CVE Vulnerability Catalog

A Hard-Coded Passwords issue was discovered in Marel Food Processing Systems M3000 and M3210 terminals. End users do not have the ability to change system passwords, which poses a significant security risk.

In ncurses 6.0, a format string vulnerability exists in the fmt_entry function. A crafted input can lead to remote arbitrary code execution.

In ncurses 6.0, there is a stack-based buffer overflow in the fmt_entry function. A crafted input can lead to remote arbitrary code execution.

In Piwigo up to version 2.9.1, there is an SQL injection vulnerability in the administrative backend that allows remote users to execute arbitrary SQL commands via the cat_false or cat_true parameter in the comments or status page to cat_options.php.

EMC VASA Provider Virtual Appliance versions 8.3.x and prior has an unauthenticated remote code execution vulnerability that could potentially be exploited by malicious users to compromise the affected system.

A use-after-free vulnerability in the XML-LibXML module through version 2.0129 for Perl allows remote attackers to execute arbitrary code by controlling the arguments to a replaceChild call.

A use after free vulnerability in Adobe Flash Player exists in versions before 20.0.0.267 across various platforms, including Desktop Runtime, Google Chrome, Microsoft Edge, and Internet Explorer. It may lead to unauthorized memory access and potential execution of malicious code.

The custom authentication realm used by karaf-tomcat's 'opendaylight' realm in Opendaylight before Helium SR3 will authenticate any username and password combination.

In Code42 CrashPlan 5.4.x, remote code execution is possible via the org.apache.commons.ssl.rmi.DateRMI class, which upon instantiation creates an RMI server that listens on a TCP port and deserializes objects sent by TCP clients.

W PHPUnit przed wersją 4.8.28 oraz 5.x przed wersją 5.6.3 istnieje podatność, która pozwala zdalnym atakującym na wykonanie dowolnego kodu PHP poprzez dane POST HTTP zaczynające się od ciągu "<?php ". Przykład ataku dotyczy witryny z publicznie dostępnym folderem /vendor.

The Symantec Messaging Gateway can encounter an issue of remote code execution, allowing commands to be executed remotely on a target machine or in a target process.

Cognito Software Moneyworks versions 8.0.3 and earlier have a password exposure issue. Verbose logging writes the administrator password to a world-readable file.

The TP-Link WR841N V8 router before TL-WR841N(UN)_V8_170210 contained a design flaw in the use of DES for block encryption. This resulted in incorrect access control, allowing attackers to gain read-write access to system settings through the protected router configuration service tddp.

CVE-2017-9848 is a SQL injection vulnerability in C_InfoService.asmx in WebServices in Easysite 7.0. It allows remote attackers to execute arbitrary SQL commands via a crafted ArticleIDs element within an XML document in a GetArticleHitsArray element.

'/cgi-bin/admin/testserver.cgi' of the web service in most VIVOTEK Network Cameras is vulnerable to shell command injection, allowing remote attackers to execute any shell command as root via a crafted HTTP request.

Insufficient sanitisation in the OCaml compiler versions 4.04.0 and 4.04.1 allows external code to be executed with raised privilege in binaries marked as setuid, by setting the CAML_CPLUGINS, CAML_NATIVE_CPLUGINS, or CAML_BYTE_CPLUGINS environment variable.

InsideSecure MatrixSSL 3.8.7b has a heap buffer overflow vulnerability related to X509 certificate parsing. A specially crafted X509 certificate can cause a buffer overflow, leading to remote code execution.

InsideSecure MatrixSSL 3.8.7b has a heap buffer overflow vulnerability related to X509 certificate parsing. A specially crafted X509 certificate can cause a buffer overflow, leading to remote code execution.

In Redgate SQL Monitor before version 3.10 and 4.x before version 4.2, a remote attacker can gain unauthenticated access to the Base Monitor, allowing for the execution of arbitrary SQL commands on monitored Microsoft SQL Server machines.

IdeaBlade Breeze.Server.NET before 1.6.5 allows remote attackers to execute arbitrary code, related to use of TypeNameHandling in JSON deserialization.