CVE Vulnerability Catalog

Accellion FTA 9_12_411 and earlier is affected by SSRF via a crafted POST request to wmProgressstat.html. The fixed version is FTA_9_12_416 and later.

Accellion FTA 9_12_411 and earlier is affected by OS command execution via a local web service call. The fixed version is FTA_9_12_416 and later.

Accellion FTA 9_12_370 and earlier is affected by SQL injection via a crafted Host header in a request to document_root.html. The fixed version is FTA_9_12_380 and later.

The systeminformation library for Node.js before version 5.3.1 contains a command injection vulnerability. The issue was fixed in version 5.3.1.

Nagios XI version xi-5.7.5 is affected by OS command injection due to improper sanitization of authenticated user input in the file /usr/local/nagiosxi/html/includes/configwizards/cloud-vm/cloud-vm.inc.php.

A vulnerability in Nagios XI version xi-5.7.5 allows OS command injection. The issue exists in the switch.inc.php file due to improper sanitization of authenticated user input.

Nagios XI version xi-5.7.5 is affected by OS command injection in the file windowswmi.inc.php due to improper sanitization of authenticated user input. This allows execution of arbitrary commands on the server.

Adminer, an open-source database management tool in a single PHP file, versions 4.0.0 through 4.7.9 contain a server-side request forgery (SSRF) vulnerability. This affects versions bundling all drivers (e.g., adminer.php). The vulnerability is fixed in version 4.7.9.

Adobe Acrobat Reader DC versions 2020.013.20074 (and earlier), 2020.001.30018 (and earlier), and 2017.011.30188 (and earlier) are affected by a heap-based buffer overflow vulnerability. An unauthenticated attacker could exploit this to achieve arbitrary code execution in the context of the current user. Exploitation requires user interaction, such as opening a malicious file.

McAfee Total Protection (MTP) prior to 16.0.30 contains an arbitrary process execution vulnerability. A local user can gain elevated privileges and execute arbitrary code by bypassing MTP self-defense.

Google Chrome prior to 88.0.4324.150 contains a heap buffer overflow in V8. A remote attacker could potentially exploit heap corruption via a crafted HTML page.

Remote Code execution vulnerability in Micro Focus Operation Bridge Reporter (OBR) product, affecting version 10.40. The vulnerability could be exploited to allow Remote Code Execution on the OBR server.

A SQL injection vulnerability in SonicWall SSLVPN SMA100 allows a remote unauthenticated attacker to perform SQL queries to access usernames, passwords, and other session-related information. This affects SMA100 build version 10.x.

The vulnerability has been reported to affect earlier versions of QTS. If exploited, this improper access control vulnerability could allow attackers to compromise the security of the software by gaining privileges or reading sensitive information. This issue affects QNAP Systems Inc. Helpdesk versions prior to 3.0.3.

D-Link DNS-320 FW v2.06B01 Revision Ax is affected by command injection in the system_mgr.cgi component, which can lead to remote arbitrary code execution.

An issue was discovered on D-Link DIR-825 R1 devices through 3.0.1 before 2020-11-20. A buffer overflow in the web interface allows attackers to achieve pre-authentication remote code execution.

Sudo before 1.9.5p2 contains an off-by-one error that can result in a heap-based buffer overflow. This allows privilege escalation to root via "sudoedit -s" and a command-line argument that ends with a single backslash character.

Tar.php in Archive_Tar through 1.4.11 allows write operations with Directory Traversal due to inadequate checking of symbolic links, a related issue to CVE-2020-28948.

Use after free in Media in Google Chrome prior to 81.0.4044.92 allowed a remote attacker to execute arbitrary code via a crafted HTML page.

Microsoft Defender contains a remote code execution vulnerability. Details of the vulnerability are not provided in the description.