CVE Vulnerability Catalog

Firmware of I-O DATA DEVICE TS-WRLP version 1.00.01 and earlier and TS-WRLA version 1.00.01 and earlier allows remote attackers to obtain authentication credentials via unspecified vectors.

Corega CG-WLR300NX firmware version 1.20 and earlier allows an attacker on the same network segment to bypass access restrictions to perform arbitrary operations via unspecified vectors.

The CSRF vulnerability in Corega CG-WLR300NX firmware version 1.20 and earlier allows remote attackers to hijack the authentication of logged in users, enabling unintended operations.

I-O DATA DEVICE WFS-SR01 firmware version 1.10 and earlier allows remote attackers to bypass access restrictions to access data on storage devices inserted into the product via unspecified vectors.

SQL injection vulnerability in Cybozu Garoon versions 3.0.0 to 4.2.2 allows remote authenticated attackers to execute arbitrary SQL commands via the 'MultiReport' function.

Cybozu Garoon versions 3.0.0 to 4.2.2 allow remote attackers to obtain CSRF tokens via unspecified vectors.

A vulnerability in the JPKI user's software for individuals allows remote attackers to gain privileges via a Trojan horse DLL in an unspecified directory. This affects version 3.0.1 and earlier for Windows 7 and later, as well as Windows Vista, and version 2.6 and earlier.

IBM Tivoli Federated Identity Manager 6.2 is affected by a vulnerability due to a missing secure attribute in encrypted session (SSL) cookie.

IBM Sterling Order Management versions 9.2 through 9.5 is vulnerable to cross-site request forgery, which could allow an attacker to execute malicious and unauthorized actions on behalf of a trusted user.

IBM Rhapsody DM versions 4.0, 5.0, and 6.0 are vulnerable to a denial of service due to an XML External Entity Injection (XXE) error when processing XML data. A remote attacker could exploit this vulnerability to expose sensitive information or exhaust all available memory resources.

IBM Tivoli Key Lifecycle Manager versions 2.0.1, 2.5, and 2.6 specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.

The IP stack in multiple Huawei Campus series switch models allows remote attackers to cause a denial of service (reboot) via a crafted ICMP request message.

The SlideshowPluginSlideshowStylesheet::loadStylesheetByAJAX function in the Slideshow plugin versions 2.2.8 through 2.2.21 for WordPress allows remote attackers to read arbitrary WordPress option values.

CVE-2015-1786 describes a CSRF vulnerability in Zend/Validator/Csrf in Zend Framework 2.3.x before version 2.3.6, which can be exploited via null or malformed token identifiers.

The signal handler implementations in socat before version 1.7.3.0 and 2.0.0-b8 allow remote attackers to cause a denial of service (process freeze or crash).

Blue Coat Advanced Secure Gateway version 6.6, CacheFlow version 3.4, and ProxySG versions 6.5 and 6.6 allow remote attackers to bypass blocked requests, user authentication, and payload scanning.

The vulnerability in ISurfaceComposer.cpp in Android allows attackers to trigger a denial of service through null pointer dereference, leading to process crashes.

389 Directory Server in Red Hat Enterprise Linux 6 and 7 allows remote attackers to read the default Access Control Instructions.

The 389 Directory Server in Red Hat Enterprise Linux 6 and 7 allows remote attackers to infer the existence of RDN component objects.

mod_ns in Red Hat Enterprise Linux 7 allows remote attackers to force the use of ciphers that were not intended to be enabled.