers to execute arbitrary code on NAS devices via a long HTTP response.
The Zend_Db_Select::order function in Zend Framework before 1.12.7 does not properly handle parentheses, allowing remote attackers to conduct SQL injection attacks via unspecified vectors.
PHP Scripts Mall PHP Multivendor Ecommerce has an SQL Injection vulnerability via the usid parameter in the seller-view.php file.
PHP Scripts Mall PHP Multivendor Ecommerce has an SQL Injection vulnerability via the fid parameter in my_wishlist.php.
PHP Scripts Mall PHP Multivendor Ecommerce is vulnerable to SQL Injection via the cusid parameter in shopping-cart.php.
Previous versions of Apache Flex BlazeDS (4.7.2 and earlier) did not restrict which types were allowed for AMF(X) object deserialization by default. The deserialization process can execute code that has undesired side effects for several known types.
A buffer overflow vulnerability exists in MediaServer.exe in ALLPlayer ALLMediaServer 0.95 and earlier that could allow remote attackers to execute arbitrary code and/or cause denial of service on the victim machine.
The AirLive BU-2015, BU-3026, MD-3025, WL-2000CAM, and POE-200CAM v2 devices have a vulnerability related to the use of hard-coded credentials in the embedded Boa web server. Attackers can gain access to user data through specially crafted HTTP requests.