CVE Vulnerability Catalog

CVE-2014-100019 describes an SQL injection vulnerability in the LTree converter in Pomm before version 1.1.5, allowing remote attackers to execute arbitrary SQL commands via unspecified vectors.

Multiple stack-based buffer overflows in pdmwService.exe in SolidWorks Workgroup PDM 2014 SP2 allow remote attackers to execute arbitrary code via a long string in specific opcodes to port 3000.

The Sendy application version 1.1.8.4 has an SQL injection vulnerability that allows remote attackers to execute arbitrary SQL commands via the i parameter.

CVE-2014-100011 describes an SQL injection vulnerability in the /send-to module in Sendy 1.1.9.1 that allows remote attackers to execute arbitrary SQL commands via the c parameter.

CVE-2014-10029 is a SQL injection vulnerability in profile.php in FluxBB before version 1.4.13 and 1.5.x before version 1.5.7. It allows remote attackers to execute arbitrary SQL commands via the req_new_email parameter.

Multiple integer signedness errors in DirectShowDemuxFilter, used in Divx Web Player, Divx Player, and other Divx plugins, allow remote attackers to execute arbitrary code via a (1) negative or (2) large value in a Stream Format (STRF) chunk in an AVI file, triggering a heap-based buffer overflow.

Multiple SQL injection vulnerabilities in TopicsViewer 3.0 Beta 1 allow remote attackers to execute arbitrary SQL commands via the id parameter to edit_block.php, edit_cat.php, edit_note.php, or rmv_topic.php in admincp/.

The WP Symposium plugin version 14.11 for WordPress has an unrestricted file upload vulnerability that allows remote attackers to execute arbitrary code by uploading a file with an executable extension.

CVE-2014-10020 is a SQL injection vulnerability in login.php in Simple e-document 1.31 that allows remote attackers to execute arbitrary SQL commands via the username parameter.

The Welcart e-Commerce plugin version 1.3.12 for WordPress contains multiple SQL injection vulnerabilities that allow remote attackers to execute arbitrary SQL commands. The attack can be carried out through the changeSort or switch parameters on the usces_itemedit page.

CVE-2014-10015 is an SQL injection vulnerability in load-calendar.php in PHPJabbers Event Booking Calendar 2.0 that allows remote attackers to execute arbitrary SQL commands via the cid parameter.

The Another WordPress Classifieds Plugin for WordPress has an SQL injection vulnerability that allows remote attackers to execute arbitrary SQL commands via the keywordphrase parameter in a dosearch action.

A stack-based buffer overflow in UltraCamLib in the UltraCam ActiveX Control (UltraCamX.ocx) for the TRENDnet SecurView camera TV-IP422WN allows remote attackers to execute arbitrary code.

CVE-2014-10004 is an SQL injection vulnerability in admin/data_files/move.php in Maian Uploader 4.0 that allows remote attackers to execute arbitrary SQL commands via the id parameter.

The YourMembers plugin for WordPress has an SQL injection vulnerability in includes/ym-download_functions.include.php, allowing remote attackers to execute arbitrary SQL commands via the ym_download_id parameter.

The RealNetworks GameHouse RealArcade Installer (also known as ActiveMARK Game Installer) versions 2.6.0.481 and 3.0.7 has weak permissions for the GameHouse Games directory, allowing local users to gain privileges via a Trojan horse DLL in an individual game's directory.

The RACInstaller.StateCtrl.1 ActiveX control in InstallerDlg.dll in RealNetworks GameHouse RealArcade Installer 2.6.0.481 performs unexpected type conversions for invalid parameter types, allowing remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via crafted arguments.

Buffer overflow in Hancom Office 2010 SE allows remote attackers to execute arbitrary code via a long string in the Text attribute in a TEXTART XML element in an HML file.

The GD Star Rating plugin version 19.22 for WordPress has an SQL injection vulnerability that allows remote administrators to execute arbitrary SQL commands via the s parameter on the gd-star-rating-stats page in wp-admin/admin.php.