CVE Vulnerability Catalog

Vulnerability in WordPress plugin DTracker version 1.5 allows adding new contacts to the wp_contact table without checking user authorization.

Vulnerability in WordPress plugin DTracker v1.5 is due to lack of input sanitization in the ./dtracker/delete.php file. The contact_id variable is not properly filtered before being appended to an SQL query.

Vulnerability in WordPress plugin DTracker v1.5 is due to the lack of user input sanitization in the ./dtracker/download.php file. The id variable is appended to the SQL query without proper processing.

The GSTN_offline_tool in India before version 1.2 executes winstart-server.vbs from the 'C:\GST Offline Tool' directory, which has insecure permissions. This allows local users to gain privileges by replacing winstart-server.vbs with arbitrary VBScript code.

The RESP parser in tcpdump before version 4.9.2 could enter an infinite loop due to a bug in print-resp.c:resp_get_length().

A buffer overflow vulnerability exists in the tag parsing functionality of LibOFX 0.9.11. A specially crafted OFX file can cause a write out of bounds resulting in a buffer overflow on the stack.

Red Hat JBoss EAP version 3.0.7 through before 4.0.0.Beta1 is vulnerable to server-side cache poisoning or CORS requests in the JAX-RS component resulting in a moderate impact.

D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) and REV. B (with firmware through FW208WWb02) devices allow remote attackers to cause a denial of service (daemon crash) via crafted LAN traffic.

D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) and REV. B (with firmware through FW208WWb02) devices have improper 0666 permissions for /var/run/hostapd* files.

D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) and REV. B (with firmware through FW208WWb02) devices have improper 0666 permissions for /var/run/storage_account_root.

D-Link DIR-850L REV. A and REV. B devices have improper permissions on the /var/etc/shadow file, which may lead to unauthorized access to user passwords.

D-Link DIR-850L REV. A and REV. B devices have improper permissions on the /var/etc/hnapasswd file, which may lead to unauthorized access to credential data.

D-Link DIR-850L REV. A (with firmware through FW114WWb07_h2ab_beta1) and REV. B (with firmware through FW208WWb02) devices have incorrect 0666 permissions for the /var/passwd file.

D-Link DIR-850L REV. A devices (with firmware through FW114WWb07_h2ab_beta1) have a vulnerability in bind.php that does not prevent unauthenticated nonce-guessing attacks. This allows remote attackers to change the DNS configuration via a series of requests.

D-Link DIR-850L REV. A and REV. B devices use the same hardcoded /etc/stunnel.key private key across different customers' installations, allowing remote attackers to defeat HTTPS cryptographic protection mechanisms.

The D-Link NPAPI extension, used in conjunction with D-Link DIR-850L REV. B (with firmware through FW208WWb02) devices, sends the cleartext admin password over the Internet as part of interaction with mydlink Cloud Services.

In Apache Spark versions 1.6.0 to 2.1.1, the launcher API performs unsafe deserialization of data received by its socket. This makes applications launched programmatically using the launcher API potentially vulnerable to arbitrary code execution by an attacker with access to any user account on the local machine.

Apache Brooklyn before version 0.10.0 uses the SnakeYAML library for parsing YAML data, allowing deserialization to any Java type. In the default configuration, an authenticated user can exploit this vulnerability to execute unauthorized Java code in the context of the Brooklyn process.

In Apache Brooklyn before version 0.10.0, the REST server is vulnerable to cross-site request forgery (CSRF), which could allow a malicious website to execute the attacker's commands as the user if clicked while logged in.

In Sophos SurfRight HitmanPro before version 3.7.20 Build 286, a crafted IOCTL with code 0x22E1C0 may lead to kernel data leaks. The leak occurs at the driver level, allowing an attacker to leak critical information about the machine.