CVE Vulnerability Catalog

D-Link DIR-130 firmware version 1.23 and DIR-330 firmware version 1.12 do not sufficiently protect administrator credentials. The tools_admin.asp page discloses the administrator password in base64 encoding in the returned web page.

D-Link DIR-130 firmware version 1.23 and DIR-330 firmware version 1.12 are vulnerable to authentication bypass of the remote login page. A remote attacker that can access the remote management login page can manipulate the POST request in such a manner as to access some administrator-only pages such as tools_admin.asp without credentials.

ACTi cameras, including the D, B, I, and E series using firmware version A1D-500-V6.11.31-AC, use non-random default credentials. A remote attacker can take complete control of a device using default admin credentials.

ACTi cameras, including the D, B, I, and E series, using firmware version A1D-500-V6.11.31-AC have a web application that uses the GET method to process requests containing sensitive information such as user account name and password.

ACTi cameras, including the D, B, I, and E series, using firmware version A1D-500-V6.11.31-AC fail to properly restrict access to the factory reset page. An unauthenticated, remote attacker can exploit this vulnerability by accessing the reset page directly.

A vulnerability in Trend Micro ScanMail for Exchange 12.0 exists in which some communications to the update servers are not encrypted.

Qt for Android prior to 5.9.0 allows remote attackers to execute arbitrary OS commands via unspecified vectors.

K7 Antivirus 15.1.0309 has a vulnerability related to NULL pointer dereference in K7Sentry.sys version 15.1.0.59, which can be triggered by a DeviceIoControl request with code 0x950025c8.

K7 Antivirus 15.1.0309 has a vulnerability in K7Sentry.sys 15.1.0.59 that allows for a NULL pointer dereference via a DeviceIoControl request with value 0x950025a4.

K7 Antivirus 15.1.0309 has a vulnerability in K7Sentry.sys 15.1.0.59 that allows for a NULL pointer dereference via a DeviceIoControl request with the value 0x950025ac.

An XML External Entity (XXE) vulnerability was found in the Conserus Image Repository solution version 2.1.1.105. An unauthenticated user can send a modified HTTP SOAP request, allowing access to the local file system and transmitting the application service's account hashed credentials to a remote attacker.

In vBulletin versions up to 5.3.x, there is an unauthenticated deserialization vulnerability that can lead to arbitrary file deletion and, under certain circumstances, code execution. This issue arises from the unsafe usage of PHP's unserialize() function in the cacheTemplates() method of the vB_Library_Template class, which is publicly exposed.

vBulletin versions up to 5.3.x on Windows allows remote PHP code execution due to the accessibility of a require_once call with an unauthenticated request that can include directory traversal sequences to specify an arbitrary pathname. The blocking of ../ traversal does not apply to ..\, allowing for exploitation of this vulnerability.

Entrepreneur Dating Script version 2.0.1 has an SQL Injection vulnerability via the marital, gender, country, or profileid parameter in the search_result.php file.

Bamboo did not check that the name of a branch in a Mercurial repository contained argument parameters. An attacker with the appropriate permissions can execute arbitrary code on systems running a vulnerable version of Bamboo Server.

There is a possibility of double OGNL evaluation in FreeMarker templates through Struts FreeMarker tags. An attacker with restricted administrative rights to Bamboo can exploit this vulnerability to execute arbitrary Java code on systems running a vulnerable version of Bamboo.

Basic Job Site Script version 2.0.5 has a SQL Injection vulnerability via the keyword parameter to /job.

Resume Clone Script version 2.0.5 has a SQL Injection vulnerability via the id parameter in the preview.php file.

Advanced World Database version 2.0.5 has an SQL Injection vulnerability via the country or state parameter in city.php and the country parameter in state.php.

Muslim Matrimonial Script version 3.02 has an SQL Injection vulnerability via the succid parameter in the success-story.php file.