CVE Vulnerability Catalog

SQL injection vulnerability in lib/admin.php in tenfourzero Shutter 0.1.4 allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

Unspecified vulnerability in Novell Open Enterprise Server (OES) 11 SP1 before Scheduled Maintenance Update 9415 and 11 SP2 before Scheduled Maintenance Update 9413 for Linux has unknown impact and attack vectors.

Cobham Sailor 6000 satellite terminals have hardcoded Tbus 2 credentials, allowing remote attackers to gain access via a TBUS2 command.

Cobham Sailor 900 and 6000 satellite terminals with firmware 1.08 MFHF and 2.11 VHF have hardcoded credentials for the administrator account, allowing attackers to gain administrative control through physical or terminal access.

The thraneLINK protocol implementation on Cobham devices does not verify firmware signatures, allowing attackers to execute arbitrary code.

Cobham SAILOR 900 VSAT, SAILOR FleetBroadBand 150, 250, and 500, EXPLORER BGAN, and AVIATOR 200, 300, 350, and 700D devices do not properly restrict password recovery. This allows attackers to obtain administrative privileges by leveraging physical access or terminal access to spoof a reset code.

Unspecified vulnerability in the AJAX autocompletion callback in the Biblio Autocomplete module for Drupal allows remote attackers to access data via unspecified vectors.

SQL injection vulnerability in the 'Biblio self autocomplete' submodule in the Biblio Autocomplete module for Drupal allows remote attackers to execute arbitrary SQL commands. This affects versions 6.x-1.x before 6.x-1.1 and 7.x-1.x before 7.x-1.5.

Multiple SQL injection vulnerabilities in ZPanel 10.0.1 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) resetkey or (2) inConfEmail parameter to index.php.

ZPanel 10.0.1 and earlier versions have an SQL injection vulnerability that allows remote attackers to execute arbitrary SQL commands via the inEmailAddress parameter in the UpdateClient action in the manage_clients module.

Multiple SQL injection vulnerabilities in Campaign11.exe in Arial Software Campaign Enterprise before version 11.0.551 allow remote attackers to execute arbitrary SQL commands via the (1) SerialNumber field to activate.asp or (2) UID field to User-Edit.asp.

Off-by-one error in the krb5_encode_krbsecretkey function in the LDAP KDB module in MIT Kerberos 5 allows remote authenticated users to cause a denial of service (buffer overflow) or possibly execute arbitrary code via a series of 'cpw -keepold' commands.

The acc_ctx_cont function in the SPNEGO acceptor in lib/gssapi/spnego/spnego_mech.c in MIT Kerberos 5 (krb5) versions 1.5.x through 1.12.x before 1.12.2 allows remote attackers to cause a denial of service (NULL pointer dereference and application crash) via an empty continuation token at a certain point during a SPNEGO negotiation.

A double free vulnerability in the init_ctx_reselect function in the SPNEGO initiator in MIT Kerberos 5 (krb5) versions 1.10.x through 1.12.x before 1.12.2 allows remote attackers to cause a denial of service (memory corruption) or possibly execute arbitrary code via network traffic that appears to come from an intended acceptor, but specifies a security mechanism different from the one proposed by the initiator.

Multiple buffer overflows in the SRP implementation in OpenSSL 1.0.1 before 1.0.1i may allow remote attackers to cause application crashes or potentially have unspecified other impacts via invalid SRP parameters (g, A, or B).

Multiple unspecified vulnerabilities in Google Chrome before version 36.0.1985.143 may allow attackers to cause a denial of service or possibly have other impact via unknown vectors.

Use-after-free vulnerability in the Web Sockets implementation in Blink, used in Google Chrome before version 36.0.1985.143, allows remote attackers to cause a denial of service or possibly have unspecified other impact via vectors that trigger an unexpectedly long lifetime of a temporary object during method completion.

Raritan Japan Dominion KX2-101 switches before version 2 are vulnerable to a denial of service attack that can cause the device to hang by sending a crafted packet.

The CTIManager module in Cisco Unified Communications Manager (CM) 10.0(1) does not properly validate Kerberos SSO tokens when single sign-on is enabled. This allows remote authenticated users to gain privileges and execute arbitrary commands via crafted token data.

Adobe Flash Player and Adobe AIR in certain versions do not properly restrict discovery of memory addresses, allowing attackers to bypass the ASLR protection mechanism.