CVE Vulnerability Catalog

Multiple SQL injection vulnerabilities in inc/lib/User.class.php in MetalGenix GeniXCMS before version 0.0.3-patch allow remote attackers to execute arbitrary SQL commands via the (1) email parameter or (2) userid parameter to register.php.

An exploitable vulnerability exists in the YAML loading functionality of util.py in OwlMixin before version 2.0.0a12. The use of load instead of safe_load allows for arbitrary Python command execution by injecting code into loaded YAML.

An exploitable vulnerability exists in the YAML parsing functionality in the YAMLParser method in Interfaces.py in PyAnyAPI before version 0.6.1. A YAML parser can execute arbitrary Python commands resulting in command execution because load is used where safe_load should have been used.

An exploitable vulnerability exists in the YAML parsing functionality in MLAlchemy before version 0.2.2, allowing arbitrary Python command execution due to the use of load instead of safe_load when processing YAML-based queries.

Ingenious School Management System version 2.3.0 is vulnerable to Boolean-based and Time-based SQL injection in the 'friend_index' parameter of a GET request in /view/friend_profile.php.

A Plaintext Storage of a Password issue was discovered in WebDatorCentral (WDC) versions prior to Version 3.4.0. WDC stores password credentials in plaintext.

The Net::Ping::External extension through 0.15 for Perl does not properly sanitize arguments (e.g., invalid hostnames) containing shell metacharacters before use of backticks in External.pm, allowing for shell command injection and arbitrary command execution if untrusted input is used.

CVE-2017-2922 describes a memory corruption vulnerability in the Websocket protocol implementation of Cesanta Mongoose 6.8. A specially crafted websocket packet can lead to a buffer being allocated with stale pointers, resulting in a use-after-free vulnerability that can be exploited for remote code execution.

CVE-2017-2921 describes a vulnerability in the Websocket protocol implementation of Cesanta Mongoose 6.8 that can lead to heap buffer overflow. A specially crafted websocket packet can cause an integer overflow, resulting in denial of service and potential remote code execution.

CVE-2017-2894 describes a stack buffer overflow vulnerability in the MQTT packet parsing functionality of Cesanta Mongoose 6.8. A specially crafted MQTT SUBSCRIBE packet can cause a buffer overflow, leading to remote code execution.

An exploitable arbitrary memory read vulnerability exists in the MQTT packet parsing functionality of Cesanta Mongoose 6.8. A specially crafted MQTT packet can cause an arbitrary out-of-bounds memory read and write potentially resulting in information disclosure, denial of service and remote code execution.

CVE-2017-2891 describes a use-after-free vulnerability in the HTTP server implementation of Cesanta Mongoose 6.8. An ordinary HTTP POST request with a CGI target can cause a reuse of previously freed pointer, potentially leading to remote code execution.

An exploitable vulnerability exists in the authentication token generation functionality of Circle with Disney. Specially crafted network packets can cause a valid authentication token to be returned to the attacker.

An exploitable routing vulnerability exists in the Circle with Disney cloud infrastructure. A specially crafted packet can make the Circle cloud route a packet to any arbitrary Circle device.

An improper restriction of excessive authentication attempts vulnerability in Synology CardDAV Server before 6.0.7-0085 allows remote attackers to obtain user credentials via a brute-force attack.

The Gentoo net-misc/vde package before version 2.3.2-r4 may allow members of the 'qemu' group to gain root privileges by creating a hard link in a directory on which 'chown' is called recursively by the OpenRC service script.

Podatność w rsync 3.1.2 i 3.1.3-development w funkcji receive_xattr w pliku xattrs.c nie sprawdza obecności znaku null na końcu nazwy atrybutu rozszerzonego (xattr). Zdalny atakujący może wysłać spreparowane dane do demona rsync, powodując odczyt poza zakresem sterty (heap-based buffer over-read) i awarię aplikacji (DoS), a potencjalnie także inne skutki.

Zoho ManageEngine Applications Manager version 13 before build 13500 is vulnerable to SQL injection via GraphicalView.do, as demonstrated by a crafted viewProps yCanvas field or viewid parameter.

Mahara Mobile before 1.2.1 is vulnerable to passwords being sent to the Mahara access log in plain text.

Mahara versions 15.04 before 15.04.8, 15.10 before 15.10.4, and 16.04 before 16.04.2 are vulnerable to some authentication methods that do not use Mahara's built-in login form, allowing users to log in even if their institution was expired or suspended.