CVE Vulnerability Catalog

Heap-based buffer overflow in the png_combine_row function in libpng before 1.5.21 and 1.6.x before 1.6.16 may allow context-dependent attackers to execute arbitrary code via a 'very wide interlaced' PNG image on 64-bit systems.

A stack-based buffer overflow in Schneider Electric Wonderware InTouch Access Anywhere Server versions 10.6 and 11.0 allows remote attackers to execute arbitrary code via a request for a filename that does not exist.

Multiple directory traversal vulnerabilities in the file-upload feature in IBM PureApplication System and Workload Deployer allow remote authenticated users to execute arbitrary code.

The ASUS WRT firmware versions 3.0.0.4.376_1071, 3.0.0.376.2524-g0013f52, and others, used in RT-AC66U, RT-N66U, and other routers, have an issue with improper MAC address checking in requests. This allows remote attackers to bypass authentication and execute arbitrary commands via a NET_CMD_ID_MANU_CMD packet to UDP port 9999.

Multiple SQL injection vulnerabilities in the administrative backend in Sefrengo before version 1.6.1 allow remote administrators to execute arbitrary SQL commands via the (1) idcat or (2) idclient parameter to backend/main.php.

The AJAX Post Search (cardoza-ajax-search) plugin before version 1.3 for WordPress contains an SQL injection vulnerability in the 'the_search_function'. Remote attackers can execute arbitrary SQL commands via the srch_txt parameter in a 'the_search_text' action to wp-admin/admin-ajax.php.

The CformsII plugin version 14.7 and earlier for WordPress has an unrestricted file upload vulnerability that allows remote attackers to execute arbitrary code by uploading a file with an executable extension.

Use-after-free vulnerability in Xen 4.2.x, 4.3.x, and 4.4.x allows remote domains to cause a denial of service (system crash) via a crafted hypercall during HVM guest teardown.

The ProjectSend (formerly cFTP) has an unrestricted file upload vulnerability in process-upload.php that allows remote attackers to execute arbitrary PHP code by uploading a file with a PHP extension.

HumHub versions 0.10.0-rc.1 and earlier have an SQL injection vulnerability in the actionIndex function in ListController.php. This allows remote authenticated users to execute arbitrary SQL commands via the 'from' parameter to index.php.

In the Debian mime-support package before version 3.52-1+deb7u1, the run-mailcap tool allows context-dependent attackers to execute arbitrary commands via shell metacharacters in a filename.

An unrestricted file upload vulnerability exists in the InfiniteWP Admin Panel before version 2.4.4 in uploadScript.php. This allows remote attackers to execute arbitrary code by uploading a file with a double extension.

SQL injection vulnerability in the InfiniteWP Admin Panel before version 2.4.4 in execute.php allows remote attackers to execute arbitrary SQL commands via the historyID parameter.

An SQL injection vulnerability in the InfiniteWP Admin Panel before version 2.4.3 in login.php allows remote attackers to execute arbitrary SQL commands via the email parameter.

Directory traversal vulnerability in Sonatype Nexus OSS and Pro before version 2.11.1-01 allows remote attackers to read or write to arbitrary files via unspecified vectors.

CVE-2014-8084 in OSClass before version 3.4.3 has a directory traversal vulnerability that allows remote attackers to include and execute arbitrary local files.

SQL injection vulnerability in the Search::setJsonAlert method in OSClass before version 3.4.3 allows remote attackers to execute arbitrary SQL commands via the alert parameter in a search alert subscription action.

The frontend rendering component in TYPO3 versions 4.5.x before 4.5.39, 4.6.x through 6.2.x before 6.2.9, and 7.x before 7.0.2, when config.prefixLocalAnchors is set to 'all' or 'cached', allows remote attackers to conduct a 'Cache Poisoning' attack using a URL with arbitrary arguments, potentially leading to unspecified impact, possibly related to resource consumption.

The wfMangleFlashPolicy function in OutputHandler.php in MediaWiki before version 1.19.22, 1.20.x through 1.22.x before 1.22.14, and 1.23.x before 1.23.7 allows remote attackers to conduct PHP object injection attacks via a crafted string containing <cross-domain-policy> in a PHP format request.

In Microweber CMS version 0.95 before 20141209, there is an SQL injection vulnerability in Category.php that allows remote attackers to execute arbitrary SQL commands via the category parameter.