CVE Vulnerability Catalog

The Repositories component in Moodle through 2.3.11, and in versions 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote attackers to conduct PHP object injection attacks and execute arbitrary code via serialized data associated with an add-on.

Unspecified vulnerability in HP and H3C VPN Firewall Module products SECPATH1000FE before version 5.20.R3177 and SECBLADEFW before version 5.20.R3177 allows remote attackers to cause a denial of service via unknown vectors.

The home module in Fonality trixbox has a vulnerability that allows remote attackers to execute arbitrary commands via shell metacharacters in the lang parameter.

SQL injection vulnerability in endpoint_generic.php in Fonality trixbox allows remote attackers to execute arbitrary SQL commands via the mac parameter in a Submit action.

Multiple SQL injection vulnerabilities in ol-commerce 2.1.1 allow remote attackers to execute arbitrary SQL commands via various parameters in PHP scripts.

An unspecified vulnerability in the MailPoet Newsletters (wysija-newsletters) plugin before version 2.6.8 for WordPress may lead to unspecified impact and attack vectors.

The MailPoet Newsletters (wysija-newsletters) plugin before version 2.6.7 for WordPress allows remote attackers to bypass authentication and execute arbitrary PHP code by uploading a crafted theme.

Microsoft Windows XP SP3 does not validate addresses in certain IRP handler routines, allowing local users to write data to arbitrary memory locations. This can lead to privilege escalation via a crafted address in an IOCTL call, related to the MQAC.sys and BthPan.sys drivers.

Directory traversal vulnerability in the toServerObject function in HP Network Virtualization 8.6 allows remote attackers to create files, and consequently execute arbitrary code, via crafted input.

Directory traversal vulnerability in the storedNtxFile function in HP Network Virtualization 8.6 allows remote attackers to read arbitrary files via crafted input.

Apple QuickTime allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a malformed version number and flags in an mvhd atom.

Multiple SQL injection vulnerabilities in CWPLogin.aspx in Sabre AirCentre Crew products version 2010.2.12.20008 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) username or (2) password field.

Morpho Itemiser 3 version 8.17 has hardcoded administrative credentials, making it easier for remote attackers to gain access via a login request.

CVE-2014-5102 is an SQL injection vulnerability in vBulletin versions 5.0.4 through 5.1.3 Alpha 5. It allows remote attackers to execute arbitrary SQL commands via the criteria[startswith] parameter to ajax/render/memberlist_items.

Buffer overflow in ACME micro_httpd, used in D-Link DSL2750U, DSL2740U, and NetGear WGR614 and MR-ADSL-DG834 routers, allows remote attackers to cause a denial of service (crash) via a long string in the URI in a GET request.

SQL injection vulnerability in E2 before version 2.4 (2845) allows remote attackers to execute arbitrary SQL commands via the note-id parameter to @actions/comment-process.

Honeywell FALCON XLWeb Linux controller devices version 2.04.01 and earlier and FALCON XLWeb XLWebExe controller devices version 2.02.11 and earlier allow remote attackers to bypass authentication and gain administrative access by visiting the change-password page.

OleumTech WIO DH2 Wireless I/O Modules rely exclusively on a time value for entropy in key generation, making it easier for remote attackers to defeat cryptographic protection mechanisms by predicting the time of project creation.

OleumTech WIO DH2 Wireless Gateway and Sensor Wireless I/O Modules do not require authentication to read the site security key, allowing nearby attackers to spoof communication.