CVE Vulnerability Catalog

The Epson 'EasyMP' software allows remote streaming from a user's computer to projectors. All Epson projectors supporting this software are vulnerable to a brute-force attack, enabling an attacker to remotely control and stream to the vulnerable device.

The Epson 'EasyMP' software allows remote streaming from a user's computer to projectors. Each device is authenticated using a unique 4-digit code, but projectors also have a hardcoded 'backdoor' code (2270) that grants access to all devices.

Buffer overflow in Sync Breeze Enterprise 10.0.28 allows remote attackers to have unspecified impact via a long username parameter to /login.

Buffer overflow in the mpfr_strtofr function in GNU MPFR before version 3.1.2-p11 may allow context-dependent attackers to achieve unspecified impact via vectors related to incorrect documentation for mpn_set_str.

The XML-RPC protocol support in Apache Roller before 5.0.3 allows attackers to conduct XML External Entity (XXE) attacks via unspecified vectors.

Multiple SQL injection vulnerabilities in Issuetracker phpBugTracker before version 1.7.0 allow remote attackers to execute arbitrary SQL commands via unspecified parameters.

Multiple SQL injection vulnerabilities in phpBugTracker before version 1.7.0 allow remote attackers to execute arbitrary SQL commands through various parameters in PHP files.

A number of command injection vulnerabilities were discovered in Music Station versions 4.8.6 (for QTS 4.2.x), 5.0.7 (for QTS 4.3.x), and earlier. If exploited, these vulnerabilities may allow a remote attacker to run arbitrary commands on the NAS.

The clusterLoadConfig function in Redis 4.0.2 allows attackers to cause a denial of service (out-of-bounds array index and application crash) by leveraging 'limited access to the machine'.

Trend Micro OfficeScan 11.0 and XG have an Unauthorized Memory Corruption vulnerability that may allow remote unauthenticated users to access the OfficeScan server and target cgiShowClientAdm.exe, leading to memory corruption issues.

Go versions before 1.8.4 and 1.9.x before 1.9.1 allow remote command execution via 'go get'. By using custom domains, it is possible to configure repositories in a way that can exploit malicious code.

The default authentication protocol in IBM Tivoli Storage Manager (IBM Spectrum Protect 7.1 and 8.1) is vulnerable to a brute force attack due to disclosing too much information during authentication. An attacker could gain user or administrative access to the TSM server.

ImageMagick version 7.0.7-2 contains a memory leak in ReadYCBCRImage in coders/ycbcr.c.

An Improper Authentication issue was discovered in Ctek SkyRouter Series 4200 and 4400, all versions prior to V6.00.11. A malicious user can access the application without authenticating by accessing a specific URL on the web server.

An Improper Authentication issue was discovered in iniNet Solutions iniNet Webserver, all versions prior to V2.02.0100. The webserver does not properly authenticate users, which may allow a malicious attacker to access sensitive information such as HMI pages or modify PLC variables.

Mercurial prior to 4.3 did not adequately sanitize hostnames passed to ssh, leading to possible shell-injection attacks.

W serwerze aplikacji Jboss, dostarczanym z Red Hat Enterprise Application Platform 5.2, stwierdzono, że metoda doFilter w ReadOnlyAccessFilter HTTP Invoker nie ogranicza klas, dla których wykonuje deserializację. To pozwala atakującemu na wykonanie dowolnego kodu za pomocą spreparowanych danych serializowanych.

Heap-based buffer overflow in dnsmasq before 2.78 allows remote attackers to cause a denial of service (crash) or execute arbitrary code via a crafted DNS response.

In Gemalto's HASP SRM, Sentinel HASP, and Sentinel LDK products prior to version 7.55 RTE, there is a remote capability to enable and disable the admin interface, leading to new attack vectors.

Memory corruption in Gemalto's HASP SRM, Sentinel HASP, and Sentinel LDK products prior to Sentinel LDK RTE version 7.55 may lead to remote code execution.