CVE Vulnerability Catalog

A SQL Injection issue was discovered in OPW Fuel Management Systems SiteSentinel Integra 100, SiteSentinel Integra 500, and SiteSentinel iSite ATG consoles. The application is vulnerable to injection of malicious SQL queries via the input from the client.

Multiple SQL injection vulnerabilities in Synology Photo Station before version 6.7.4-3433 and 6.3-2968 allow remote attackers to execute arbitrary SQL commands via the (1) article_id parameter to label.php; or (2) type parameter to synotheme.php.

CVE-2015-5052 is an SQL injection vulnerability in Sefrengo before version 1.6.5 beta2.

Huawei E5756S before V200R002B146D23SP00C00 allows remote attackers to read device configuration information, enable PIN/PUK authentication, and perform other unspecified actions.

There is an SQL injection vulnerability in Pragyan CMS 3.0, which may allow attackers to execute unauthorized queries against the database.

strongSwan versions 5.2.2 and 5.3.0 allow remote attackers to cause a denial of service (daemon crash) or execute arbitrary code.

The WordPress Community Events plugin before version 1.4 contains a SQL injection vulnerability.

The WatuPRO plugin before version 5.5.3.7 for WordPress has an SQL injection vulnerability that allows remote attackers to execute arbitrary SQL commands via the watupro_questions parameter in a watupro_submit action to wp-admin/admin-ajax.php.

An issue was discovered on FiberHome User End Routers Bearing Model Number AN1020-25 which allows an attacker to restore a router to its factory settings by simply browsing to a specific link. Due to improper authentication on this page, the software accepts the request, allowing the attacker to reset the router to its default configurations.

The XXE vulnerability in the GlobalProtect gateway interface in PAN-OS before 6.1.18, 7.0.x before 7.0.17, 7.1.x before 7.1.12, and 8.0.x before 8.0.3 allows remote attackers to obtain sensitive information, cause denial of service, or conduct SSRF attacks.

Lexmark Scan To Network (SNF) version 3.2.9 and earlier stores network configuration credentials in plaintext and transmits them in requests. This allows remote attackers to obtain sensitive information via specific requests.

A session fixation vulnerability in D-Link DIR-600L routers (rev. Ax) with firmware before FW1.17.B01 allows remote attackers to hijack web sessions via unspecified vectors.

Soreco Xpert.Line 3.0 allows local users to spoof users and consequently gain privileges by intercepting a Windows API call.

The XXE vulnerability in SAP Netweaver before version 7.01 allows an attacker to exploit external XML entities to gain access to system data.

Froxlor before 0.9.33.2 with the default configuration/setup might allow remote attackers to obtain the database password by reading /logs/sql-error.log.

The NodeManager in Apache Hadoop versions 2.6.x before 2.6.5 and 2.7.x before 2.7.3 can leak the password for the credential store provider used by the NodeManager for YARN applications.

HelpDEZk version 1.1.1 has an SQL Injection vulnerability in the loginController.php file, occurring in the selectWarning function. This issue is related to the admin/login/getWarningInfo/id/ PATH_INFO.

ImageMagick version 7.0.6-5 has a memory leak vulnerability in ReadWEBPImage in coders/webp.c because memory is not freed in certain error cases, as demonstrated by VP8 errors.

The webadmin plugin for opendreambox 2.0.0 contains a vulnerability that allows remote attackers to execute arbitrary OS commands via shell metacharacters in the command parameter to the /script URI.

The Ping Module in the web interface of Technicolor TD5336 OI_Fw_v7 devices has a command injection vulnerability that allows remote attackers to execute arbitrary OS commands as root via shell metacharacters in the pingAddr parameter to mnt_ping.cgi.