CVE Vulnerability Catalog

A path traversal information disclosure vulnerability exists in Schneider Electric's U.motion Builder software versions 1.2.1 and prior, allowing an unauthenticated user to execute arbitrary code and exfiltrate files.

A SQL injection vulnerability exists in Schneider Electric's U.motion Builder software versions 1.2.1 and prior, allowing unauthenticated users to execute arbitrary SQL commands against the underlying database.

Password reset tokens in Magento CE before 1.9.2.2 and Magento EE before 1.14.2.2 are passed via a GET request and not canceled after use, allowing remote attackers to obtain user passwords.

The redhat-support-plugin-rhev in Red Hat Enterprise Virtualization Manager before version 3.6 allows remote authenticated users with the SuperUser role to execute arbitrary commands on any host in the RHEV environment.

There is a stack-based buffer overflow in the getpwnam and getgrnam functions of the NSS module nss-mymachines in systemd.

Versions of inspircd in Debian before 2.0.7 have an issue with improper handling of unsigned integers. This vulnerability exists due to an incomplete fix for CVE-2012-1836.

The Responsive Image Gallery plugin before version 1.2.1 for WordPress has an SQL injection vulnerability that allows remote attackers to execute arbitrary SQL commands via the 'id' parameter in an add_edit_theme task on the wpdevart_gallery_themes page in the admin panel.

Server Side Request Forgery vulnerability in Vebto Pixie Image Editor versions 1.4 and 1.7 allows remote attackers to disclose information or execute arbitrary code via the url parameter to Launderer.php.

Multiple hardcoded credentials exist in Xsuite 2.x, which may lead to unauthorized access to the system.

Before version 4.8.2, WordPress mishandled % characters and additional placeholder values in $wpdb->prepare, potentially allowing SQL injection attacks via plugins and themes.

DenyAll WAF before version 6.4.1 allows unauthenticated remote attackers to obtain authentication information by making a typeOf=debug request to /webservices/download/index.php and then reading the iToken field in the reply.

Authentication bypass vulnerability in Trend Micro Mobile Security (Enterprise) versions before 9.7 Patch 3 allows attackers to access a specific part of the console using a blank password.

Trend Micro Mobile Security (Enterprise) versions before 9.7 Patch 3 contain SQL Injection vulnerabilities that allow remote attackers to execute arbitrary code on vulnerable installations.

CA Identity Manager versions r12.6 to r12.6 SP8, 14.0, and 14.1 allow remote attackers to potentially identify passwords of locked accounts through an exhaustive search.

In sam2p version 0.49.3, there is an invalid read of size 2 in the parse_rgb function in in_xpm.cpp. This can also cause a write to an illegal address.

Due to an integer overflow in sam2p 0.49.3, a loop executes 0xffffffff times, ending with an invalid read of size 1 in the Image::Indexed::sortPal function in image.cpp. This also causes memory corruption due to an attempted write to the invalid d[0xfffffffe] array element.

An out-of-bounds read (CWE-125) vulnerability exists in Micro Focus VisiBroker 8.5. The feasibility of leveraging this vulnerability for further attacks was not assessed.

An integer overflow (CWE-190) led to an out-of-bounds write (CWE-787) on a heap-allocated area, leading to heap corruption in Micro Focus VisiBroker 8.5.

libexif through 0.6.21 is vulnerable to out-of-bounds heap read vulnerability in exif_data_save_data_entry function. The issue is caused by improper length computation of the allocated data of an ExifMnote entry, which can lead to denial-of-service or possibly information disclosure.

Version 1.0.46-1 of pure-ftpd shipped in Fedora was vulnerable to a packaging error that caused the original configuration to be ignored after an update, resulting in the service running with the default configuration.