CVE Vulnerability Catalog

The Comcast firmware on Cisco DPC3939 devices allows remote attackers to obtain root access to the Network Processor (NP) Linux system by enabling a TELNET daemon and then establishing a TELNET session.

The Comcast firmware on Cisco DPC3939 devices allows remote attackers to execute arbitrary commands as root by leveraging local network access and connecting to the syseventd server.

VMware vCenter Server versions 5.5, 6.0, and 6.5 allow vSphere users with limited privileges to use the VIX API to access Guest Operating Systems without the need for authentication.

There is a division-by-zero vulnerability in LAME 3.99.5, caused by a malformed input file.

The MEDHOST Document Management System contains hard-coded credentials for accessing Apache Solr. An attacker with knowledge of these credentials and the ability to communicate with Apache Solr may gain access to sensitive patient and financial information.

The MEDHOST Document Management System contains hard-coded credentials used for customer database access. An attacker with knowledge of these credentials and the ability to communicate with the database may obtain or modify sensitive patient and financial information.

In MetInfo versions up to 5.3.17, the job/uploadfile_save.php file blocks the .php extension but not related extensions, which may allow remote authenticated admins to execute arbitrary PHP code by uploading a .phtml file after certain actions.

NetComm Wireless 4GT101W routers with Hardware: 0.01 and Software: V1.1.8.8 and Bootloader: 1.1.3 do not require authentication to access logfile.html, status.html, and system_config.html.

SQL injection exists in GLPI before version 9.1.5 in front/devicesoundcard.php via the start parameter.

Reporter.exe in Acunetix 8 allows remote attackers to execute arbitrary code or cause a denial of service (application crash) via a malformed PRE file, related to a 'User Mode Write AV starting at reporter!madTraceProcess.'

A flaw in Intel processors from the 6th and 7th Generation and in the Intel Xeon E3-1500M v5 and v6 and E3-1200 v5 and v6 Product Families allows compromised system firmware to impact SGX security via incorrect early system state.

GraphicsMagick 1.3.26 has a heap overflow in the WriteCMYKImage() function in coders/cmyk.c when processing multiple frames that have non-identical widths.

GraphicsMagick version 1.3.26 has a memory leak in the PersistCache function in magick/pixel_cache.c during the writing of Magick Persistent Cache (MPC) files.

GraphicsMagick version 1.3.26 has a NULL pointer dereference in the WritePCLImage() function in coders/pcl.c during writes of monochrome images.

GraphicsMagick version 1.3.26 has a heap overflow in the WriteRGBImage() function in coders/rgb.c when processing multiple frames with non-identical widths.

Fiyo CMS version 2.0.7 has an SQL injection vulnerability in status.php that uses the id parameter.

SAP TREX 7.10 allows remote attackers to (1) read arbitrary files via an fget command or (2) write to arbitrary files and consequently execute arbitrary code via an fdir command.

The cipherstring parsing code in nss_compat_ossl while in multi-keyword mode does not match the expected set of ciphers for a given cipher combination, allowing attackers to have unspecified impact via unknown vectors.

CVE-2015-2798 is a SQL injection vulnerability in Joomla! Component Contact Form Maker version 1.0.1 that allows remote attackers to execute arbitrary SQL commands via the id parameter.

MEDHOST Connex contains hard-coded credentials for customer database access. An attacker with knowledge of these credentials and the ability to communicate with the database may obtain or modify sensitive patient and financial information.