CVE Vulnerability Catalog

E-Sic version 1.0 allows SQL injection via the q parameter in the esiclivre/restrito/inc/lkpcep.php file, which is part of the private search area.

In the web panel of the Airtame HDMI dongle with firmware before version 3.0, an attacker can set their own session ID via a 'Cookie: PHPSESSID=' header. This can lead to persistent access to the admin panel even after an admin password change.

Apache Solr before 7.1 is vulnerable to remote code execution, which can be exploited via an XXE attack in conjunction with the Config API add-listener command, leading to the RunExecutableListener class.

CVE-2017-10622 is an authentication bypass vulnerability in Juniper Networks Junos Space Network Management Platform that allows a remote unauthenticated attacker to log in as any privileged user. This issue affects Junos Space Network Management Platform 17.1R1 without Patch v1 and 16.1 releases prior to 16.1R3.

A vulnerability in the pluggable authentication module (PAM) of Juniper Networks Junos OS may allow an unauthenticated network based attacker to potentially execute arbitrary code or crash daemons such as telnetd or sshd that make use of PAM.

CVE-2016-1265 allows a remote unauthenticated attacker with access to Junos Space to execute arbitrary code or gain access to devices managed by Junos Space. It exploits attack vectors such as CSRF, default authentication credentials, information leak, and command injection.

The Windows Search component on various versions of Microsoft Windows allows remote code execution due to improper handling of DNS responses.

An Improper Authentication issue was discovered in JanTek JTC-200, all versions. The improper authentication could provide an undocumented BusyBox Linux shell accessible over the TELNET service without any authentication.

Apache OpenMeetings before 3.1.2 is vulnerable to Remote Code Execution via RMI deserialization attack.

The doFilter method in UrlAccessController in HPE Intelligent Management Center (iMC) PLAT 7.2 E0403P06 allows remote bypass of authentication via unspecified strings in a URI.

HPE LoadRunner before version 12.53 Patch 4 and HPE Performance Center before version 12.53 Patch 4 allow remote attackers to execute arbitrary code via unspecified vectors. In LoadRunner, this involves a heap-based buffer overflow in libxdrutil.dll.

An Authentication Bypass by Spoofing issue was discovered in LAVA Ether-Serial Link (ESL) running firmware versions 6.01.00/29.03.2007 and prior versions. Exploiting this vulnerability allows an attacker with the same IP address to bypass authentication by accessing a specific URL.

RubyGems versions between 2.0.0 and 2.6.13 are vulnerable to a possible remote code execution vulnerability. YAML deserialization of gem specifications can bypass class white lists.

Flexense VX Search Enterprise version 10.1.12 is vulnerable to a buffer overflow via an empty POST request to a long URI beginning with a /../ substring. This allows remote attackers to execute arbitrary code.

Seagate BlackArmor NAS devices with firmware sg2000-2000.1331 allow remote attackers to execute arbitrary commands via shell metacharacters in the ip parameter to backupmgt/getAlias.php.

Zyxel NBG6716 devices version V1.00(AAKG.9)C0 allow command injection in the ozkerz component due to the direct use of beginIndex and endIndex parameters in a popen call.

An input validation vulnerability in HPE Operations Orchestration product all versions prior to 10.80 allows for the execution of code remotely.

UI-Dialog version 1.09 and earlier allows remote attackers to execute arbitrary commands.

An XXE vulnerability in the import package functionality of the deployment module in Lansweeper before version 6.0.100.67 allows remote authenticated users to obtain sensitive information and conduct SSRF attacks.

The Epson 'EasyMP' software allows remote streaming from a user's computer to projectors. All Epson projectors supporting this software are vulnerable to a brute-force attack, enabling an attacker to remotely control and stream to the vulnerable device.