CVE Vulnerability Catalog

Vulnerability in the Java SE and Java SE Embedded component of Oracle Java SE, concerning RMI, allows an unauthenticated attacker with network access to compromise these systems. The attacker can exploit this vulnerability by supplying data to APIs in the specified component.

Vulnerability in the Java SE and Java SE Embedded component of Oracle Java SE (subcomponent: JAXP) allows an unauthenticated attacker with network access to compromise these systems. It requires human interaction, making attacks potentially impactful on additional products.

Vulnerability in the Java SE and Java SE Embedded component of Oracle Java SE (subcomponent: JAXP) allows an unauthenticated attacker with network access to compromise these systems. Successful attacks require human interaction, making them easy to execute under the right conditions.

A vulnerability in the Java SE and Java SE Embedded components allows easy exploitation by an unauthenticated attacker with network access. It requires human interaction, which may lead to the takeover of Java SE and Java SE Embedded.

Vulnerability in the Java SE component of Oracle Java SE (subcomponent: ImageIO) allows an unauthenticated remote attacker to gain access to the system. It requires user interaction, which may lead to the takeover of Java SE.

A vulnerability in the Java SE and Java SE Embedded components allows an unauthenticated attacker with network access to compromise these systems. It requires user interaction, making the attack easy to execute under the right conditions.

A vulnerability in the Java SE component of Oracle Java SE (subcomponent: JavaFX) allows an unauthenticated attacker with network access to compromise Java SE. Successful attacks require human interaction and may significantly impact additional products.

A vulnerability was discovered in Siemens SiPass integrated (all versions before V2.70) that could allow an attacker with network access to bypass the authentication mechanism and perform administrative operations.

A vulnerability was discovered in Siemens ViewPort for Web Office Portal before revision number 1453 that could allow an unauthenticated remote user to upload arbitrary code and execute it with the permissions of the operating-system user running the web server by sending specially crafted network packets to port 443/TCP or port 80/TCP.

Crypto-NAK packets in ntpd in NTP versions 4.2.x before 4.2.8p4 and 4.3.x before 4.3.77 allow remote attackers to bypass authentication.

The datalen parameter in the refclock driver in NTP 4.2.x before 4.2.8p4 and 4.3.x before 4.3.77 allows remote attackers to execute arbitrary code or cause a denial of service (crash) via a negative input value.

The rate limiting feature in NTP versions 4.x before 4.2.8p4 and 4.3.x before 4.3.77 is vulnerable. Remote attackers can exploit this vulnerability by sending a large number of crafted requests.

The NSSCipherSuite option with ciphersuites enabled in mod_nss before version 1.0.12 allows remote attackers to bypass application restrictions.

The Loginizer plugin before version 1.3.6 for WordPress has an SQL Injection vulnerability that can be exploited via the X-Forwarded-For HTTP header.

Zend/Session/SessionManager in Zend Framework 2.2.x before 2.2.9 and 2.3.x before 2.3.4 allows remote attackers to create valid sessions without using session validators.

SQL injection vulnerability exists in Quest KACE Asset Management Appliance versions 6.4.120822 through 7.2 and Systems Management Appliance versions 6.4.120822 through 7.2.101.

The api/storage web interface in Unitrends Backup (UB) before version 10.0.0 has an issue with the validation of one of its input parameters. A remote attacker could exploit this flaw to bypass authentication and execute arbitrary commands with root privileges on the target system.

A vulnerability was discovered in the bpserverd protocol in Unitrends Backup (UB) before version 10.0.0, allowing authentication to be bypassed. A remote attacker could exploit this issue to execute arbitrary commands with root privileges on the target system.

A Missing Encryption of Sensitive Data issue was discovered in PDQ Manufacturing LaserWash G5, G5 S Series, M5, 360, 360 Plus, AutoXpress, AutoExpress Plus, LaserJet, ProTouch Tandem, ProTouch ICON, and ProTouch AutoGloss. The username and password are transmitted insecurely.

An Improper Authentication issue was discovered in PDQ Manufacturing LaserWash G5, G5 S Series, M5, 360, 360 Plus, AutoXpress, AutoExpress Plus, and ProTouch systems. The web server does not properly verify that provided authentication information is correct.