CVE Vulnerability Catalog

The Tomcat application credentials are hardcoded in the SonicWall GMS and Analytics configuration file. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.

The authentication mechanism in SonicWall GMS and Analytics Web Services had insufficient checks, allowing authentication bypass. This issue affects GMS: 9.3.2-SP1 and earlier versions; Analytics: 2.5.0.4-R7 and earlier versions.

The authentication mechanism in PowerShield SNMP Web Pro 1.1 contains a vulnerability that allows unauthenticated users to directly access CGI scripts without proper identification or authorization. This issue arises from a lack of proper cookie verification.

Online Piggery Management System version 1.0 is vulnerable to File Upload. An unauthenticated user can upload a PHP file by sending a POST request to 'add-pig.php.'

Online Piggery Management System version 1.0 is vulnerable to SQL Injection, which may lead to unauthorized access to the database.

Code-projects Online Restaurant Management System version 1.0 is vulnerable to SQL Injection. An attacker can exploit this vulnerability to bypass the admin panel and view order records, add items, delete items, etc.

The vulnerability in Rockwell Automation 1756 EN2* and 1756 EN3* ControlLogix communication products could allow a malicious user to perform remote code execution with persistence on the target system through maliciously crafted CIP messages. This includes the ability to modify, deny, and exfiltrate data passing through the device.

The vulnerability in DigiExam up to v14.0.2 lacks integrity checks for native modules, allowing attackers to access PII and take over accounts on shared computers.

The RocketMQ NameServer component still has a remote command execution vulnerability as the CVE-2023-33246 issue was not completely fixed in version 5.1.1.

The Orchid package, used for back-office application development, has a vulnerability related to the deserialization of untrusted data from the `_state` query parameter. This can lead to remote code execution. The issue has been addressed in version 14.5.0.

A vulnerability in the Windows Routing and Remote Access Service (RRAS) allows for remote code execution. An attacker can exploit this flaw to gain control over the system.

A vulnerability in the Windows Routing and Remote Access Service (RRAS) allows for remote code execution. An attacker can exploit this flaw to gain control over the system.

A vulnerability in the Windows Routing and Remote Access Service (RRAS) allows for remote code execution. An attacker can exploit this flaw to gain control over the system.

A vulnerability in Microsoft Office allows for a security feature bypass, potentially leading to unauthorized access to user data.

xalpha version 0.11.4 is vulnerable to Remote Command Execution (RCE).

WebsiteGuide v0.2 is vulnerable to Remote Command Execution (RCE) via image upload.

A buffer overflow in the level parsing code of RobTop Games AB Geometry Dash v2.113 allows attackers to execute arbitrary code via entering a Geometry Dash level.

A vulnerability has been identified in RUGGEDCOM ROX MX5000, MX5000RE, RX1400, RX1500, RX1501, RX1510, RX1511, RX1512, RX1524, RX1536, and RX5000 devices in versions below V2.16.0. The SCEP CA Certificate Name parameter in the web interface is vulnerable to command injection due to missing server-side input sanitation.

A vulnerability has been identified in RUGGEDCOM ROX MX5000, ROX MX5000RE, ROX RX1400, ROX RX1500, ROX RX1501, ROX RX1510, ROX RX1511, ROX RX1512, ROX RX1524, ROX RX1536, and ROX RX5000 in versions below V2.16.0. The SCEP server configuration URL parameter in the web interface is vulnerable to command injection due to missing server-side input sanitation.

A vulnerability has been identified in RUGGEDCOM ROX MX5000, ROX MX5000RE, ROX RX1400, ROX RX1500, ROX RX1501, ROX RX1510, ROX RX1511, ROX RX1512, ROX RX1524, ROX RX1536, and ROX RX5000 devices in versions below V2.16.0. The uninstall-app App-name parameter in the web interface is vulnerable to command injection due to missing server-side input sanitation.