CVE Vulnerability Catalog

Adult Script Pro version 2.2.4 allows SQL Injection via the PATH_INFO parameter to a /download URI, which is a different vulnerability than CVE-2007-6576.

D-Park Pro Domain Parking Script version 1.0 is vulnerable to SQL Injection via the 'username' field in the admin/loginform.php login form.

In the com_tag component 1.7.6 for Joomla!, a SQL injection vulnerability is located in the `tag` parameter to index.php. The request method to execute is GET.

The XXE vulnerability in Apache ActiveMQ 5.x before version 5.10.1 allows remote consumers to have unspecified impact via XPath based selectors when dequeuing XML messages.

The XXE vulnerability in Apache ActiveMQ Apollo 1.x before version 1.7.1 allows remote consumers to have unspecified impact via vectors involving an XPath based selector when dequeuing XML messages.

The Apache XML-RPC library version 3.1.3, as used in Apache Archiva, allows remote attackers to execute arbitrary code via a crafted serialized Java object in an <ex:serializable> element.

An out-of-bounds read in V8 in Google Chrome prior to version 57.0.2987.133 for Linux, Windows, and Mac, and 57.0.2987.132 for Android, allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page, related to Array.prototype.indexOf.

Before Thornberry NDoc version 8.0, laptop clients and the server have default database (Cache) users set up with a single password. This password is left behind in a cleartext log file during client installation on laptops.

The Tapatalk plugin versions 4.9.0 and earlier and 5.x through 5.2.1 for vBulletin contain multiple SQL injection vulnerabilities. Attackers can remotely execute arbitrary SQL commands via a crafted xmlrpc API request.

Apache OFBiz 10.04.x before 10.04.02 allows remote attackers to execute arbitrary code via unspecified vectors.

The ultimate-form-builder-lite plugin before version 1.3.7 for WordPress has SQL Injection, leading to PHP Object Injection via wp-admin/admin-ajax.php.

In phpCollab version 2.5.1 and earlier, there is an SQL injection vulnerability that allows remote attackers to execute arbitrary SQL commands via the id parameter in newsdesk/newsdesk.php.

D-Link DGS-1500 Ax devices before version 2.51B021 have a hardcoded password, allowing remote attackers to gain shell access.

CVE-2017-15222 describes a buffer overflow vulnerability in Ayukov NFTPD 2.0 and earlier, allowing remote attackers to execute arbitrary code.

Directory traversal vulnerability in minion id validation in SaltStack Salt before version 2016.3.8, 2016.11.x before 2016.11.8, and 2017.7.x before 2017.7.2 allows remote minions with incorrect credentials to authenticate to a master via a crafted minion ID.

Cloud Foundry Runtime before 216, UAA before 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before 1.7.0 allow attackers to leverage unspecified impact by failing to expire password reset links.

The password change functionality in Cloud Foundry Runtime before version 216, UAA before version 2.5.2, and Pivotal Cloud Foundry (PCF) Elastic Runtime before version 1.7.0 allows attackers to leverage the failure to expire existing sessions.

The get_login_ip_config_file function in Eyou Mail System before version 3.6 allows remote attackers to execute arbitrary commands via shell metacharacters in the domain parameter.

In PHPSUGAR PHP Melody CMS version 2.6.1, SQL Injection exists via the playlist parameter to playlists.php.

The printDirect function in the node-printer module version 0.0.1 and earlier allows remote attackers to execute arbitrary commands via unspecified characters in the lpr command.