CVE Vulnerability Catalog

RVM automatically loads environment variables from files in $PWD, leading to command execution vulnerabilities. RVM also executes hooks and installs gems and performs 'bundle install' based on files in $PWD, resulting in code execution.

GlassFish Server version 3.0.1 (build 22) is vulnerable to Java Key Store Password Disclosure, allowing an unauthenticated attacker to obtain the administrative user's plain text password and gain access to the web-based administration interface.

SYN Flood or FIN Flood attack in eCos 1 and other versions of embedded devices results in web Authentication Bypass. eCos Embedded Web Servers fail to validate and handle SYN and FIN packets, resulting in no authentication requirement.

Akeneo PIM CE and EE versions below 1.6.6, 1.5.15, and 1.4.28 are vulnerable to shell injection in mass editing, leading to remote code execution.

ATutor version 2.2.1 and earlier are vulnerable to SQL injection in multiple components, leading to information disclosure, database modification, or potential code execution.

ATutor versions 2.2.1 and earlier are vulnerable to an incorrect access control check vulnerability in the Social Application, Module, and Alternative Content components, resulting in privilege escalation.

ATutor versions 2.2.1 and earlier are vulnerable to a directory traversal and file extension check bypass in the Course component resulting in code execution. Additionally, these versions are vulnerable to a directory traversal vulnerability in the Course Icon component resulting in information disclosure.

A remote code execution vulnerability exists when Microsoft scripting engine improperly accesses objects in memory. This could corrupt memory in a way that enables an attacker to execute arbitrary code in the context of the current user.

The DiskFileItem class in Apache Wicket 6.x before 6.25.0 and 1.5.x before 1.5.17 allows remote attackers to cause a denial of service (infinite loop) and write to, move, and delete files with the permissions of DiskFileItem. Additionally, if running on a Java VM before 1.3.1, it can execute arbitrary code via a crafted serialized Java object.

In Apache httpd before 2.2.34 and 2.4.x before 2.4.27, the value placeholder in [Proxy-]Authorization headers of type 'Digest' was not initialized or reset before or between successive key=value assignments by mod_auth_digest. This could lead to leakage of potentially confidential information and a segfault in other cases resulting in denial of service.

IBM BigFix Inventory v9.2 uses inadequate account lockout settings that could allow a remote attacker to brute force account credentials.

In install/page_dbsettings.php in the Core distribution of XOOPS 2.5.8.1, unfiltered data passed to CREATE and ALTER SQL queries caused SQL Injection in the database settings page.

CVE-2017-4053 is a Command Injection vulnerability in the web interface of McAfee Advanced Threat Defense (ATD) versions 3.10, 3.8, 3.6, and 3.4. It allows remote unauthenticated users or attackers to execute arbitrary commands via a crafted HTTP request parameter.

CVE-2017-4052 is an authentication bypass vulnerability in the web interface of McAfee Advanced Threat Defense (ATD) 3.10, 3.8, 3.6, 3.4. Remote unauthenticated users can change or update configuration settings and gain administrator functionality via a crafted HTTP request parameter.

phpMyFAQ before 2.9.8 does not properly mitigate brute-force attacks that try many passwords in attempted logins quickly.

FineCMS version 2.1.0 allows remote attackers to execute arbitrary PHP code by using a URL Manager 'Add Site' action to enter this code after a ', sequence in a domain name.

A vulnerability in ipsilon 2.0 before 2.0.2, 1.2 before 1.2.1, 1.1 before 1.1.2, and 1.0 before 1.0.3 allows an attacker to log out active sessions of other users. This issue is related to how it tracks sessions and allows an unauthenticated attacker to view and terminate active sessions from other users.

Podatność CVE-2017-11165 dotyczy urządzenia dataTaker DT80 dEX w wersji 1.50.012, które pozwala zdalnym atakującym na uzyskanie wrażliwych informacji o poświadczeniach i konfiguracji poprzez bezpośrednie żądanie do URI /services/getFile.cmd?userfile=config.xml.

A vulnerability in Windows allows remote code execution due to improper handling of objects in memory by Windows Search. This affects multiple versions of Windows operating systems, including Windows 7, 8.1, and Windows 10.

On iSmartAlarm cube devices, there is an authentication bypass leading to remote execution of commands, such as setting the alarm on/off, related to incorrect cryptography.