CVE Vulnerability Catalog

CVE-2014-5520 is a SQL injection vulnerability in XRMS CRM, possibly in version 1.99.2. It allows remote attackers to execute arbitrary SQL commands via the user_id parameter in plugins/webform/new-form.php, which is not properly handled by plugins/useradmin/fingeruser.php.

F5 BIG-IP Analytics 11.x before 11.4.0 uses a predictable session cookie, making it easier for remote attackers to guess its value.

Directory traversal vulnerability in the agentUpload servlet in ZOHO ManageEngine EventLog Analyzer 9.0 build 9002 and 8.2 build 8020 allows remote attackers to execute arbitrary code by uploading a ZIP file which contains an executable file with .. (dot dot) sequences in its name.

CVE-2013-1641 is a vulnerability in the zip download functionality in QuiXplorer before version 2.5.5 that allows remote attackers to read arbitrary files via a directory traversal attack using the .. (dot dot) in the selitems[] parameter.

The shell_quote function in python-gnupg 0.3.5 does not properly quote strings, allowing attackers to execute arbitrary code via shell metacharacters in unspecified vectors.

The Remote Controls feature on Samsung mobile devices does not validate the source of lock-code data received over a network, which makes it easier for remote attackers to cause a denial of service (screen locking with an arbitrary code) by triggering unexpected Find My Mobile network traffic.

The displayServiceStatus.php file in Centreon 2.5.1 and Centreon Enterprise Server 2.2 (fixed in Centreon web 2.5.3) contains a vulnerability that allows remote attackers to execute arbitrary commands via shell metacharacters in the session_id or template_id parameters, related to the command_line variable.

Multiple SQL injection vulnerabilities in Centreon 2.5.1 and Centreon Enterprise Server 2.2 allow remote attackers to execute arbitrary SQL commands. These issues have been fixed in Centreon web 2.5.3.

The Calendar Base (cal) extension before 1.5.9 and 1.6.x before 1.6.1 for TYPO3 allows remote attackers to cause a denial of service (resource consumption) via vectors related to the PHP PCRE library.

Unspecified vulnerability in Shim might allow attackers to execute arbitrary code via a crafted MOK list, which triggers memory corruption.

CVE-2014-3676 involves a heap-based buffer overflow in Shim that allows remote attackers to execute arbitrary code via a crafted IPv6 address, related to the 'tftp:// DHCPv6 boot option.'

Directory traversal vulnerability in ZOHO ManageEngine Desktop Central (DC) before version 9 build 90055 allows remote attackers to execute arbitrary code via a .. (dot dot) in the fileName parameter to mdm/mdmLogUploader.

Directory traversal vulnerability in ZOHO ManageEngine Desktop Central before version 9 build 90055 allows remote attackers to execute arbitrary code via a .. (dot dot) in the fileName parameter in an LFU action to statusUpdate.

Unspecified vulnerability in the management interface in Citrix NetScaler Application Delivery Controller (ADC) and NetScaler Gateway 10.x before version 10.1-129.11 and 10.5 before version 10.5-50.10 allows remote attackers to execute arbitrary code via unknown vectors.

SQL injection vulnerability in the MRBS module for Drupal allows remote attackers to execute arbitrary SQL commands via unspecified vectors.

SQL injection vulnerability in openSIS from version 4.5 to 5.3 allows remote attackers to execute arbitrary SQL commands via the Username and password to index.php.

The WordPress Spreadsheet (wpSS) plugin version 0.62 contains an SQL injection vulnerability in the ss_handler.php file, allowing remote attackers to execute arbitrary SQL commands via the ss_id parameter.

Schrack Technik microControl devices with firmware before version 1.7.0 (937) store sensitive information under the web root with insufficient access control. This allows remote attackers to obtain access data for ftp and telnet services via a direct request for ZTPUsrDtls.txt.

Multiple SQL injection vulnerabilities in the login in web_reports/cgi-bin/InfoStation.cgi in Innovative vtls-Virtua before version 2013.2.4 and 2014.x before version 2014.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) password parameter.