CVE Vulnerability Catalog

A VMSF_DELTA memory corruption was discovered in unrar before 5.5.5, used in Sophos Anti-Virus Threat Detection Engine before 3.37.2, which can lead to arbitrary code execution. An integer overflow in DataSize+CurChannel results in a negative value for the 'DestPos' variable, allowing the attacker to write out of bounds.

The OpenWebif plugin up to version 1.2.4 for E2 devices has a vulnerability that allows unauthorized code execution. The saveConfig function in 'plugin/controllers/models/config.py' performs eval() on the contents of the 'key' HTTP GET parameter.

In EMC Avamar Server Software versions 7.4.1-58, 7.4.0-242, 7.3.1-125, 7.3.0-233, and 7.3.0-226, an unauthorized attacker may leverage the file upload feature of the system maintenance page to load a maliciously crafted file to any directory, which could allow the attacker to execute arbitrary code on the Avamar Server system.

In EMC Avamar Server Software versions 7.3.1-125, 7.3.0-233, 7.3.0-226, 7.2.1-32, 7.2.1-31, 7.2.0-401, an unauthenticated remote attacker may potentially bypass the authentication process to gain access to the system maintenance page. This may be exploited to view sensitive information, perform software updates, or run maintenance workflows.

A SQL Injection issue was discovered in Ecava IntegraXor Versions 5.2.1231.0 and prior. The application fails to properly validate user input, which may allow for an unauthenticated attacker to remotely execute arbitrary code in the form of SQL queries.

The Foscam C1 firmware version 1.9.1.12 contains hard-coded FTP credentials (r:r). Knowledge of these credentials allows remote access to any cameras found on the internet that do not have port 50021 blocked by an intermediate device.

A stack-based buffer overflow vulnerability exists in the web management interface of the Foscam C1 Indoor HD Camera. A specially crafted HTTP request can cause a buffer overflow, resulting in overwriting arbitrary data on the stack frame.

The install/save.php file in WebsiteBaker version 2.10.0 has a vulnerability that allows remote attackers to execute arbitrary PHP code via the database_username, database_host, or database_password parameters.

Adobe Captivate versions 9 and earlier have a remote code execution vulnerability in the quiz reporting feature that could be abused to read and write arbitrary files to the server.

Adobe Digital Editions versions 4.5.4 and earlier contain an insecure library loading vulnerability. This vulnerability is due to unsafe library loading functions in the installer plugin.

Adobe Digital Editions versions 4.5.4 and earlier have an exploitable memory corruption vulnerability in the character code mapping module. Successful exploitation could lead to arbitrary code execution.

Adobe Digital Editions versions 4.5.4 and earlier have an exploitable memory corruption vulnerability in the PDF parsing engine. Successful exploitation could lead to arbitrary code execution.

Adobe Digital Editions versions 4.5.4 and earlier have an exploitable memory corruption vulnerability in the PDF processing engine. Successful exploitation could lead to arbitrary code execution.

Adobe Digital Editions versions 4.5.4 and earlier have an exploitable memory corruption vulnerability in the bitmap representation module. Successful exploitation could lead to arbitrary code execution.

Adobe Digital Editions versions 4.5.4 and earlier contain an insecure library loading vulnerability. This vulnerability is due to unsafe library loading of editor control library functions in the installer plugin.

Adobe Digital Editions versions 4.5.4 and earlier contain an insecure library loading vulnerability. This issue is due to unsafe loading of browser related library extensions in the installer plugin.

Adobe Digital Editions versions 4.5.4 and earlier have an exploitable memory corruption vulnerability in the PDF imaging model. Successful exploitation could lead to arbitrary code execution.

Adobe Digital Editions versions 4.5.4 and earlier have an exploitable memory corruption vulnerability in the PDF runtime engine. Successful exploitation could lead to arbitrary code execution.

Adobe Shockwave versions 12.2.8.198 and earlier have an exploitable memory corruption vulnerability. Successful exploitation could lead to arbitrary code execution.

Adobe Flash Player versions 25.0.0.171 and earlier have an exploitable use after free vulnerability in the advertising metadata functionality. Successful exploitation could lead to arbitrary code execution.