CVE Vulnerability Catalog

On Beijing Hanbang Hanbanggaoke devices, due to insufficient sanitization of user-controlled input, sending a PUT request to /ISAPI/Security/users/1 allows an admin password change.

The process_version_sections function in readelf.c in GNU Binutils 2.29 allows attackers to cause a denial of service (Integer Overflow, and hang because of a time-consuming loop) or possibly have unspecified other impact via a crafted binary file with invalid values of ent.vn_next during 'readelf -a' execution.

Version 3.4.4 of Tcpreplay has a Heap-Based Buffer Overflow vulnerability triggered by a crafted PCAP file.

The Photocrati NextGEN Gallery plugin version 2.1.10 for WordPress allows unrestricted file upload via the 'name' parameter if the file extension is changed from .jpg to .php.

Nagios Core through 4.3.4 initially executes /usr/sbin/nagios as root but supports configuration options in which this file is owned by a non-root account. This allows local users to gain privileges by leveraging access to this non-root account.

CVE-2015-9227 in AlegroCart 1.2.8 has a remote file inclusion vulnerability in the get_file function, allowing remote administrators to execute arbitrary PHP code via a URL in the file_path parameter.

Multiple SQL injection vulnerabilities in AlegroCart 1.2.8 allow remote administrators and authenticated users to execute arbitrary SQL commands through specific parameters in download and order update functions.

STDU Viewer version 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .jb2 file, related to a read access violation.

STDU Viewer version 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .jb2 file, related to a read access violation.

STDU Viewer version 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .jb2 file, related to a read access violation.

STDU Viewer version 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .jb2 file.

STDU Viewer version 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .jb2 file, related to a 'Read Access Violation'.

STDU Viewer version 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .jb2 file. The issue is related to branch selection control from a faulting address.

STDU Viewer version 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .jb2 file, related to a 'Read Access Violation'.

STDU Viewer version 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .jb2 file, related to a read access violation.

STDU Viewer version 1.6.375 allows attackers to cause a denial of service or possibly have unspecified other impact via a crafted .jb2 file.

STDU Viewer version 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .jb2 file. The issue relates to faulting address controls affecting subsequent write addresses.

STDU Viewer version 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .jb2 file. The issue relates to faulting address control affecting subsequent write addresses.

STDU Viewer version 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .jb2 file. The issue relates to how data from the faulting address controls the subsequent write address.

STDU Viewer version 1.6.375 allows attackers to execute arbitrary code or cause a denial of service via a crafted .jb2 file. The issue relates to faulting address controls affecting subsequent write addresses.